Active Directory

How to demote a Windows Server 2012 Domain Controller

In this short write up I will go over steps to demote a Server 2012 domain controller.

If you have worked in Active Directory and Windows Domain Administration over the years you may recall that in previous version of Windows Server that you would use the command line tool of ‘DCPROMO’ to promote or demote a server. Since Server 2012, the use of DCPROMO has been deprecated. In fact, if you attempt to use it you will be inform of this via the Active Directory Domain Service Installed.

In Server 2012 and later versions the use of Server Manager or PowerShell is required to promote / demote a server to/from a Domain Controller (DC). Below I provide steps on how to demote a server with some illustration along the way. Also, here is a quick YouTube video on the process: https://youtu.be/sBK2_APaDdg

Log into the domain controller you intend on demoting and Launch the Server Manager, select the Manage drop down menu, select Remove roles and features.

On the server selection page, select the desired server from the pool.

On the Remove Roles and Features Wizard, un-tick the Active Directory Domain Services box

The Remove Roles and Features dialog box will open. Click Remove features

On the Remove Roles and Features Wizard dialog box Validation Results box will appear. The domain controller must be demoted before continuing. Click on Demote this domain controller.

On the Active Directory Domain Services Configuration Wizard enter the required credentials to demote this server, click Next.

You will have several removal options. From the forced remove of failed domain member, to removing of the last domain in your forest. Make the selections which is appropriate for your remove task and click Next

Finally you will arrive on the New Administrator Password, enter and confirm the new local administrator account password, click Next.

On the Review Options verify the information is correct and click Demote.

After the server has restarted it will no longer be a domain controller

And that is it.

PowerShell: Unlock Active Directory Users Account

Use:

 

  • Listing account lockouts in Active Directory
  • Unlocking locked out accounts

# Open PowerShell or PowerShell ISE with an account with rights to unlock accounts
# Import the Actice Directory Module to PowerShell
#
Import-Module ActiveDirectory
#
# Run the Search-ADAccount command to search for accounts that are locked out
# Accounts locked out will be displayed
#
Search-ADAccount -LockedOut
#
#
# To unlock multiple {All} accounts the following command can be used
Search-ADAccount -LockedOut | Unlock-ADAccount
#

This could be useful if you wanted to somehow send an email to a ticket system so that you log and create IT tickets of account lockouts. A good way for your IT staff to track those types of activities that they do spend time on.

 

Tech Short: Using PowerShell to join Computer to AD Domain

Working on a server installation I decided to use a simple yet effective power-shell command to join a Windows Server 2012/R2 system to our domain.

For the sake of brevity lets just show you.

Requirements:

  • Admin access to the computer/server you are joining to the domain along with permissions in the AD domain to join machines
  • Connected to the network where the domain is accessible
  • Obtain an network ip address along with dns that can resolve the domain you are joining
  • PowerShell

Steps:

  1. Launch PowerShell as an Administrator
  2. Issue the following command example: Add-Computer -DomainName <domain name> -Restart

You will be prompt for a username and password at this point. Enter in the correct credentials and soon after a restart will occur.

When you resume from the restart you can now log in on this workstation/server with domain credentials.

Additional info can be found on Technet

I hope you enjoyed this short, thanks for visiting – jermal

Remote Server Administration Tools for Windows 10 | Released

Weeks of waiting and its here at last.

Q. What is it?

A. RSAT (Remote Server Administration Tools) is a Windows Server component for remote management of other computers and server operating systems running Windows.

Grab the tools here: Remote Server Administration Tools for Windows 10

 

Tech Short Q&A: What is vCenter Single Sign-On For

What is vCenter Single Sign-On?

vCenter Single Sign-On is a feature of VMware vCenter 5, 6 and future vCenter implementations that is an authentication broker which also creates security tokens providing a secure way of accessing your environments.

This token exchange mechanism is far superior than the former requirement of each component authenticating separately with a directory service such as Active Directory. Its VMware’s answer to identity management

Here are some key capabilities of SSO?

  • add multiple AD domains, OpenLDAP, and the local operating system where SSO is deployed. It also lets you create local users and groups.
  • allows VMware vSphere to connect to a non-AD Identity Source, OpenLDAP.
  • supports the SAML 2.0 standard and WS-TRUST, both of which are open industry standards.
  • lets users delegate tasks to solutions that can run as the identity of the user.
  • supports identity delegation for long-lived tasks with the ability to renew tokens.

follow this link -> VMware vCenter Single Sigion-On for more info on

 

I hope you enjoyed this techshort, thanks for visiting – jermal