How to Remove an orphaned Windows Domain

I recently had to remove a Domain Controller and a Child Domain from a Windows Forest because it was no longer needed by my client. I tried using the Server Manager GUI and kept running into errors after errors. So, I turned my focus to ntdsutil which I have used many, many times in the past to solve this type of issues with orphaned DC's.

First, you must remove the orphaned DC's and then you can remove the orphaned Domain.

Process: Locate the DC that has the Domain Naming Master role you can do this by typing

netdom query fsmo and use that server to run the ntdsutil and metadata cleanup commands. 

How to remove DC's manually

1. Type ntdsutil

2. Type metadata cleanup

3. Type connections

4. Type connect to server "servername" This is the name of the domain controller that holds the Domain Naming Master FSMO Role.

5. Type quit and then you are in the Metadata Cleanup menu

6. Type select operation target

7. Type list sites. Which displays a list of sites in the forest and each site has a number associated with it.

8. Type select site "number". Important - Make sure you select the number of the domain to be removed

9. Type list domains in site, and then press Enter. A list of domains in the site is displayed, each with an associated number.

10. Type select domain "number". Select the number associated with the domain to be removed.

11. Type list servers for domain in site. A list of domain controllers in the domain is displayed  and each DC has an associated number.

12. Type select server "number".  Select the number that is associated with the domain controller to be removed.

13. Type quit. The Metadata Cleanup menu is then displayed.

14. Type remove selected server.You should now receive the confirmation that the removal of the DC that you selected to be removed was successful.

15. Type quit at each menu

Repeat the steps above for any remaining or orphaned DC's of the child domain to be removed.

How to remove a Domain manually

1. 1. Type ntdsutil

   2. Type metadata cleanup

   3. Type connections

   4. Type connect to server "servername", This is the name of the domain controller that holds the Domain Naming Master FSMO Role.

   5. Type quit. The Metadata Cleanup menu is then displayed.

   6. Type select operation target.

   7. Type list domains. A list of domains in then displayed that belong to the forest, each has an associated number.

   8. Type select domain "number".  Important - Select the umber of the domain to be removed.

   9. Type quit. The Metadata Cleanup menu is then displayed.

   10. Type remove selected domain.You will receive confirmation that the removal was successful.

   11. Type quit

   Open the Active Directory Sites and Services and remove the domain controllers of the domain to be removed from their site, manually.

2. Open Active Directory Domains and Trusts and remove any trust relationships if applicable to the domain that you deleted.

3. Remove all entries in DNS related to the domain that you removed, also remove any SRV records.

   Check for any other reminiscences of the DC's and Domain that you removed in DNS, Active Directory Sites and Services, etc.
   

How to Add UPN suffix in Microsoft Active Directory

How to Add UPN suffix in Microsoft Active Directory?

First, what is a UPN?

The User Principal Name (UPN) suffix is part of the logon name in Active Directory. When you create a logon account, by default it will use the DNS name of your AD domain. Example: Your local domain name phmservices.local. The user that you want to create is WMays therefore, the username would be wmays@phmservices.local. 

However, what if you want it to be something else like wmays@phmservices.com? You can add an alternate UPN or second UPN.

What are some reasons that you might need a second UPN for?

• A future implementation of Office 365
• The internal domain is a domainname.local and you want users to sign in with the domain.com suffix
• New software or a software upgrade that requires the users UPN to match the user’s email address

 How to Add the second UPN?

Open Active Directory Domains and Trusts, right-click Active Directory Domains and Trusts, and then choose Properties.

On the UPN Suffixes tab, in the Alternative UPN Suffixes tab, type the new UPN suffix you want, and then select Add, then click OK.

Note: You can also use powershell  

Exchange Server Defrag

Note: Some of these commands can be quite lengthy and therefore, will vary in the time to complete.

After any of the steps if the database shows as "Clean" when you check the status with the /mh command, then you can try to mount the DB again. If the DB is shows as "Dirty Shutdown" then keep going with the steps below.

1. Eseutil /mh database file path   - this checks the status of the DB

If the output shows "Dirty Shutdown" then you need to repair it- see below 

Example: eseutil /mh D:\Program Files\Exchange Server\Databases\Mailbox1\Mailbox1.edb

2. Soft Recovery: Eseutil /r d:\Program Files\Exchange Server\Databases\Mailbox1\Mailbox1.edb - note this only works if minimal corruption. Then run this again to check the status  --   eseutil /mh D:\Program Files\Exchange Server\Databases\Mailbox1\Mailbox1.edb

3.If the above did not work then proceed to Hard Recovery: Eseutil /p D:\Program Files\Exchange Server\Databases\Mailbox1\Mailbox1.edb

after it completes run status again Eseutil /mh D:\Program Files\Exchange Server\Databases\Mailbox1\Mailbox1.edb

 4. Also a defrag may be needed if so Eseutil /d

You should run this command with a temp location so you don't run out of room. Designate a temp location that hes enough space to acommdata the database temp file. 

Example: Eseutil /d D:\Program Files\Exchange Server\Databases\Mailbox1\Mailbox1.edb /t e:\Temp\Temp1.edb

Note: To be safe the temp file should be two times the amount of the size of the database. In other words if the DB is 100GB it is best to have the temp file go to a location that has 200GB available. Otherwise, the command will not complete because it does not have enough space to work and complete the task.

Dell PowerEdge and VMware Compatibility Matrix

Dell PowerEdge Systems VMware compatibility Matrix

 https://www.dell.com/support/kbdoc/en-us/000178967/dell-poweredge-systems-vmware-compatibility-matrix

VMware Compatibility Matrix

 VMware Compatibility Matrix

https://www.vmware.com/resources/compatibility/search.php

VMware VSphere ESXi and VCenter Versions and Build Numbers

 VMware VSphere ESXi Versions and Build Numbers

https://kb.vmware.com/s/article/2143832

VMware VCenter Versions and Build Numbers

https://kb.vmware.com/s/article/2143838

Veeam Versions and Build Numbers for Veeam Backup and Replication

Veeam Version and Build Numbers for Veeam Backup and Replication

https://www.veeam.com/kb2680

Netagear ReadyNAS, NFS datastore, VMware VSphere ESXi and VCenter

How to create an NFS volume to be used as a datastore for VMware environment with a NetGear Ready NAS

Login to the Netgear Ready NAS as the admin
Under Settings – Enable NFS
Create a Share - and name it
Then select the Settings of the Share
Select Network Access select NFS- check off read/write
                Note: You can also limit the host by IP that can have access to this share
File Access - check off read/write
Make sure that you note the volume name. You will need this when you are entering the folder name in the NFS mount process. Note the volume name may differ depending on the version of your Netgear ReadyNAS firmware version, etc. in this example it is Data

Open VCenter VSphere client or VSphere Web Client to create a new datastore for your VMware environment. Make sure that include the volume name and the folder share name when you are entering the folder name in the VMware NFS datastore mount process. The key point is to use the proper syntax for the folder name when you are putting in the information for the folder name In my example I used /Data/VMs

Note: Caps and correct spelling really, really count and of course the correct syntax as you see above J

For Server you can enter an IP address or the FQDN

Type in a name for the VMware datastore name

How to change SID on a Windows Server 2016

Open Powershell as Administrator and type Whoami /all

Get the SID information and record it somewhere

Run C:\windows\system32\sysprep\Sysprep.exe

This will bring up the System Preparation Tool (sysprep)

Select Enter System Out of Box Experience (OOBE) and Select Generalize 

Reboot the Server

Open Powershell as Administrator and type Whoami /all

Verify that the SID changed from the one that you recorded earlier

Change the Static IP or DHCP /release if applicable
DHCP /renew if applicable

Change the computer name if applicable and Reboot

WIndows Server 2016 VMTools installaiton with VSphere 5.5 host

How to get the VMTools properly installed on W2K16 Server running onVSphere.5.5
First of all yes I know that VSphere 5.5. is not officially supported anymore. However, for lab purposes I often have to do what I have to do :-) to do my testing. I am also aware that this may be old news but as I run into new scenarios I like to post a simple fix if I can.
When you install the new Windows 2016 VM you will have to choose Windows 2012 (64bit) as your operating system. Note: You do not have a choice to select 2016 as the server OS>
VCenter will show that the VMTools are not running on your Windows 2016 server however, you have already installed them -What to do?
No worries it is a simple thing-
Uninstall VMTools and Reboot the Windows 2016 Server
Install the VMTools as Administrator another words right-click on the VMTools setup64.exe and select Administrator and then reboot the Windows 2016 server. VCenter will now display that the VMTools are running on the Windows 2016 server- Success!.

VMRC console has disconnected attempting to reconnect

I received this error below today while attempting to open the Console of a VM with VMware VSphere 5.5 Client.

The VMRC console has disconnected attempting to reconnect

I have seen this issue before so I decided to post the resolution this time.
Close all of the VMware vSphere Clients that you have running on your machine. Then open Task Manager and make sure all processes with the vmware-vmrc.exe and vpxclient.exe are not running. If they close all of those processes. Note: you may have several of these tasks running. In my case I was using the VCenter server as my client and it had several clients open in the background that was causing my issue.

One more thing if all fails above you may also need to reboot the machine you are using as a client.

Windows Server 2016 the Domain Administrator no permissions however, the Local Admin does

I tried to personalize the W2K16 Server desktop by adding desktop icons and I get something like the the error messages below. Sorry no screen shot :-)
C:\Windows\system32\rundll32.exe
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.
Note: This does not happen if you login as the local admin. However, if you login as the Domain Admin which is of course a local admin you still get the permissions error.The server was already joined to the domain.

This issue is by design of Windows Server 2016. I knew it was related to server W2K16 so I tracked it down with the help of this article:
https://www.windows-security.org/95e7dc697029b38b45ac53f7efef3935/user-account-control-admin-approval-mode-for-the-built-in


How to fix this issue:
On the Windows 2016 Server open the GPMC, Computer Configuration, Windows Settings, Security Settings, Local Policies,  Security Options, then enable User Account Control: Admin Approval Mode for the Built-in Administrator account
Reboot the server and all is well...

ADprep Conflict Promoting a Windows 2012 R2 DC Server to a Windows 2008 R2 Domain

It has been quite a while since I last posted anything. So this one was such pain to track down I decided to post it and hopefully it helps somebody save some time and lots of aggravation!

I ran into this prerequisites check error below while promoting a Windows 2012 R2 DC Server to a Windows 2008 R2 Domain

The issue is related to WMI on the existing 2008 R2 DC where the WMI class objects are invalid.

Note: If you run adprep /forest prep from a command line you will also see this error Microsoft WMI Invalid Class Error [0x80041010

Note: I also tried running adprep /forestprep from a command line on the Windows 2008 R2 DC itself and it still failed 
 

After many frustrating hours of researching and trying all types of things I ran across this post which led me in the correct direction https://www.virtuallyboring.com/microsoft-wmi-invalid-class-error-0x80041010/

Note: I run everything from an elevated Windows Command line just in case

Run the Winmgmt.msc and select properties which will display if there are any issues with the WMI classes

 

If the WMI has an invalid class as seen above then download the Microsoft WMIDiag tool https://www.microsoft.com/en-us/download/details.aspx?id=7684

Extract it and Right click on the WMIDiag VBScript and select Open with Command Prompt

The script can run for a while and will eventually produce a text file. The text file will most likely identify a number of issues with .MOF extensions.

To resolve these issues

cd c:\Windows\Syetm32\wbem

An then run this command below:   

dir /b *.mof *.mfl | findstr /v /i uninstall > moflist.txt & for /F %s in (moflist.txt) do mofcomp %s

Run the Winmgmt.msc and select properties which will display if there are any issues with the WMI classes and you should now see something like this below

You can now go back and re-run the DC promotion process on the Windows 2012 R2 server

Continue with the DC promotion process and Reboot when required, etc.