HSPD-12 and Active Directory Domains -Documents Updated

Microsoft has updated their documentation regarding HSPD-12 Logical Access Authentication and Active Directory Domains

These documents are probably going to be more valuable to those that support federal customers in the US but they are a good read for anyone planning to deploy smart cards in their environment.

For those not familiar with HSPD-12 in a nut shell it is a mandate for federal organizations to issue common ID/Smart cards to their users.  This comes into play in the Active Directory arena as the cards are used for login using two-factor authentication/smart card login.  The two-factors in this case are:

• Something the user has - the smart card
• Something the user knows - PIN

Everyone has seen this referenced in the Account tab of a user in AD Users & Computers.

Those in the military or who have supported US Military customers will hear the term CAC Card used for their smart cards. Those supporting civilian agencies/.gov will hear the term PIV Card for their smart cards.

You can get the updated Microsoft documentation here:

HSPD-12 Logical Access Authentication and 2008 Active Directory Domains 

Kurt Hudson has a good quote about the documents on the Windows PKI Blog

Included within this document are detailed steps to configure Windows Server 2008 R2 Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), Windows® 7, and Microsoft® Office 2010 to perform traditional UPN based smart card logon, explicit smart card logon (client authentication certificate mapped to multiple accounts), explicit cross-forest smart card logon and NIST SP800-78-3 compliant S/MIME email exchanges. 

Smart card/HSPD-12 adoption within agencies varies.  DoD has definitely been the leader in this space.  There are other agencies that I've been at that are also rolling but there are also those that haven't even started issuing smart cards to the majority of their users yet.   I'm not naming names here :)

Windows Server 8 Member Server - ADAC Recycle Bin

Windows Server 8 Beta was released a few weeks ago and I understand that many organizations may be hesitant to start deploying domain controllers.

One nice thing is that some of the new features can easily run on a member server or workstation and work fine in your current domains.  You don't need to convince anyone about a schema update or new Windows 8 Domain Controllers right now.  Enjoy the new features with no risk (I'd argue there is not a lot of risk in adding a domain controller but I understand leadership wanting to wait on domain controllers)

One of those features is the AD Recycle Bin GUI. That is a nice addition that system administrators have been asking for since 2008 R2 was released. Your forest does have to be at 2008 R2 Forest Functional Level to enable the recycle bin.

Many people enabled and used the AD Recycle Bin in 2008 R2  There are even some 3rd party tools that can help and put a GUI front end around the Recycle Bin. In my opinion the GUI in Windows Server 8 is much nicer and is definitely a reason to add a Windows Server 8 member server now.

In my lab I have a 2008 R2 (forest functional level 2008 R2) Domain Controller and a Windows Server 8 Beta member server.

Windows 2008 R2 Domain

SIDE NOTE: As you can see my test domain is named USMCThanksForYourService.mil I've heard there might be some Marines stationed in Afghanistan reading this entry so a heartfelt thanks for all you all do. It takes a lot of courage to be in the military right now and you all are on the front lines. THANK YOU!!


SIDE NOTE II:  .  Any other military members reading my blog?  Leave a comment, I'd love to hear from you.

So people don't think I'm cheating I'll first verify that the Recycle Bin is not enabled by using the powershell command Get-ADOptionalFeature -Filter {name -like "*Recycle Bin*"} If EnabledScopes is empty that indicates the Recycle Bin has not been enabled.

AD Recycle Bin not enabled

I also join the Windows Server 8 Beta machine to the domain.

Adding Windows 8 Server to the domain

Once the server is added to the USMCThanksForYourService.mil domain I have to install the Remote Server Administration Tools (RSAT) Feature for Active Directory so I can have access to the necessary AD tools and fetures.

Adding Roles and Features in Server Manager

Adding RSAT Features

Adding RSAT Features Part II

Once the RSAT tools have been installed you are ready to use Active Directory Administrative Center (ADAC) against your 2008 R2 domain.

You can enable the AD Recycle Bin from the GUI now instead of the old way using Powershell 

Selecting ADAC from Server Manager in Windows 8

Enabling the AD Recycle Bin from Windows Server 8 Member Server ADAC

AD Recycle Bin Confirmation 1

AD Recycle Bin Confirmation 2

Just want to confirm that the AD Recycle Bin has been enabled.  Notice this time the same command yielded an entry in "EnabledScopes"...success

AD Recycle Bin Enabled - Confirmation

 A quick tutorial of the new feature now that it is enabled and the member server is up and ready to go.

As you can see there is a user named Dakota Meyer who is in the group "MedalofHonor"

A young contractor was really excited and lost his mind and accidentally deleted the account.   Luckily the USMC leadership had allowed this Windows 8 Member Server and Dakota's account would be restored in a few clicks.

In ADAC Navigate to the Deleted Objects Container

Notice the deleted user is listed.  Right click on the user for Restore Options

In ADAC we confirm that the user has been successfully restored

On the 2008 R2 DC the restore is confirmed using ADUC

Windows Server 8 Beta - Schema Version - Update

I previously posted a "quick-hitter" blog about the Active Directory Schema version in Windows 8 Developers Preview.

Windows Server 8 Beta has been out for over a week now and I have a domain controller in my lab for testing.  The schema version is now 52


I once again used adfind to quickly find the schema version.

I've updated the Active Directory Schema version table below.

Windows Server 8 Beta	52
Windows 2008 R2	47
Windows 2008	44
Windows 2003 R2	31
Windows 2003	30
Windows 2000	13

Windows Server 8 Beta and VMware Tools

I am running VMware workstation 8.0.2 build-591240 to test Windows Server 8 Beta.  I'm doing this on my Windows 7 machine.  Right now there is no Microsoft hypervisor that runs on top of Windows 7/client OS that will support a 64 bit operating system (that changes with Windows 8)

The installation of Windows Server 8 Beta went fine and I had no issues with that.  I then tried to install VMware Tools

After the installation of VMWare tools the Windows Server 8 Beta box became unresponsive and the screen was black and the VM was unusable.  I had a snapshot so I went back to that and was able to work and test.

I looked around the VMware site and found a blog entry about running Windows 8 CP in Workstation 8

That didn't really help because my issue is with Windows Server 8.  I started reading the comments and noticed that there were others having this exact issue.  Some folks suggested enabling 3D Acceleration on the VM.

I enabled the feature and then installed VMware tools again and this time the VM booted up fine.  No black/unresponsive screen.

I hope this helps others trying to install VMWare tools with Windows Server 8.

Windows Server 8 DCPromo Error - FIXED

In a previous post  I showed that there was an error if trying to set the forest and domain functional levels to Windows 8 during DCPROMO using Windows 8 Developers Preview.

Now that Windows Server 8 Beta/Consumer Release Preview has been released I tested the promotion process again.

I once again selected Windows Sever 8 for my functional levels

I am very pleased to report that I no longer receive the same error that I mentioned with Windows Server 8 Developers Preview.

After the promotion is done the Functional Levels are set to Windows Server 8

Nice job with the fix Microsoft AD Team!  

I don't have a comprehensive list of features that are dependent on Windows Server 8 functional levels (forest & domain).  When I have that list I'll post it.

Enjoy Windows Server 8 Beta!

Goodbye Old Friend

Last night I had to do one of the toughest things any pet owner ever has to do and that is to make the decision to put my cat down.

My cat was 20 years old and I'd had her for the last 12.  She was battling the final stages of kidney failure and had deteriorated badly over the last few days.  She also had a small mass in her stomach that was probably cancer. I could have tried to give her more time by giving her IV fluids at home but nothing was guaranteed and I didn't want to put either of us through that.

Growing up I always thought of myself as a dog person.  My good friend John and his wife were starting a family in the late 90's and had two cats that they could no longer give all their attention to.  I'm not sure how the discussion happened but my brother and I took them both in.  At the time we were living in a shitty apartment but had room for them.  It ended up being one of the best decisions I've ever made.

Growing up as dog owners we didn't know what cats were like but they both ended up being really great pets.  Cats are definitely easier than dogs to take care of and yes although they worked and played on their schedule they still gave the same unconditional love that any beloved pet gives.  That is probably the greatest thing about a pet. You give them some attention and care for them and they return it back ten fold.

Max is one of the final links to my youth.  When we got her I was recently out of the Army.  My brother and I were both starting out with entry level jobs at the time and 12 years later so much has changed but Max was the one constant and I'll miss that a lot. Looking back Max and her sister who died four years earlier taught me that I'm actually a dog & cat person.

I don't know when or if I'll get another pet. Losing them is so tough. I hate going through this every time but I remember all the good years.

My girlfriend Michelle went with me last night and I can't repay or thank her for doing that.  It's tough times like that when you really see what a person is made of and she was there for me.  Also a special thanks to Dr. Reese at TLC in Leesburg, VA  Dr. Reese is a cat owner and lover herself and was very caring and compassionate with Max until the end.  I have no idea how Vets deal with that day in and day out but I'm very glad there are those that go into that profession.

Goodbye Old Friend...Thanks for always being there.

Max
1992 - Feb 2, 2012

Find Non Replicated Attributes in Active Directory

The quick hitter series is back and this entry was inspired by a colleague (thanks Funk!)

If you are querying AD you may get inaccurate results if you are querying an attribute that is not replicated between all domain controllers.   Two common attributes I see people having issues with are lastlogon and whenchanged.  The issue here is suppose you query for lastlogon and get a value.  That may not be accurate as there may be a newer value on another DC.  On a side note for that issue lastlogontimestamp is usually good enough for most folks...but I digress.

Is there a way to find what attributes are not replicated between DCs?  The answer to that is yes and there are various methods to find this information.  I once again go to the great ADFIND tool from MVP Joe Richards   Joe was recently awarded the MVP for the 10th straight year and that is well deserved.

Adfind has a ton of great shortcuts and one of them is to find non-replicated attributes.

adfind -sc norepl cn -nodn

I only outputted the cn of the object and didn't need the distinguished name so left that off with -nodn

You can see part of the output below.  Notice the whenchanged attribute that was mentioned earlier.

systemFlags contains a flag that defines if an attribute is replicated.  As you can see in the link if the value 1 is applied to an attribute it will not be replicated.  So you could also get fancy with adfind and do something like

adfind -schema -bit -f  "&(objectclass=attributeschema)(systemflags:AND:=1)" cn -nodn

That should give you the exact same result as the previous command.  I'd personally always go with the shortcuts...they are there to make things easier...thanks Joe :)