Using CSVDE - Group name with space

Was working with CSVDE to export users into a csv, but had no luck with exporting users from a group name containing spaces (i.e  "Group 2").  One of my examples had the filter contained in quotes.

Discovered that:
The filter clause should be enclosed in parenthesis, not quotes. The quotes
should enclose the distinguished name of the group.

csvde -f report.txt -r (memberOf=CN="Group 2",OU=Test1,DC=t410corp,DC=com) -l
sAMAccountName,displayName,mail

You can also replace the space with "\20" (without the quotes).

How to Fix C00002E2 Directory Services could not start error – jet engine error

 

Running a Active Directory on Windows Server 2012 Core in a VM on a Hyper-V host.  The host lost power and corrupted the AD instance running on the VM.

 

Server 2012 would enter into the Repair mode and I caught the error 0x0c00002e2 as the resultant issue and discovered that AD was indeed corrupted.  This is the only domain controller for the domain and has accounts on it, so a backup was not an option.  (I know.... Murphy was in rare form today).

 

I found two helpful links:

 

How to recover Hyper-V Guest Domain Controller from Stop Error 0xc00002e2
(Michael Pollards answer was helpful, but I ran into a deeper problem because the ntds.dit database was corrupt).

• Open a Command Prompt (Win-R, CMD, Enter). Type NTDSUTIL and press Enter.
• Type activate instance ntds and press Enter.
• Type Files and press Enter.
• Type Info and press Enter. Verify the folder is actually C:\Windows\NTDS.
• Type Compact to and press Enter. I created C:\Windows\NTDS\Temp and used that.
• Copy the new file Ntds.dit in the temp folder over top of the old one in NTDS, and delete all the *.log files.

However, when trying to compact the database, I received basically the error:
                        could not initialize the jet engine error 501

 

How to Fix C00002E2 Directory Services Could Not Start – Blue Screen
Very helpful, and I was able to boot the domain controller.

 

Basic steps were:

 

Boot into Directory Services Restore Mode. When the server powers on, press F8 before the OS begins to load.  I used the recovery mode| change startup button, to bring up the boot options.

 

I was running Server Core, so from the prompt, cd \windows\ntds
Created a 'temp' folder in the c:\windows\ntds folder.
Copied the ntds.dit file to that temp folder.
Ran the commands below:

 

• Type: esentutl /g c:\windows\ntds\ntds.dit
• This will perform an integrity check, (the results indicate that the jet database is corrupt - ok)
• Type: esentutl /p   c:\windows\ntds\ntds.dit
• Agree with the prompt

I had to run the last command twice for it to return success.
Rebooted and system was up an running. 

 

 

 

 

 

Renaming Server 2012 domain controller

In my test environment, I needed to change the hostname of the domain controller.  You can rename a domain controller using the netdom command.  It appears that you must first add a machine account based on the current machine account:

STEP 1: netdom computername /add:

so, in the powershell command prompt, type (with quotes) "netdom computername wrongname.domain.local /add:server.domain.local"



STEP 2: netdom computername /makeprimary:
so, we type netdom computername wrongname.domain.local /makeprimary:server.domain.local

Once the command completes successful, it will warn you that you need to reboot immediately, as it may not authenticate logons (very important if only DC in forest)


But, I kept getting this error message:
"Unable to add "VM1" as an alternate name for the computer.  The error is:
The specified domain either does not exist or could not be contacted.
The command failed to complete successfully."

Discovered from the following link, that in Windows Serve 2008 and Server 2012, that the netlogon share is not present after you install Active Directory services.

The NETLOGON share is not present after you install Active Directory Domain Services on a new full or read-only Windows Server 2008-based domain controller

Changed the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\SysvolReady
from 0 to 1.

Ran the commands successfully and the domain controller hostname was changed.

-Reggie

REFERENCES:
https://www.experts-exchange.com/questions/28188083/The-specified-domain-either-does-not-exist-or-could-not-be-contacted-error-message-in-Windows-Server-2012.html#a39336191

https://community.spiceworks.com/how_to/103538-properly-renaming-a-domain-controller-server-2012r2

[SOLVED] Large disk space consumption (Windows 7)

I’ve run into this on a system and wanted to share.

I was having aproblem with disk space and used diruse.exe utility to isolate an folder that was using an enormous amount of disk space.  The folder was in the ProgramData\Microsoft folder.

The article link is:  http://www.admin-enclave.com/en/articles/windows/133-taming-the-wer-windows-error-reporting-on-windows-7-2008.html was very helpful.

 

Basically, the Windows Error Reporting service captures errors and gathers data that may be related to a crash (i.e. files) and stores them in the C:\ProgramData\Microsoft\Windows\WER\ReportQueue folder.  I had 33 GB of extraneous data there that I used the method in the link to clean up.

 

The WER service never deletes these files that it captures.  Absolutely, crazy!

 

 

-Reggie

Simple Folder compare script

DFS Replication was doing something strange when I enabled replication during the day.  Had a user complain that they were missing a file.  Another user said the same, so I needed to do a simple folder compare to see if there were differences.  The folders were different in *.tmp and ~*.* files, but I did find 7 files that were not on both replication partners.

Used the following script to do the comparison:

PS L:\shared\Peds IT\Nerds\Reggie\dfsr> $fso = get-childitem -recurse -path "Y:\replicated"
PS L:\shared\Peds IT\Nerds\Reggie\dfsr> $fsoBU = get-childitem -recurse -path "Z:\original
PS L:\shared\Peds IT\Nerds\Reggie\dfsr> Compare-Object -ReferenceObject $fsoBU -DifferenceObject $fso

Reference:   Easily Compare Two Folders with Powershell

AntiMalware Health State Error 0x800106f7

Discovered this error on one of my servers - "There was an error 0x800106f7 in creating the Antimalware Health State WMI instance."  This error was occuring every 30 seconds.

Found the article:  AntiMalware Health State Error 0x800106f7

Basically, kill the WMI provider (WmiPrvSE.exe) and let it restart on it own - like a reboot.

tasklist | find "WmiPrvSE.exe"
taskkill /im WmiPrvSE.exe /f

Powershell - Syntax notes

Powershell Split Operator
Had a problem with -split of a string variable that contained a "." (period) in it.  Discovered from this article that a period as a regular expression means 'any character', so you must escape the period with a "\".
For example:    $a,$b = $member.SamAccountName -split('\.')

See:   Article - Powershell Split Operator