FSMO Roles 1

FSMO Short form Flexible Single Master Operation Role.

There are five rules are there in FSMO, they are

1)     Schema master (One per Forest)

2)     Domain naming master (one per forest)

3)     PDC emulator (one per domain)

4)     Infrastructure master (one per domain)

5)     Relative ID (RID) master (one per domain)

Short Notes for FSMO

Schema master (one per forest):

This role is responsible for maintaining and modifying the Active Directory schema.

Domain naming master (one per forest):

This role is responsible for the addition and deletion of domains in a forest.

PDC emulator (one per domain):

This role allows Windows Server 2003 to act as a Windows NT primary domain

Controller (PDC) and it provides replication support for Windows NT-based backup domain controllers (BDCs). In addition, this role assists with time and group policy synchronization, bad password etc…

Infrastructure master (one per domain):

This role is responsible for updating the group-to-user references whenever the members of groups change or receive new names.

Relative ID (RID) master (one per domain):

This role ensures that every object created has a unique identification number.

Rules for FSMO Role Placement

Rule 1:

The PDC Emulator and RID Master roles should be on the same machine because the PDC Emulator is a large consumer of RIDs.

Note:

Since the PDC Emulator is the role that does the most work by far of any FSMO role, if the machine holding the PDC Emulator role is heavily utilized then move this role and the RID Master role to a different DC, preferable not a global catalog server (GC) since those are often heavily used also.

Rule 2:

The Infrastructure Master should not be placed on a GC.

Tip:

Make sure the Infrastructure Master has a GC in the same site as a direct replication partner.

Exception 1:

It's OK to put the Infrastructure Master on a GC if your forest has only one domain.

Exception 2:

It's OK to put the Infrastructure Master on a GC if every DC in your forest has the GC.

Rule 3:

For simpler management, the Schema Master and Domain Naming Master can be on the same machine, which should also be a GC.

Exception:

If you've raised your forest functional level to Windows Server 2003, The Domain Naming Master doesn't need to be on a GC, but it should at least be a direct replication partner with a GC in the same site.

How RID works

When there are two or more domain controllers in a domain. The RID master assigns a block of 500 identifiers to each domain controller. When an object is created the domain controller where the object is created assigns RID to it from the pool. When a domain controller has used 50 percent of the supply of RIDs that it originally received from the RID master, it must contact RID master and request a new supply.

When an object needs to be moved from one domain to another, you must be logged on to the RID master in the source domain, and the move operation must be performed against the RID master in the destination domain to move an object to different domain, the Movetree.exe command is required. The Movetree.exe command allows an object such as Organization Unit (OU) or User object to be moved to another domain within the same forest.

The movetree operation copies the source objects to the Last and Found Container on the source domain. And then they are moved to the destination domain. The lost and found container is a built-in container for orphaned objects whose parent container has been deleted.

A globally unique identifier (GUID), The GUID is a 128-bit hexadecimal number that is assigned to every object in the active directory forest upon its creation. This number does not change even when the object itself is renamed.

How to seize the roles?

Seizing the Role

The NTDSUTIL tool allows you to transfer and seize operations master roles. When you use the NTDSUTIL command-line tool to seize an operations master role, the tool attempts a transfer from the current role owner first.

Then, if the existing operations master is unavailable, it performs the seizure.

To seize the operations master role assignments, complete the following steps:

1. Click Start, and then click Command Prompt.

2. At the command prompt, type ntdsutil and press Enter.

3. At the ntdsutil prompt, type roles and press Enter.

4. At the fsmo maintenance prompt, type connections and press Enter.

5. At the server connections prompt, type connect to server,

Followed by the fully qualified domain name (FQDN), and press Enter.

6. At the server connections prompt, type quit and press Enter.

7. At the fsmo maintenance prompt, type one of the following:

* seize schema master and press Enter

* seize domain naming master and press Enter

* seize RID master and press Enter

* seize PDC and press Enter

* seize infrastructure master and press Enter

8. At the fsmo maintenance prompt, type quit and press Enter.

9. At the ntdsutil prompt, type quit and press Enter.

Managing Operations master Roles:

There are two ways to manage operations master roles

Transfer and Seizure

Transferring operations master roles

To transfer an operations master role is to move it with the cooperation of its current owner. You transfer and operations master role when you want to move a role from one server to another.

Seizing Operations master roles:

To seizing an operations master role is to move it without the cooperation of its current owner. You seize an operations master role assignment when a server that is holding a role fails and you do not intend to restore it.

The Infrastructure master Role:

An object’s SID a DN can changes when the object is moved to another domain. However, the object is moved to another domain. However, the Globally Unique Identifier (GUID) does not change. The GUID is a 128 bit hexadecimal number given at the time of creation in the forest. This number is a combination of date and time the object was created a unique identifier and sequence number. This number never changed even if the account is moved from one domain to another domain in the forest.

PDC Emulator Role:

By default there is only a 5 minutes clock skew allowed by Kerberos as part of the default maximum tolerance for the computer clock synchronization policy? If the clocks between a client and server are off by more than 5 minutes, you might not be able to logon server.

Domain naming master role:

If your forest functional level is set to windows 2000, the domain naming master role should reside on a global catalog server, when the forest functional level is set to windows server 2003 this is not necessary.

Windows Questions

Netlogon service?

If the server is a Domain Controller, Stop and Restart the Net Logon service to

Register the Service (SRV) records in the DNS server.

The Netlogon service registers all the SRV records for that DC.

What is the content of System State backup?

1)     Registry

2)     Boot Files

3)     Active Directory

4)     Sysvol

5)     Com + Class Registry

6)     Certificate Server

Types of event viewer?

1)     System log

2)     Security log

3)     Application log

4)     DNS Server log

5)     File Replication log

6)     Directory Service log.

What is an AGUDLP?

It is a user and group strategy

A: Account

G: Group

U: Universal

DL: Domain Local

P: Permission

Where FRS logs stored in and what is the Database Engine Name?

C:\Windows\NTFRS\JET\Log, The engine is Jet database engine NTFRS.JDB.

How do you install recovery console?

C:\I386\Win32 /CMDCONS, assuming that your Win Server Installation is on

Drive   C:

What’s contained in administrative template conf.adm?

Microsoft NetMeeting policies

What are the different types of profile?

Local Profile: Stored on local machine where the user log on. User gets different Profile when he logs on to different machine.

Roaming Profile: Stored in shared folder of server. User gets same profile when he logs on to different machine. User can modify his profile.

Mandatory profile: Stored in shared folder of server. User get same profile when he

Logs on to different machine. User cannot modify his profile.

Difference between Roaming and Mandatory profile?

Roaming Profile: User can modify his profile

Mandatory Profile: User cannot modify his profile

Difference between Roaming and Local profile?

Local Profile	Roaming Profile
stored on local machine	stored on shared folder of server
user get different profile for different machine	user get same profile on different  machine
stored in C:\docs and settings	Stored on shared folder of a server
These profile are automatically	These profile is required to be
Created when a user logs on to a  Machine.	Configured as per requirement.

How to configure a user profile as mandatory?

To configure a profile as mandatory we need to configure a profile as roaming and then rename the ntuser.dat to ntuser.man from the shared folder.

What hidden shares exist on Windows Server 2003 installation?

Admin$, Drive$, IPC$, NETLOGON, print$ and SYSVOL

You need to automatically install an app, but MSI file is not available.

What do you do?

 .zap text file can be used to add applications using the Software Installer, rather than the Windows Installer.

How to convert the .exe to .Zap?

[Application]

Friendly Name=”ADOBE”

Setup Command= “\\System Name \Adobe\Adobe.exe”

[Exit]

What is a Kernel version for windows 2008, Vista?

NT 6.1

Windows 2008 server performance?.

Windows 2008 server monitoring tools

1) Performance Monitoring

2) Reliability Monitoring

3) Data collector set.

How do you trouble shoot startup problem with windows xp?

Modify the Boot.ini file to include the /SOS switch. When trying to troubleshoot startup problems with windows XP in particular when the system hangs at reboot as in this scenario, we should use the “/SOS switch in the Boot.ini startup file. This switch causes the names of drivers to be displayed as the load during boot.

What should you use Answer file when you are going to install windows XP unattended installation?

The file name must be in Winnt.sif.

It should be locate on i386 folder.

Simple Shortcut Notes

%UserProfile%

%SystemRoot%

How to check the memory dump error log file?

ü  Microsoft kernel debugger (KD.EXE) it’s a CUI too.

ü  Microsoft WinDBG debugger (Windbg.exe) it’s a GUI tool.

What is debug mode?

It will check the driver files and versions and status. Once it is checked it will give the details to c:\windows\ntbootlog.txt files.

Remote Administration Upgrades:

Remote Control /admin always seemed like something that really needed to be “in the box” integrated into OS.

Standard Operating System (NT, 2000, 2003 or 2008) local user’s password database?

C:\WINNT\SYSTEM32\CONFIG\(SAM)..

SAM (Security Accounts Manager)

Troubleshooting Boot Process:

USING THE ADVANCED OPTION MENU.

Windows advanced option menu.

ü  Safe mode

ü  Safe mode with networking

ü  Safe mode with command prompt

ü  Enable boot logging

ü  Enable VGA mode

ü  Last known good configuration (your most recent setting that worked)

ü  Directory service restore mode (domain controllers only)

ü  Debugging mode

The last known good configuration:

One purpose of the last known good configuration option is to save you from your better ideas. For example one time I thought I’d try installing the CD-BURNING software designed for a windows 98 computer on a windows 2000 professional computer. While installing, I saw an error warning me that the software was not designed for windows 2000, but I preserved (Rules? Ha| we spit at rules) everything went smoothly and I finished installing the tool. Feeling a little smug, I rebooted when prompted. And windows 2000 refused to start and instead displayed a blue screen. I stopped feeling smug.

Instead I rebooted again, pressed F8 to display the advanced options menu and chose to boot been logged into the computer. The computer unloaded the new drivers, I booted successfully, and life was good. So long as the change you made produced no system critical errors (at the time, that is as you can see, it’s okay if the change you made prevents the OS from starting up properly) and you successfully booted and logged into the server once before you ran into the problem all is not lost. You can load the last known good configuration and choose from three different system start-up options.

Using the current configuration

Using the last known good configuration loaded the last time the server successfully

Restarting the server

Understanding how last know good works

Every time you boot the computer and login, the configuration information for the local machine is stored in HKLM\SYSTEM\CurrentControlSet. The OS also stores a backup copy of this information and assigns it a number for organization purpose. This backup is used should the default set of configuration information the - current set - become corrupted and unusable.

Server 2003 stores several copies of the information numbering them consecutively. Another number set is maintained as a last known good configuration to be used if the default configuration set becomes unusable.

You can’t tell form the numbers which configuration set your server is currently using. To find this information, look in the \select key in HKLM\System. There are four values here.

Current

Default

Failed

And lastknowngood.

If you restart the machine and boot normally (that is, without using the advanced option menu), then Default control set will be used. The value of failed is the configuration set that had been the default when you chose to start the machine from the last known good configuration menu. Because you told the OS to not start with that configuration set. It’s now marked as failed even if nothing is actually wrong with it.

If you choose while booting time last known good configuration, you are choosing to reverse all non security related changes made to the registry during the last session. As I mentioned in my earlier example, this includes unloading drivers installed during the previous session.

The change that you want to reverse is not related to control set information. You

cannot remove changes to user profiles or system policies with last know good configuration menu, for example, password are also unaffected by the last known good option. So you can’t use this option to recover from a forgotten administrator password.

 Enable VGA Mode

Those familiar with NT Server will remember that in previous versions of the operating system, the boot menu had two entries for each instance of NT installed on the computer. One with whatever graphics settings you’d chosen and one designed to run in vanilla VGA mode.

There was a good reason for this, in NT 3.1, there was no VGA mode and if you set up the wrong driver and logged in (making the last known good option useless) then you had to go through a complicated sequence of keystrokes to navigate blindly to the display applet in the control panel and fix things. This gave you a terrific sense of accomplishment when it actually worked, but it made video problems more than a little painful to resolve.

The VGA option is no longer in the main menu however to get to it, you must press F8 at boot time and choose enable VGA mode from the advanced options menu, use this option if you’ve installed a bad video driver and need to correct the problem. Unlike the last known good menu, this option will work at any time, not just before you’ve successfully logged in.

Enable Boot Logging:

Enable boot logging from the advanced options menu starts windows as usual, except that it creates a file called NTBTLOG.TXT and stores it in the top of your system root directory.

If you’re running in to problem, then you can check this log to see what drivers did and did not load its normal for some drivers to not load. They are available, but if you have not got anything running that requires them, the OS won’t start them, so as to save memory, but if your network for example is not working you can scan the list of drivers to make sure that NDIS.SYS is present.

Note: at a time when the server is working normally, enable boot logging and save the output under another name, nothing the date and new changes to the server. If something does go wrong with the machine, you can compare the healthy boot record with the stick one to find the discrepancy.

Debugging mode

This final option in the advanced option menu, debugging mode sends debugging information to a computer connected to a windows 2000 computer you are booting via the serial port. The basic gist of this is that it’s a way to monitor the progress of a servers boot from another server.

Using memory dump files to analyze stop errors?

Memory dump files record detailed information about the state of your operating system when the stop error occurred you can analyze memory dump files manually by using debugging tools or by using automated processes provided by Microsoft. The information you obtain can help you understand more about the root cause of the problem.

ü  Microsoft kernel debugger (KD.EXE) it’s a CUI too.

ü  Microsoft WinDBG debugger (Windbg.exe) it’s a GUI tool.

OS Release Features

What are the new features in windows 2008 server?

1)     Hyper-V and Live migration

2)     File Classification Infrastructure

3)     Active Directory and Pervasive PowerShell

4)     IIS 7.5

5)     Direct Access

6)     Branch Cache

7)     Remote Desktop and Applications

8)     Virtual Desktop Infrastructure (VDI)

9)     Active Directory Administrative Center

10) RODC [Read Only Domain Controllers]

11) WDS [Windows Deployment Service] instead of RIS 2003 server

12) Shadow copies for each and every folder

13) Boot sequence is changed

14) Services are known as role in it

Windows Server 2008 R2 Active Directory Features?

1)     Active Directory Administrative Center

2)     Windows Power shell and Windows Power shell cmdlets

3)     Best Practices Analyzer for Active Directory

4)     Active Directory Recycle Bin

5)     Active Directory Web Services

6)     Managed Service Accounts

7)     Offline Domain Join

8)     Read only domain controllers

9)     Restart able active directory domain service

10)  Fine grained password policies

Active Directory Recycle Bin

The Active Directory recycle bin will not be available until the forest level is at Windows Server 2008 R2. 

When it is turned on it can restore not only the object but also the attributes that go along with that user (Ex: SID, Group Members etc). 

Cannot recover anything deleted before the active directory recycle bin is turned on.  You will see deleted objects in the recycle bin but it will not be able to recover them.

It is built on powershell so everything has to be done from powershell, however, there are some great GUI tools out there for the AD recycle bin feature.  One of which is the Active Directory Recycle Bin powerpack for Powergui: Link.

 Also, one thing to note about the Active Directory Recycle Bin is that once it is turned on, it cannot be turned off.

The essentials of RODC’s are:

Read only domain controller

Administrative role separation

Credential caching

Read only DNS

Administrative Role Separation:

You can delegate local administrator permissions for the RODC server to any user in active directory. The delegated user account will now be able to log onto the server and do server maintenance tasks, without having any ADDS permissions and the user does not have access to other domain controllers in active directory, this way security is compromised for the domain..

Credential Caching:

By default the RODC doesn’t store any user or computer credentials except the computer account of the RODC itself and a special “krbgt” account that each RODC has.

The RODC can however be configured to cache passwords, this is handled be the password replication policy. The password replication policy determines if replication from the writable DC to the RODC is allowed for the user or computer credentials. If a certain user is allowed the users credentials are cached on the RODC at login.

When an account is successfully authenticated against the RODC, the RODC attempts to contact a writable domain controller at the HUB site. If a password is not cached, the RODC will forward the authentication request to a writable DC, the DC receiving the request recognizes that the request is coming from an RODC and checks with the password replication policy.

The benefit of credential caching is that is helps with password protection at branch offices and minimizes exposure of credentials in case the RODC is compromised. When using credential caching and if an RODC is stolen the user account and computer account can have their passwords reset based on the RODC they belong to.

Credential caching can be left disabled and this will limit the eventual exposure but if will also increase when traffic, since all authentication request will be forwarded to the writable DCS in the main hub site.

Read Only DNS:

In addition to the RODC it’s also possible to install a DNS service. A DNS server running on an RODC doesn’t support dynamic updates. But clients are able to use the DNS server to query for name resolution.

Since the DNS is read only, clients cannot update records on it. But if a client wants to update its own DNS record the RODC will send a referral forward to a writable DNS. The single updated record will afterwards be replicated from writable DNS server to the DNS server on the RODC. This is a special single object (DNS record) replication, to keep the RODC DNS servers up to date and give the clients in the branch office faster name resolution.

Restartable Active Directory Domain Service:

With windows server 2008 active directory domain service (ADDS) are now Stoppable and Restartable , this means that you can stop the ADDS to perform tasks and maintenance, which in prior versions of windows server required a reboot into directory service restore mode (DSRM), this is an excellent feature for scripting and automating those tasks.

The possible states for ADDS are

ADDS – started

ADDS – stopped

ADDS – restore mode (DSRM)

It’s a benefit that tasks that used to require a reboot to take the ADDS offline are now available directly from the console. This gives administrators some flexibility towards maintaining and performing offline ADDS operations more quickly.

Fine Grained Password Policy:

Prior to windows server 2008 you could have only one password and account lockout policy per domain which applied to all users in the domain. As something new in windows server 2008 ADDS, it is now possible with fine grained password policies to define different sets of password or lockout policies to different set of users in the same domain.

With fine grained password policies the following settings are available.

Password Policy

Enforce password history

Maximum password age

Minimum password age

Minimum password length

Passwords must meet complexity requirements

Store password using reversible encryption

Lockout policy

Account lockout duration

Account lockout threshold

Reset account lockout after

Fine grained password policies can be applied to user objects and global security it’s not possible to apply them to OUs.

To use fine grained password policies the domain functional level must be at windows server 2008.

What is active directory federation Services?

Active directory federation services (ADFS) is a feature introduced with windows server 2003 R2 that provides an identity access solution. It gives browser based clients, which are inside or outside your network single sing on (SSO) access to web based applications. It is important to note that ADFS only works for web based applications. ADFS can be used in web hosting or share point environments. It is very useful when a company has web servers located in a DMZ or at a remote hosting vendor or business partner and wants to control account credentials to their web applications from the internal active directory. 

Federation Services:

The federation service can be used by one or more federation servers to share a common trust policy. Federation servers are used to route authentication requires from user accounts in other organizations or from client that may be located on the internet.

Federation Service Proxy:

The federation service proxy is a proxy to the federation service in the perimeter network (DMZ). The federation service proxy uses WS-federation passive requestor profile (WS-FPRP) protocols to collect user credentials from browser clients and it sends the user credentials to the federation service on their behalf.

Benefits of TS Gateway?

TS Gateway provides many benefits, including the following.

TS Gateway enables remote users to connect to internal network resources over the internet, by using an encrypted connection without needing to configure virtual private network (VPN) connections.

Difference between Windows 2003 Standard Editions and Windows 2003

Enterprise Editions?

Windows 2003 Features	Standard Ed	Enterprise Ed
Server Clusters	No	Yes
Active Directory Federation Services	No	Yes
ADFS Proxy	No	Yes
Microsoft Identity Integration Server 2003 MIIS Support	No	Yes
8-Way Symmetric Multiprocessing (SMP) Support	No	Yes
Support for 32 GB of RAM	No	Yes
Support for 64 GB of RAM	No	Yes

What is difference between windows 2000 server and windows 2003 server?

1)     Domain rename it is not possible in windows 2000

2)     Windows 2000 IIS 5 and 2003 IIS6

3)     Windows 2000 IE 5 and 2003 IE 6

4)     Windows 2000 does not have 64 bit versions

5)     DNS Stub zone has introduced in 2003 server.

6)     Shadow Copying introduced

7)     Schema version has changed from Version 13 to Version 30

8)     2000 does not support dot net whereas 2003 support Microsoft .Net 2.0

9)     In Windows 2000 we can create 1 millions users and in Windows 2003 we can create 1 Billions users.

10) Windows 2000 supports 4 nodes clustering whereas Windows 2003 supports 8 nodes.

11)  2003 has service called ADFS (Active Directory Federation Services) which is used to communicate between branches with safe authentication.

12) Windows 2003 there is improved storage management using service File Server Resource Manager (FSRM).

13) 2000 supports IPV4 whereas 2003 supports IPV4 and IPV6.

Windows Time Service

Windows Time Service

Reference Links

& 

Reference Links

The Computers running Windows Server 2003, XP use the Network Time Protocol (NTP),

Is used which give benefits such as more reliable time due to better correction methods.
This is configured using the new W32TM commands which we will look at later on.
Whereas Computers running Windows 2000 use the Simple Network Time Protocol (SNTP).
Configured with the NET TIME command.

Benefits and Purposes of Windows Time Service

The first question that we need to ask ourselves why do we need time synchronization? Well, in an Active 

Directory domain, it is very important for all clocks to be within 5 minutes of each other (by default) due to 

the implementation of the Kerberos protocol for authentication which relies on time stamped packets to prevent amongst other things, man-in-the-middle attacks. Another reason time sync is important for is because now Active Directory uses multi-master domain controllers (DCs) it is important that changes made at a later actual time on one DC don’t get overwritten by similar changes on another DC whose time is set wrong thus making it look like the most recent change!

The Kerberos V5 authentication protocol on a Windows Server 2003 family domain has a default time synchronization threshold of 5 minutes. Computers that are more than five minutes out of synchronization on the domain will fail to authenticate using the Kerberos protocol. This time value is also configurable, allowing for greater or lesser thresholds. Failure to authenticate using the Kerberos protocol can prevent logons and access to Web sites, file shares, printers, and other resources or services within a domain.
The Windows Time service is implemented in a dynamic link library called W32Time.dll. W32Time.dll is installed by default in the Systemroot\System32 folder during Windows Server 2003 setup and installation.

Port and Protocol

Port: NTP and SNTP use User Datagram Protocol (UDP) port 123 on time servers. If this port is not open to the Internet, you cannot synchronize your server to Internet SNTP or NTP servers.

Protocol: The service on Windows Server 2003 implements NTP to communicate with other computers on the network.

Forest Time Server configuration for Windows 2000 and 2003:

I am now going to look at how you setup your Windows 2000 machine to sync over the Internet and what protocol Windows 2000 users to do this. As mentioned briefly above, this is one of the differences between Windows 2003/XP and 2000. The protocol used for Windows 2000, is called Simple Network Time Protocol or SNTP. It is a “simple” version of NTP and lacks some of the more complex algorithms which provide more accurate and stable time for NTP clients. The way you set this up is to use the command line to enter the following:

NET TIME /SETSNTP:dnsnameofserver

For example, you could use the following:

NET TIME /SETSNTP:time.window.com

If you what to find out which server you setup a machine to sync to you can use the following command:

NET TIME /QUERYSNTP

Windows 2003 uses W32TM not NET TIME

As I mentioned above, Windows Server 2003 and Windows XP now use NTP instead of SNTP. Alongside that they now have a new way of configuring the WTS. The command that now does everything regarding WTS is:

w32tm

What these parameters actually do is control a registry entry called "Type" in:

HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters 

This key is either set to

"NT5DS" if you're in an AD,

 or "NTP" if you're either not an AD member, or if you're the root domain's PDCe.

Actually, this key could also be set to “NoSync” to prevent any time sync taking place.

Once you have setup the PDC to sync with an external time source then what will happens?

Well, it tries to sync every 45 minutes until it achieves its first sync. Then after that, it syncs again every 45 minutes until it has done three successful syncs in a row. After that it syncs once every 8 hours.

If a domain controller is configured to be a reliable time source, in other words, it syncs with an external time source, the NetLogon service announces that domain controller as a reliable time source when it logs on to the network. When other domain controllers look for a time source to synchronize with, they choose a reliable source first if one is available. When a DC is intended to be a reliable time source you should ensure that the following registry key has a value of 5 if not then the default value 10 should be left in place.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time

\Config\AnnounceFlags

Group Policy Settings:

Group Policy can be used to control Windows Time Service for computers that are running Windows Server 2003 to limit the flow of information to and from the Internet.
The synchronization type and NTP time server information can be managed and controlled through Group Policy. The Windows Time Service Group Policy object (GPO) contains configuration settings that specify the synchronization type. When the synchronization type is set to NT5DS, Windows Time Service synchronizes its time resource with the network domain controller. Alternatively, setting the type attribute to NTP configures Windows Time Service to synchronize with a specified NTP time server. The NTP server is specified by either its Domain Name System (DNS) name or its IP address when you select NTP as the synchronization type.

You can set the global configuration settings for Windows Time Service by using Group Policy.

In Computer Configuration\Administrative Templates\System\Windows Time Service\Global Configuration Settings, there is only one setting that might, in certain scenarios, affect the way that Windows Time Service communicates when the computer is in a domain.

This setting is AnnounceFlags, which controls whether this computer is marked as a reliable time server. A computer is not marked as reliable unless it is also marked as a time server. The settings are as follows:

0 Not a time server

1 Always a time server

2 Automatic time server, meaning the role is decided by Windows Time Service

4 Always a reliable time server

Automatic reliable time server, meaning the role is decided by Windows Time Service

The default is 10, meaning that Windows Time Service decides the role.

In the Group Policy settings located in Computer Configuration\Administrative Templates\System\Windows Time Service\Time Providers, there are a number of settings that might affect the way that Windows Time Service communicates across the Internet. The following table describes some of these policy settings.

Selected Group Policy Settings for Configuring the Windows Time Service NTP Client for Computers Running Windows Server 2003

Policy Setting	Effect of Setting	Default Setting
NtpServer	Establishes a space-delimited list of peers from which a computer obtains time stamps, consisting of one or more DNS names or IP addresses per line. Computers connected to a domain must synchronize with a more reliable time source, such as the official U.S. time clock. This setting is used only when Type is set to NTP or AllSync. 0x01 SpecialInterval 0x02 UseAsFallbackOnly 0x04 SymmetricActive 0x08 NTP request in Client mode	time.windows.com, 0x1
Type	Indicates which peers to accept synchronization from: NoSync. The time service does not synchronize with other sources. NTP. The time service synchronizes from the servers specified in the NtpServer registry entry. NT5DS. The time service synchronizes from the domain hierarchy. AllSync. The time service uses all the available synchronization mechanisms	Default options NTP. Use on computers that are not joined to a domain. NT5DS. Use on computers that are joined to a domain.
CrossSiteSyncFlags	Determines whether the service chooses synchronization partners outside the domain of the computer. None 0 PdcOnly 1 All 2 This value is ignored if the NT5DS value is not set.	2
ResolvePeerBackoffMinutes	Specifies the initial interval to wait, in minutes, before attempting to locate a peer to synchronize with. If the Windows Time Service cannot successfully synchronize with a time source, it will keep retrying, using the settings specified in ResolvePeerBackOffMinutes and ResolvePeerBackoffMaxTimes.	15
ResolvePeerBackoffMaxTimes	Specifies the maximum number of times to double the wait interval when repeated attempts fail to locate a peer to synchronize with. A value of zero means that the wait interval is always the initial interval in ResolvePeerBackoffMinutes.	7
SpecialPollInterval	Specifies the special poll interval in seconds for peers that have been configured manually. When a special poll is enabled, Windows Time Service will use this poll interval instead of a dynamic one that is determined by synchronization algorithms built into Windows Time Service.	604800 (workgroup) 3600 (domain)

Troubleshooting Commands:

To Manually Start Windows Time Service Using the Net Command

Net Start w32time

To Manually Stop Windows Time Service Using the Net Command

Net Stop w32time

To Synchronize the Client Time with a Time Server

w32tm /resync

To Resynchronize the Client Time with a Time Server

By default, a computer running Windows Time Service will not synchronize with a time source if the computer's time is more than 15 hours off

w32tm /resync /rediscover

After running this command we should get event id 35 / 37 and event itself is self explanatory.

Event id 35 and Event 37 are for successfully Time sync.

Registry Values:

In domain based environment for time sync, in registry there a key called “Type” should have value as “NT5DS” under 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

Event IDs

Event id 35 and Event 37 are for successfully Time sync.

Linux Backup Script

echo ""
echo "   Windows Directory Mounting "
echo ""
# Mount the directories or drives from your LINUX systems on /mnt directory and before that check #desired permissions on
# Source and destination (Source normally use Backup Operator rights, destination use full rights like 777) 
# The below is my windows file server and i am talking entire backup on D thats why i am using D$

mount -t cifs -o username=Provide yourUser Name,password=password //10.X.X.X/D$/ /mnt/disk1

# The below is my destination windows server which i am running for back up purpose

mount -t cifs -o username=Provide yourUser Name,password=Password //10.X.X.X/f/ /mnt/todisk

echo ""
if [ $? = 0 ];then
echo " Directory mounted Suceesfully "
echo ""
sleep 2
echo " Backup Started "
echo ""
LOG=`date +%d%b%y`
# My back operation switch key (avuzb) - exclude i would like to exclude some of the files while running back
# And log will saved on log folder
# Exclude.txt file refer end of this script

rsync -avuzb --exclude-from exclude.txt /mnt/disk1/ /mnt/todisk  >> /log/disk5h.$LOG.log

echo ""
echo " Backup Has been Completed Successfully "
echo ""

#Once the backup has been completed the mount drives will be automatically unmovent.

umount /mnt/disk1/
umount /mnt/todisk/

# Creating the directory for storing logs

mkdir /log/`date +%d%b%y`

# Moving the log files on the day folder.

mv /log/disk*.* /log/`date +%d%b%y`

else
 echo "mount Failed"
 exit 0
fi






########################



exclude.txt

*.bak
*.mp3
*.avi
System Volume Information
RECYCLER