Menu Sidebar
Menu

Backup & Restore Active Directory integrated DNS zones

DNS is one of the core components for Active Directory Domain Services. In a disaster scenario, it becomes impossible to locate resources within the network and all AD operations come to a screeching halt. Therefore, it’s absolutely necessary to restore the DNS servers. One way to set this right is by performing an AD DS authoritative restore by using Microsoft’s preferred method for backing up a DNS server by performing a system state backup. That process is a time-consuming and a complex process in which the domain controllers must be restarted for the changes to take effect also you will also end up restoring the Registry, Active Directory database and a number of other components. Eventually, it leads to increased downtime, which impacts productivity.

Luckily, it’s possible to back up a DNS server independently using PowerShell.

Backup:

For AD integrated zones, the support tool dnscmd.exe can get the job done. To back up any DNS zone with dnscmd.exe, you just need to use the /zoneexport switch with the command. To back up the Zone1.com zone locally on a DNS server, you’d run the below command on the DNS server:

where DC1 is DNS server name, This command writes a copy of the Zone1.com zone to the %systemroot%\system32\dns\backup\Zone1.com.dns.bak file.

Note that the command doesn’t overwrite existing files, so if you’re including it with a backup script, be sure to move the file to an alternate location after the export completes, or to rename or delete the current backup file before you run a new dnscmd /zoneexport job.

PowerShell Script to backup DNS:

Restore:

Make sure the zone does not exist on DNS manager as it will give an error. If you need to re-create a new zone from the export file, you’ll find that you can do this by using dnscmd.exe with the /zoneadd switch. The only catch with this approach is that if you’re looking to recover an AD-integrated zone, you need to add the zone as a primary first and then convert it to AD-integrated. For example, to recover my Zone1.com zone:

Note that the backup file needs to reside in the %systemroot%\system32\dns folder for it to be properly discovered.

The /load switch to tell the command to load the configuration from the existing file. Without it, the command will create a new zone data file that will overwrite the contents of the backup file.

After adding the zone to the DNS server, you can convert it to an AD-integrated zone by running:

At this point, you can then enable secure dynamic updates for the zone by running:

This command configures the zone to accept only secure dynamic updates, as specified by the allowupdate value of 2 (use 0 to specify No dynamic updates, 1 for nonsecure and secure dynamic updates).

PowerShell Script to restore DNS:

Note that this script will work to “recreate” a DNS zone. If the zone you are trying to restore is still present on the DNS Server, the dnscmd.exe utility will return a warning information telling you that the zone already exists. You might need to delete the zones before restoring them.

Fix Active Directory broken security inheritance problem

Ran into a situation at a client location where in Active Directory, the security permissions applied to an OU were not getting inherited permissions on to the objects. Basically, security inheritance was broken.This causes a problem when the administrative accounts or groups needing to modify an attribute on the AD object throw errors, or are unable to edit the AD object.

To find out which objects were not getting the inherited permissions run the following :

I ran it on the entire domain to identity potential problem accounts. 🙂

To fix the issue:

Reference:

https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.objectsecurity.areaccessrulesprotected?view=netframework-4.8
https://blogs.msdn.microsoft.com/adpowershell/2009/10/22/viewconfigure-protected-acl-and-fixing-broken-inheritance/

List all SPNs in Active Directory

Ran into a situation where I needed to get all the SPNs that are listed in AD.

Find duplicate SPNs

Listing duplicate SPNs is fairly easy, just use setspn -X on your command-line and you’ll find out.

What is a SPN?

An SPN or Service Principal Name is a unique identity for a service, mapped with a specific account (mostly service account). Using an SPN, you can create multiple aliases for a service mapped with a domain account.

SetSPN command-line

To set, list or delete the SPN, we use an in-built command line tool SETSPN provided by Microsoft.

Quite some scripts assume you’re looking for a specific SPN (HTTP/…), a specific user, or a specific computer. For example, using setspn to find SPNs linked to a certain computer:

Or setspn to find SPNs linked to a certain user account:

Now we need a script to list all SPNs, for all users and all computers.

Get All SPNs

SPNs are set as an attribute on the user or computer accounts. That makes it fairly easy to query for that attribute.

Powershell to the rescue!

 

Get All DCs in the Entire Forest

Getting a know a new environment for a new client and I a quickly needed information about all domain controllers in the entire forest.

Wrote a small little script to provide me all the information I needed:

 

Determine & Change Tombstone Lifetime in Active Directory

Recently, I wanted to know what the tombstone lifetime was in my environment and decided to find this using PowerShell. There are a number of ways I could do this but dong it through PowerShell would be much easier. For those of you that are new to the attribute, a good explanation of it is:

The number of days before a deleted object is removed from the directory services. This assists in removing objects from replicated servers and preventing restores from reintroducing a deleted object.

Tombstone Lifetime  is used to determine how long a deleted object in the Active Directory database (NTDS.dit) is stored. When object is deleted, it does not immediately delete from the AD database. Instead, the object as deleted is marked where the is-Deleted attribute is set to true. Additions, most attributes are removed and the object will be renamed as follows: CN=<old RDN>\0ADEL:<objectGUID>

After renaming the object is moved to the hidden Deleted Objects container. At this time, the deleted object is referred to as tombstone. Then replicates these changes to all other DCs. Only when the tombstone lifetime has been exceeded, the object is permanently removed from the AD database.

The tombstone lifetime is set with the install of the first DCs in a forest for all domains. The tombstone lifetime is not configurable per domain.

Windows 2000 (all SPs) = 60 days

Windows Server 2003 without SP = 60 days

Windows Server 2003 with SP1 = 180 days

Windows Server 2003 R2 with SP1 installed with both R2 discs = 60 days

Windows Server 2003 R2 with SP1 installed only with the first R2 Disc = 180

daysWindows Server 2003 with SP2 = 180 days

Windows Server 2003 R2 with SP2 = 180 days

Windows Server 2008 = 180 days

Windows Server 2008 R2 = 180 days

Windows Server 2012 = 180 days

Windows Server 2012 R2 = 180 days

Windows Server 2016 = 180 days

Windows Server 2019 = 180 days

More info:https://docs.microsoft.com/en-us/previous-versions/technet-magazine/cc137800(v=msdn.10)

AD Recycle Bin

The AD Recycle Bin enables rapid restoration of deleted objects without a restore operation by implementing two new attributes, and using two existing attributes:

  • isDeleted

    • Has existed since Windows 2000
    • Exists on every object
    • Describes if an object is deleted but restorable
  • isRecycled

    • New to Windows Server 2008 R2
    • Exists on every object once it is recycled
    • Describes if an object is deleted but not restorable
  • msDS-deletedObjectLifetime

    • New to Windows Server 2008 R2
    • Is set on the “CN=Directory Service,CN=Windows NT, CN=Services, CN=Configuration, DC=COMPANY,DC=COM” container
    • Describes how long a deleted object will be restorable
  • tombstoneLifetime

    • Has existed since Windows 2000
    • Is set on the “CN=Directory Service,CN=Windows NT, CN=Services, CN=Configuration, DC=COMPANY,DC=COM” container
    • Describes how long a deleted object will not be restorable

Basically, I wanted to know how long I had to recover  if (in my case) one of my domain controllers were down for an extended period of time. For more information on the fun that can occur if this happens and it is down beyond the tombstone lifetime, check out this article: http://technet.microsoft.com/en-us/library/cc786630(v=ws.10).aspx

Determining Tombstone Lifetime:

PowerShell Code:

Upon successful execution it should return a numeric value and that’s how many days before the DC tombstones.

Did you know...
If the attribute’s value shows blank then it is setup as ‘not set’ , the tombstone lifetime of the forest is 60 days.

This happens if your enviornment has gones throught a few generations of upgrades! 🙂

Changing Tombstone Lifetime:

PowerShell:

This same process can be leveraged to identify the msDS-deletedObjectLifetime value (180 days by default).

The tombstone lifetime of an AD forest can be modified using the ADSIEdit tool by following this procedure:

  1. At an elevated command prompt, type adsiedit.msc.
  2. Right-click ADSI Edit in the left pane and select Connect to.
  3. In the Connection Point section, select the Select a well known Naming Context radio button and select Configuration from the dropdown list.
  4. Expand Configuration; CN=Configuration,DC=<forest_root_domain>; CN=Services; and CN=Windows NT
  5. Right-click CN=Directory Service and select Properties.
  6. In the Attribute Editor tab of the properties window, locate the tombstoneLifetime attribute. The value of this attribute represents the forest’s current tombstone lifetime in days. If the attribute’s value shows <not set>, the tombstone lifetime of the forest is 60 days.
  7. To modify the tombstone lifetime, click Edit.
  8. Type the desired tombstone lifetime and click OK. Click OK again to close the properties window. The change takes effect immediately.

How to Enable or Disable Collect Activity History in Windows 10

Microsoft Windows 10 still collects activity data even when tracking is disabled., but there is a new workaround way to block it. 🙂

Starting with Windows 10 build 17040, Microsoft added settings that let you to view and manage your activity history, which Cortana uses to let you pick up where you left off. Your collected activity history allows you to jump back into what you were doing with apps, docs, or other activities, either on your PC or your phone. To resume your activities, Windows needs to collect your PC activity.

If you like, you can enable or disable letting Windows collect User Activities.

If enabled, Let Windows collect my activities will be turned on for all users, but users will still be able to turn this setting on or off for their account.
If disabled, Let Windows collect my activities will be turned off for all users, and users will not be able to turn this setting on or off for their account.

To enable or disable Activity history settings to let Windows collect User Activities for all users in Windows 10.

You must be signed in as an administrator to enable or disable online tips and help for the Settings app
Timeline requires the Windows Search service to be enabled, running, and set to Automatic (Delayed Start).

 

Enable or Disable Collect Activity History in Local Group Policy Editor

Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option TWO below.

1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)

Computer Configuration\Administrative Templates\System\OS Policies
 In the right pane of OS Policies in Local Group Policy Editor, double click/tap on the Allow publishing of User Activities policy to edit it. (see screenshot above)

4. Do step 5 (enable) or step 6 (disable) below for what you would like to do.

 5. To Enable Collect Activity History – Select (dot) Not Configured or Enabled​ (recommended), click/tap on OK, and go to step 7 below. (see screenshot below)

NOTE: Not Configured is the default setting.
 6. To Disable Collect Activity History – Select (dot) Disabled, click/tap on OK

Enable or Disable Collect Activity History using a REG file (Workaround) 🙂

The downloadable .reg files below will add and modify the DWORD value in the registry key below.
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
PublishUserActivities DWORD
0 = Disable
1 = Enable
To Enable Collect Activity History
Download : Enable_Activity_history.reg
To Disable Collect Activity History
Download : Disable_Activity_history.reg
  •  Save the .reg file to your desktop.
  • Double click/tap on the downloaded .reg file to merge it.
  • When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
  • Sign out and sign in to apply.

Convert a Dynamic IP to Static

Working on a project where on some servers the DHCP assigned addresses needs to be converted to static. Since there is always more than one…I needed to script it.

Here is a quick way to do it via PowerShell.

Hope this helps!

Older Posts

Mohammed Wasay

Dallas based Design Technologist & Hybrid Developer