One of the problems that has continued to plague Windows is the ability for users, administrative or not, to execute programs from unsafe temporary file system locations sometimes bypassing security controls. UAC has helped to reduce the attack surface along with the Windows integrity mechanism that monitors and restricts files based on a level of trustworthiness.  Combine that with a good anti-virus product and sometimes the bad stuff can still get through, even when accidentally executed from a dangerous location such as temporary internet files. Internet Explorer contributes to this problem as the only major browser on the market that actually allows execution directly from a download (which can happen accidentally). Chrome and Firefox require a download to be saved to disk first then manually executed after the download is completed. This alone is good enough reason to not use IE for daily casual browsing.

Microsoft’s AppLocker is a free built-in group policy utility that comes with the Enterprise and Ultimate versions of Windows that puts a stranglehold on the execution environment of the OS. Unlike the troublesome software restriction policies of long ago, AppLocker provides an intuitive and highly customizable framework to protect your PC and servers, if desired. AppLocker works for home or corporate PCs and can be configured using group policy. I have configured AppLocker on every Win7 PC I’ve built for friends or family for years and they do not have malware problems. Period.

Best practices for novice or intermediate user PCs:

• Users should not run as administrators, remove the user account from local admins
• Enable the local admin account and set a password
• Run a quality antivirus product
• Ensure UAC is enabled and set to the default level
• Configure AppLocker to protect the OS

Accessed from within the local computer security policy (gpedit.msc) or via group policy in a AD domain, AppLocker can be found in the Application Control Policies section below Security Settings.

A number of different rule types can be configured and new for Win8/ Server 2012, AppLocker now supports Packaged apps, which I’ll talk about in the section that follows.

Executable Rules

Executable rules are by far the simplest and most effective means of providing solid protection. First thing to do is to create the default rules: right-click in the white space in the right pane, click “create default rules.” These rules will ensure that executables can only be run from within the trusted program files and windows folders. Administrators will be allowed to execute any file regardless of file system location. Anything that is executed from the desktop or temp folders, for example, will be denied.

For the PC of a non-administrative user, to execute a file outside of the specified safe locations will require both intent and elevation via UAC to run; no accidents will be possible.

Applications that are not installed for “all users” of a PC are typically installed to a space in %userprofile%\AppData. These applications will need to be individually permitted or they will subsequently fail to run. The easiest method providing the best protection is to configure path rules for each application as required.

If this is too troublesome, a publisher rule will suffice which will cast a wider net allowing any application of a given publisher or product to execute. Move the slider to enforce more or less granularity as desired.

Windows installer and script rules can also be used to to provide further restrictions. Use care if you choose to enable these as frustration could ensue when trying to install certain applications afterwards.

Packaged App Rules

For Windows 8 and Server 2012, having the interface formerly known as Metro and apps to go with it, AppLocker provides a new mechanism to comprehend these “packaged apps.” The options are more limited but provide suitable protection and control.

Create a packaged app rule by first choosing a reference file from the Metro apps installed:

Adjust the slider to specify a publisher, package or version rule:

Enforcement

Any configured rules will be enforced by default unless you specify Audit Only in the enforcement properties.

For any configured rules to actually take affect, the Application Identity service must be running. Set the service to Automatic and start it.

Follow these recommendations and you should never have to clean another malware infested PC again. I honestly can’t remember the last time I’ve had to.

References:

Windows System Integrity Mechanism

AppLocker Technical Architecture

BitLocker is a useful hard drive encryption tool supported by the Enterprise and Ultimate versions of Windows7. Recovery is handled through the use of 48-digit keys that are generated for each host running BitLocker. Best practice and common sense is to configure your environment so that the recovery keys are stored in Active Directory. There are a number of scenarios in which the use of these keys are required to gain access to the OS. By default only members of the Domain Admins group has access to these keys which is very inconvenient if you have a delegated support staff that are not domain admins. 

You can grant your support group full control to the AD container housing computers with BitLocker enabled and they will still not be able to see the recovery keys. Delegation of this access is done via a script. Just copy the text below, save it to a file with a .vbs extension, and run cscript whatever.vbs from a DC or workstation with a Domain Admin logged in. The only thing you need to change in this script is the second line: enter whatever your support AD group is called here. This all of course only applies to Server 2008/R2 and Windows7.

'To refer to other groups, change the group name (ex: change to "DOMAIN\Help Desk Staff")
strGroupName = "DOMAIN\Help Desk Staff" 

' --------------------------------------------------------------------------------
' Access Control Entry (ACE) constants
' --------------------------------------------------------------------------------

'- From the ADS_ACETYPE_ENUM enumeration
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT      = &H5  'Allows an object to do something

'- From the ADS_ACEFLAG_ENUM enumeration
Const ADS_ACEFLAG_INHERIT_ACE                = &H2  'ACE applies to target and inherited child objects
Const ADS_ACEFLAG_INHERIT_ONLY_ACE           = &H8  'ACE does NOT apply to target (parent) object

'- From the ADS_RIGHTS_ENUM enumeration
Const ADS_RIGHT_DS_CONTROL_ACCESS      = &H100 'The right to view confidential attributes
Const ADS_RIGHT_DS_READ_PROP                 = &H10  ' The right to read attribute values

'- From the ADS_FLAGTYPE_ENUM enumeration
Const ADS_FLAG_OBJECT_TYPE_PRESENT           = &H1  'Target object type is present in the ACE
Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2  'Target inherited object type is present in the ACE

' --------------------------------------------------------------------------------
' BitLocker schema object GUID's
' --------------------------------------------------------------------------------

'- ms-FVE-RecoveryInformation object:
'  includes the BitLocker recovery password and key package attributes
SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}"

'- ms-FVE-RecoveryPassword attribute: 48-digit numerical password
SCHEMA_GUID_MS_FVE_RECOVERYPASSWORD = "{43061AC1-C8AD-4CCC-B785-2BFAC20FC60A}"

'- ms-FVE-KeyPackage attribute: binary package for repairing damages
SCHEMA_GUID_MS_FVE_KEYPACKAGE = "{1FD55EA8-88A7-47DC-8129-0DAA97186A54}"

'- Computer object
SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"

'Reference: "Platform SDK: Active Directory Schema"

' --------------------------------------------------------------------------------
' Set up the ACE to allow reading of all BitLocker recovery information properties
' --------------------------------------------------------------------------------

Set objAce1 = createObject("AccessControlEntry")

objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE
objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT
objAce1.Flags = ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT

objAce1.Trustee = strGroupName
objAce1.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS + ADS_RIGHT_DS_READ_PROP
objAce1.InheritedObjectType = SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION

' Note: ObjectType is left blank above to allow reading of all properties

' --------------------------------------------------------------------------------
' Connect to Discretional ACL (DACL) for domain object
' --------------------------------------------------------------------------------

Set objRootLDAP = GetObject("LDAP://rootDSE")
strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com

Set objDomain = GetObject(strPathToDomain)

WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName")

Set objDescriptor = objDomain.Get("ntSecurityDescriptor")
Set objDacl = objDescriptor.DiscretionaryAcl
 
' --------------------------------------------------------------------------------
' Add the ACEs to the Discretionary ACL (DACL) and set the DACL
' --------------------------------------------------------------------------------

objDacl.AddAce objAce1

objDescriptor.DiscretionaryAcl = objDacl
objDomain.Put "ntSecurityDescriptor", Array(objDescriptor)
objDomain.SetInfo

WScript.Echo "SUCCESS!"

Once the script has run successfully, the BitLocker Recovery tab will now be accessible in ADUC and ADAC.

 

Reference:

TechNet

Despite whatever you may feel about UAC for use on your home PC, it is a great tool for desktops in the enterprise. “Run As” served its purpose well in the XP days almost a decade ago (has it really been that long?). As much as I like UAC in my enterprise for easy elevation of administrative tasks and accompanied profile virtualization, it’s not without its shortcomings. Namely, it is lacking the ability to selectively elevate specific applications that, for whatever reason, require administrative privileges, without the user knowing an administrator’s password. The solution used to be to grant the users administrative privileges outright or try to figure out the required permissions for every file write, registry call, or function the application would need to perform (subinACL). There has to be a better way. The principle of least privilege is a best practice that should be enforced in all environments, which serves to protect the organization as a whole as well as the individual user.

The problem:

I have several legacy applications with custom device drivers, built-in updaters, or program dependencies requiring change or write access to files that live in protected system directories. I don’t want the user to have to call for support every time they need to run the program and I don’t want to grant them administrative access.

While researching solutions we came across a product called PowerBroker:Desktops by BeyondTrust. They just re-branded this product so it used to exist as Privilege Manager. As advertised this solution was designed to address my problem exactly. Not only that this product supports the ability to elevate MSI’s and Active-X controls. Windows 7 and Server 2008 R2 are fully supported. The solution is comprised of two parts:

1. The Manager which contains the GPO editor extensions and RSOP snap-ins.
2. The Client which is a kernel-mode driver that lives on the user's PC including group policy client side extension and WMI namespace (deployable via MSI)

The driver on the client PC watches processes launched locally and checks against any configured GPO rules. If a rule exists for a launched process, the driver elevates the security token for that process based on settings in the rule. The added value for this method is that when applications are elevated the file system is not virtualized as is the case with a default “run as admin” operation. Additional privileges are added to the user’s security token for that specific process when it’s launched. This is like adding the user to the Administrators group temporarily just for that process for the duration it’s run (sudo).

The Manager piece is installed on your domain controllers, very straight forward.

Once installed the new features are immediately available in GPMC. Create a new or edit an existing GPO. You will see a new settings container under both the computer and user sections of the policy called Computer Security and User Security, respectively.

Before you can get to creating new policy items you will have to configure licensing. Along with the new settings containers, you should see a new button between View and Help called Privilege Manager. Open the Licensing tool and you will see 3 tabs: Local, GPO, and Request. You can generate a new request from the tool or simply import and activate a license you have received. To enable you first have to import the license you have purchased, then deploy it to the GPO in which you have enabled Privilege Manager features.

Deployment is done via the GPO License tab.

Once the license is active you can begin setting up policies. There are a number of options at your disposal which at first glance look a lot like a software restriction policy.

Once the program information is supplied you can assign permissions, privileges, and integrity settings to it. You can get very granular at each level if you need to.

Under the last tab, Common, you can apply filters to your policy much like a GPO Preference item.

Testing

To test, I have set up a path rule for cmd.exe that will elevate a non-administrative user to the builtin\administrators group for this process alone. The PowerBroker client can be deployed via GPO or other systems management solution to the specific PCs that need it. A single service will run on the client PCs called BeyondTrust Reporting Service. To prove that this solution works I will use a tool deployed with the client called Policy Monitor (polmon) as well as execute a privileged command from the prompt.

Logged into a PC with my test user John Doe, with PolMon running, I launch cmd.exe. Polmon displays that cmd.exe has been invoked and that there is a rule match for this application. The rule is parsed and John’s security token is elevated for the cmd process only, as configured.

With my elevated command prompt running, John executes a GPResult /R which under normal user mode only displays information about the user account. Computer related information is normally denied from being displayed without command prompt elevation. As you can see John was able to display RSOP results for both the user and computer accounts. Not only that the file system is not virtualized as you can see from the working directory. The user sees no UAC or other prompts, the application just works.

A quick note on licensing. PowerBroker:Desktops is licensed per enabled user that has the client installed. The license is installed at an OU level of your choosing and enabled per GPO. According to the documentation, each active user in an OU will be counted as a user for PowerBroker. So as far as the software is concerned any user in an OU that it can see is considered an active user. BeyondTrust has a few ways to deal with this, both extremely fair. You can use an enterprise license, enabling access for all users, which requires an annual true-up where you prove the actual number of users using the product. The other option is buying x number of licenses and they will provide some additional license padding for growth. User licenses will run in the $30-40 range each so depending on the size of your environment is very reasonable.

But here's the rub...BeyondTrust will only issue you a temporary 30-day license until their invoice is paid. Yep, even if you buy through the channel! So if your reseller (their partner) doesn't pay their invoice, guess what? No permanent license for you. If your reseller (their partner) has net 60 terms with them, guess what, no permanent license for you. This is an extremely paranoid way to license a product that I have honestly not seen ever in over a decade in this business! I am over 60 days now, on my second temp license, and am still waiting for my permanent lic. The product definitely works but their licensing policy is asinine. Buyer beware!

PowerBroker:Desktops is an extremely clean solution that works exactly as advertised. For those of us that have to deal with badly written or legacy applications requiring administrative access, this solution is a winner. I have ~20 users that will need this functionality so at the quoted price point this solution is a great deal with the amount of time and frustration it will save.

Folder redirection has been around since Windows 2000 and has undergone significant changes since then. The core function is the same: take a local directory path and point it somewhere else, without the user knowing or caring that it isn’t local. The advantages of this are that your users can store their important documents “on the network” without having to map drives or instructing them to save in a certain location. You can selectively redirect documents and app data but exclude photos, music, etc if you choose. In this example, I am interested in redirecting My Documents for all users to a secure, redundant, and high performance NetApp Filer. Technologies involved are Windows 7 Enterprise, Server 2008 R2 DFS, and NetApp CIFS shares running on a FAS2020.

First thing, create your CIFS shares on the filer. The way NetApp NAS with the CIFS protocol works is that the filer actually becomes a member of your domain. You can even apply certain GPO settings to it! The stated domain type is incorrect as I’m running in 2008 R2 native mode, but this doesn’t affect anything functionally from what I can tell.

  

Your CIFS shares are then managed just like a regular Windows server. You can even connect to the filer via the computer management MMC.

Each share you create exists inside a volume and has an associated qtree. All the other NetApp goodies still apply: deduplication, snapshots, auto volume grow, and opportunistic locking. The rest of the options look very much like a regular Windows file server.

I have created a single hidden share called Users$ that sits in a 300GB volume. All of my user’s My Documents will live here. Following best practices, I have granted authenticated users full control to the share as I will control granular access permissions with NTFS. We’re ready to prepare the DFS namespace.

Now in my redirection GPO I could simply point all users to redirect to \\<filername>\users$\<username> but one of the values DFS provides is a consistent domain-based namespace: \\domain\<dfsRoot>\<redirection_root>\<username>. Everything that will exist as a file share in my environment will be accessible via a DFS namespace, much cleaner this way and much easier to change targets should I need to enact my DR plan which I would do via folder targets to my DR filer. I first create a new domain-based namespace in Server 2008 mode called Users (add a $ to the end to make it hidden):

This is simply the DFS root which lives in the local file system space on my namespace server (domain controller). To be able to point to my filer I need to create another folder inside of this DFS root, that can then be targeted to a matching folder on my NAS. So I will create a new folder called “root” on both NAS: \\cufas2\users$\ and DFS: \\domain.com\Users\. First create the new root folder on NAS then add a folder to DFS with a target that will point to the root folder on the filer. Additional targets can be configured and controlled for redundancy, replication, and DR.

Before we configure the GPO let’s set permissions on the Root folder. This is a critical step and is what will ultimately make or break this configuration. Since this is the root folder for the entire share, remove permission inheritance and set the following permissions:

• CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
• System - Full Control (Apply onto: This Folder, Subfolders and Files)
• Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
• Authenticated Users - Create Folder/Append Data (Apply onto: This Folder Only)
• Authenticated Users - List Folder/Read Data (Apply onto: This Folder Only)
• Authenticated Users - Read Attributes (Apply onto: This Folder Only)
• Authenticated Users - Traverse Folder/Execute File (Apply onto: This Folder Only)

This will allow all users to programmatically create their directory folders beneath the root folder as well as be granted full control to them without the ability to see anyone else’s folders. Domain Admins will have full control to all folders. Now we’re ready to set up our folder redirection GPO.

Folder redirection is a user configuration setting so the GPO that contains these settings must be linked to an OU that houses user accounts, or linked high enough in the AD tree so that user-housing OUs will inherit. Redirection can be set in basic or advanced mode, basic redirecting everyone to the same location. Advanced enables the opportunity to redirect users differently based on security group. In either case you can redirect to the user’s home directory, create a folder for each user under the specified root, redirect to a specific location or to the user’s local %userprofile% path. I will be using the “create a folder” option under the advanced mode and the path is the DFS root created earlier: \\domain.com\users$\root. For now the policy will apply to one group, domain users, but I will have future flexibility should I need to have additional groups redirected differently. The effect of this policy is that each user, once successfully redirected, will automatically have a new folder under the root directory named after their username, with the documents folder beneath it. Any other folders I choose to redirect will also live under this %username% directory.

Additionally, you can grant the user exclusive access to their folder which keeps out even domain admins and creates problems for backups. Since we’ve set very specific permissions on the root we don’t need to worry about this anyway. The other pertinent option is to move the contents of the source to the destination which I have had problems with in my environment. I’ll be leaving both of these unchecked.

Now when a user logs into any machine in the enterprise they will see the exact same documents folder which lives safe and sound on an enterprise storage array. Should the primary array fail, DFS will repoint their redirected documents to a DR filer in another datacenter.

 

Something else to consider for your laptop users is offline files in conjunction with folder redirection. I have this enabled by default for all laptops and expressly disable them for desktops. This is a good compromise so that laptop users will enjoy the benefits of redirection while in the office but will also be able to access and work on these documents while away. The next time they connect to the corporate network any changes they made to an offline file will sync back up with their redirected folders on the NAS.

I came across a thread in the TechNet forums discussing printer queue naming best practices. One of the Microsoft Printing Team members chimed in to explain how they do it internally in Microsoft.

At Microsoft the printer names are associated only with locations + A, B, C and CLR if it’s color.

Possible examples: Sales-A-CLR or Bldg3_Flr2_West-A

They then include more detail in the location field and device brand, model, PCL/PS, etc in the comments field. This way the queue (name) is not married to a specific printer type. When they physically replace a printer they only have to change the driver and port name, then update the comments. A very clean and simple way to do it.

When the user searches for network printers using AD they will see:

NAME (this is the share name of the print queue)

LOCATION (text has been entered in the location field of the print queue)

MODEL (driver in use on the print queue – very misleading unless 1:1 always in place)

SERVER NAME (the print server where the print queue resides)

COMMENTS (text has been entered in the comment field of the print queue)

Reference:

Technet Forums

1. Install Server 2008 R2 on servers to become DCs, all applicable drivers, and Windows updates.
2. Assign static IP address (disable IPv6 if you don’t plan to use it).
3. Enable Active Directory Domain Services role.
4. Run DCPROMO to begin AD installation. Separate the AD database and logs on different disks (RAID 1 ideally), keep SYSVOL with the database.
5. Install DNS, ensure that Dynamic Updates are set to Secure Only. Set the domain controller to point to it’s own production IP address for DNS resolution.
6. Configure sites, add subnets, configure replication (rename default links).
7. Distribute FSMO roles according to best practices.
8. Configure NTP on DC holding the PDCe FSMO role. (see time services refresher posted earlier)
9. Build OU structure.
10. Make copies of default GPOs, rename the copies, and unlink the originals.
11. Install DHCP role, configure scopes. (2008 R2 includes a nifty split scope wizard)
12. Enable AD recycle bin.
13. Set up ADMX central store.
14. Create starter GPOs in GPMC (optional).
15. Run dcdiag and repadmin, correct any errors or failures.
16. Check event logs on all DCs, correct any errors or misconfigurations.
17. Backup system state on each DC, using Windows Server Backup or a 3rd party solution.

Time services play a pivotal role in the Kerberos authentication process, so ensuring that they are set up properly is important. With the exception of a few deprecated time-related command switches, not a lot has changed with regard to time in Server 2008/ Windows 7. Having just upgraded a 2008 domain to 2008 R2 with new domain controllers I wanted to share the process of setting up time services for the domain.

By default the DC that holds the PDC Emulator role is the time keeper for the domain. Also in its default state the PDCe assumes that it is itself the stratum 1 time provider, as reflected in the registry key value \HKLM\System\CurrentControlSet\services\W32Time\Parameters: Type NT5DS. This value controls the synchronization type which specifies if time is to be received from the domain hierarchy (NT5DS) or from an external provider (NTP). The default is fine if you’re alright with the server using its own CMOS clock to provide time for the domain. In this case all you need to do is configure the Announce Flags (see KB). To force the DC to use an external time provider, on the DC that holds the PDCe role, change this value to “NTP”. Per RFC 1305 (via MS KB816042), the PDCe must not be configured to sync time with itself.

NTP.org maintains the lists for publicly accessible time servers. Pool servers, stratum 1 (primary) and stratum 2 (secondary) servers are documented here. You can configure your PDCe to point directly to several stratum 1 servers, or you could just point to the pool addresses which employs DNS round robin to ensure you always have a reliable stratum 2 time source. In this scenario I will be pointing to the US pool servers: us.pool.ntp.org.

Net Time is still alive in Server 2008 but /querysntp and /setsntp have been deprecated. Configuration must be performed via W32tm.exe. Since we now have our PDCe set to sync to an external time source, we need to configure its peer list which can be FQDNs or IPs. This is done via: w32tm /config /manualpeerlist:"0.us.pool.ntp.org 1.us.pool.ntp.org 2.us.pool.ntp.org 3.us.pool.ntp.org"

Run a quick update with w32tm /resync /rediscover then verify the configuration is working by running w32tm /query /peers /verbose

C:\Windows\system32>w32tm /query /peers /verbose
#Peers: 4

Peer: 1.us.pool.ntp.org
State: Active
Time Remaining: 37.7327154s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 0.us.pool.ntp.org
State: Active
Time Remaining: 37.6859151s
Mode: 1 (Symmetric Active)
Stratum: 3 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 2.us.pool.ntp.org
State: Active
Time Remaining: 37.6859151s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

Peer: 3.us.pool.ntp.org
State: Active
Time Remaining: 37.7015152s
Mode: 1 (Symmetric Active)
Stratum: 2 (secondary reference - syncd by (S)NTP)
PeerPoll Interval: 8 (256s)
HostPoll Interval: 8 (256s)
Last Successful Sync Time: 9/1/2009 3:32:37 PM
LastSyncError: 0x00000000 (Succeeded)
LastSyncErrorMsgId: 0x00000000 (Succeeded)
AuthTypeMsgId: 0x0000005A (NoAuth )
Resolve Attempts: 0
ValidDataCounter: 8
Reachability: 255

The other DCs will look to the PDCe as their time source and domain clients will look to their authenticating DC. If you need to get more granular with time services there are a few GPO settings capable of some good granularity. “Computer Configuration\ Administrative Templates\ System\ Windows Time Service” contains policy items to configure polling intervals, phase corrections, or to disable the client altogether, which is useful if you need to implement a 3rd-party NTP solution in your organization. If any other domain clients or servers need to be updated immediately, simply run w32tm /resync /rediscover.

References:

NTP.org time server lists

How to configure an authoritative time server in Windows Server

New for Server 2008 R2 and Windows 7 is the AD admin center (part of the Windows 7 RSAT). A UI based on PowerShell, ADAC provides a slightly richer experience over the MMC-based ADUC. Object-related tasks are clearly visibly, object properties are consolidated in a single flowing pane, multiple domains can be seamlessly managed, and new query abilities make up some of the major improvements.

All aspects of a computer or user object can be managed from one intuitive interface, although a majority of the tabbed extensions still exist in the new pane. Account, Org, Member of, and profile were broken out separately.

Another nice feature is that you can quickly view many advanced details about an object such as last log on, SIDs, USNs, and GUIDs.

Filtering allows administrators to perform searches through the directory to quickly determine many details such as disabled or locked accounts, accounts that haven’t logged on in x days, etc.

I’m not sure I’m ready to give up ADUC just yet for ADAC but I’ll keep playing to possibly uncover additional value.

A few minor things have changed since the RTM build of 2008 R2 dropped with regard to this feature. Here is a quick recap and overview.

First your domain must be running in Server 2008 R2 forest and domain functional level, which means all of your DCs must be running 2008 R2.

Once this is achieved you will be allowed to enable the recycle bin AD feature (which must be done from the DC holding the Domain Naming master role).

To verify that the feature was successfully enabled fire up ldp.exe in admin mode. In the 2008 R2 RC the deleted objects container was now visible but in RTM it isn’t. Hit View—>Tree—> and select the Configuration partition for the BaseDN. Expand down to the Partitions container and verify the recycle bin has been enabled under msDS-EnabledFeature.

Ok good, the feature is enabled but we still can’t see the deleted objects container nor any objects that we delete at this point, even though the container is visible in the well known objects list. This is because the container itself is marked as deleted. Deleted object restore or view operation attempts will fail at this point as well.

To change this, with the domain root selected as BaseDN, click Browse—>Search, enter CN=Deleted Objects,DC=domain,DC=com for the Base DN, change the filter from * to user, then click options. Change the search call type to extended then click the controls button. In the “Load Predefined” drop down select “return deleted objects” and double-click the 1.2.xx item in the active controls pane. Click Check in, then Ok. The TechNet link at the bottom goes into greater detail about this.

Refresh the tree and you should now see the deleted objects container. You should now be able to view and restore your deleted objects via ldp or PowerShell.

Reference:

TechNet

HP’s Integrated Lights Out is an out-of-band management feature, provided throughout the Proliant server line, that allows for remote server management via a dedicated module and private network connection. The iLO operating system is firmware based and can be flash upgraded from within the iLO environment itself, from within the server OS, or remotely. Access control can be defined per iLO system using local user accounts (default) or via Active Directory. To integrate with AD the schema must first be extended, iLO objects created, logon policies defined, and policies configured in each iLO management processor (MP).
One of my favorite, albeit extremely hard to find, tools is HP’s Lights-out Migration Utility. Using this tool, one can extend the AD schema to support iLO integration, install management plug-ins into the ADUC MMC, manage the firmware of entire networks of iLO devices at once, and configure the access method for all iLO devices as well.
When first loading the utility package you are presented with three options: Schema Extender, Snap-ins, and Directories Migration Utility. If you’re just looking to mass-manage the firmware of your iLOs you can skip the first two options. If you want to extend your AD schema to integrate your iLOs just go down this list in order as it is fairly self explanatory. The rest of this blog entry will focus on the third option, the Directories Migration Utility.
Clicking the third button will invoke the migration utility installer which will create a start-menu shortcut for easy access. When first launching the utility, the startup screen outlines the steps that the tool provides. Although this tool was intended to be used for LDAP-integration it can serve as a great general purpose bulk iLO management tool.
While it’s scanning, go ahead and prepare the latest firmware images for each iLO version in your environment. The tool will discover iLO and iLO2 and can upgrade both versions simultaneously. The easiest way to do this is to download the “Online ROM Flash Component for Windows-HP Integrated Lights-Out2” (or iLO v1) and EXTRACT the files, don’t install. In the extracted files look for <device name>_<firmware version>.bin, i.e. ilo2_178.bin. Pull this file out and store somewhere convenient. Repeat for iLO v1 firmware.
Once all your iLOs have been discovered, on the next screen you can point to each iLO version image file and upgrade the firmware of each that needs it. *Please note that your iLO MP will reboot as part of the flash process so any network monitoring will report a brief outage.
I don’t know why it’s so hard to find this utility on hp.com but it is. It is definitely a great tool to have in your arsenal if you manage a Proliant shop!

Here is version 2.01: http://goo.gl/TZBc1