Steven M. Jordan

Problem:

The NPS Azure AD Extension creates a self-signed certificate that is valid for two years. This certificate must be renewed!

The renewal process is simple enough:

PS C:\Program Files\Microsoft\AzureMfa\Config
> .\AzureMfaNpsExtnConfigSetup.ps1

PowerShell Error:

This error implies the package source 'https://www.powershellgallery.com/api/v2 is not reachable or resolved.

Fix:

Windows 2016, 2019, and up natively support TLS 1.2. However, you might still need to update the .NET framework and cryptography. At a minimum, manually enable TLS 1.2:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

That's it!

How to Assign Active Network Location with PowerShell.

Step 1: Identify networks and associated NICs.

Get-NetConnectionProfile

Name             : domain.com

InterfaceAlias   : Ethernet (Domain)

InterfaceIndex   : 1

NetworkCategory  : DomainAuthenticated

IPv4Connectivity : Internet

IPv6Connectivity : NoTraffic



Name             : Unidentified network

InterfaceAlias   : RDMA

InterfaceIndex   : 2

NetworkCategory  : Public

IPv4Connectivity : NoTraffic

IPv6Connectivity : NoTraffic

The above examples shows two NICs that belong to two different networks.

Step 2. Change the NetworkCategory:

Set-NetConnectionProfile -InterfaceIndex 13 -NetworkCategory Private

This example changes the active network for the NIC named RDMA. The network location changed from Public to Private. Confirm with Get-NetConnectionProfile.

That't It!

References:

https://docs.microsoft.com/en-us/powershell/module/netconnection/get-netconnectionprofile?view=win10-ps

Problem:

How to use PowerShell commands to transfer FISMO roles?

Solution:

Active Directory PowerShell module.

Assumptions:

FISMO PowerShell management requires Active Directory PowerShell module.

Import-Module ActiveDirectory

Example 1. Show forest FSMO roles (forest):

PS> Get-ADForest contoso.com| ft DomainNamingMaster, SchemaMaster

Example 2. Show domain FSMO roles (domain):

PS> Get-ADDomain contoso.com | ft InfrastructureMaster, PDCEmulator, RIDMaster

Example 3. Transfer single role to a domain controller.

PS>; Move-ADDirectoryServerOperationMasterRole -Identity "DCX" PDCEmulator

#N.B., PowerShell FISMO role names:

0= PDCEmulator
1= RIDMaster
2= InfrastructureMaster
3= SchemaMaster
4= DomainNamingMaster

Example 4. Transfer multiple roles.

Move-ADDirectoryServerOperationMasterRole -Identity “DCX” –OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster

Example 5: Transfer all roles with numbers:

Move-ADDirectoryServerOperationMasterRole “DCX” –OperationMasterRole 0,1,2,3,4

Example 6. Transfer FSMO roles between domain controllers:

Move-ADDirectoryServerOperationMasterRole

That's It!

References:

https://docs.microsoft.com/en-us/powershell/module/addsadministration/move-addirectoryserveroperationmasterrole?view=win10-ps
https://blogs.technet.microsoft.com/canitpro/2017/05/24/step-by-step-migrating-active-directory-fsmo-roles-from-windows-server-2012-r2-to-2016/

Outline:

How to configure locator preferences for domain controllers (DCs). How to set priority and weight on domain controllers. Force clients to consistently connect to the same domain controller.

Problem:

Clients connect to different DCs within the same site. IPv4 DNS server search has no effect on this random behavior.

Solution:

(a) Assign priority and weights to DNS SRV-records via GPO (i.e., registry changes);

(b) Or, change subnet topology for simple DC Subnet Prioritization;

Assumptions:

All DCs are located within the same Active Directory (AD) site.

Domain Controller Priority within a Site

Domain DNS SRV-records assign priority and weight values that determine DC preference. Clients connect to the domain controller (DC) with the lowest priority value. By default, priority for all DCs is set to zero. For example, assume a site has two DCs:

· DC-X with a priority of 0 (i.e., preferred).
DC-Y with a priority of 2.

In this example, Windows clients connect to DC-X because it has the lowest priority value. Clients only connect to DC-Y when DC-X is unavailable (e.g., maintenance).

Domain Controller Weights

What happens when all the DCs share the same priority? In this situation, DC preference is determined by SRV-record weight values. Unlike priority, clients prefer higher weight values over lower values.

What happens if all DCs have the same weight values? By default, DCs weight value is set to 100. Clients connect round-robin when all DCs use the same priority and weight values.

What happens when same-site DCs have the same priority and different weight values? Weight is not absolute. Weight is proportionate. In other words, clients may disproportionately connect to any available DC.

Clients are more likely to connect to DCs with higher weights. Clients are less likely to connect to lower weights DCs. Weight preference uses a simple formula: DC weight (i.e., single server) divided by the sum of all DCs weights:

For Example, assume three DCs within a single AD site (Table 1):

Table 1
Determine domain controller preference based on weights.

Domain Controller	Priority (Default)	Weight	Formula	Connection Odds
DC10	0	10	10/(10+20+30) = 10/60 = 1/6	17%
DC20	0	20	20/(10+20+30) = 20/60 = 2/6	33%
DC30	0	30	30/(10+20+30) = 30/60 = 1/2	50%

Note: This assumes client and domain controllers reside in the same site and use the same priority values.

DC Preference Configuration

Set priority and weight via the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Create new 32-bit DWORDs:
LdapSrvWeight
LdapSrvPriority
Assign DC priority and weight values.
Restart the NETLOGON service to publish to SRV records

Subnet Prioritization

Clients prefer to connect to DCs on the same IP subnet. For example, let’s say we have a single AD site. This site consists of one Windows 10 client and two DCs (Table2):

Table2
Subnet Prioritization

Host	Priority	Weight	IP address	Preferred DC
WIN-10			192.168.1.1/24
DC-X	0	100	192.168.1.100/24	Yes
DC-Y	0	100	192.168.2.100/24	No

Note: All hosts reside in the same AD site. DC01 and DC02 use default weight and priority values.

In this situation, all hosts belong to the same AD-site. Both DCs have the same preference values (i.e., default). WIN-10 and DC-X belong to the same IP subnet. However, DC-Y resides on a separate IP subnet. DC-X is the preferred DC. Clients only connect to DC-y when DC-X is unavailable (e.g., maintenance).

Additional Thoughts:

I recommend minimal registry changes –especially to DCs. Implement priority and weight changes with caution. Also consider, registry changes can be difficult to troubleshoot. Therefore, it’s prudent to push these changes out via GPO.

Subnet Prioritization seems to be the simplest approach. That is, if you’re comfortable with internetworking. Simply create a new gateway. Add routes. Assign the subnet to the second DC. Done.

That’s It!

References:

https://blogs.msmvps.com/acefekay/2010/01/03/the-dc-locator-process-the-logon-process-controlling-which-dc-responds-in-an-ad-site-and-srv-records/

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc733142(v=ws.10)

http://techgenix.com/domain-controllers-weight-priority/

https://www.blackmanticore.com/1a64083f14eccc1d32a755a850c2ea3d

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772592%28v%3dws.10%29

NPS Extension Certificate Error

Problem:

PowerShell Error:

Fix:

GPO Slow Link Detection

Problem:

Definition: Group Policy Slow Link Detection

Background:

Group Policy Slow Link Detection:

Solution:

References:

Set the Network Location

How to Assign Active Network Location with PowerShell.

Step 1: Identify networks and associated NICs.

Step 2. Change the NetworkCategory:

References:

Transfer FISMO Roles with PowerShell

Problem:

Solution:

Assumptions:

Example 1. Show forest FSMO roles (forest):

Example 2. Show domain FSMO roles (domain):

Example 3. Transfer single role to a domain controller.

Example 4. Transfer multiple roles.

Example 5: Transfer all roles with numbers:

References:

Domain Controller Preference Order

Outline:

Problem:

Solution:

Assumptions:

Domain Controller Priority within a Site

Domain Controller Weights

DC Preference Configuration

Subnet Prioritization

Additional Thoughts:

References:

My Instagram