Windows Server Administrator should know about these commands

As an administrator, you should familiarize yourself with the following commandline
utilities:
• ARP Displays and manages the IP-to-Physical address mappings used by
   Windows Server 2003 to send data on the TCP/IP network.
• AT Schedules programs to run automatically.
• DNSCMD Displays and manages the configuration of DNS services.
• FTP Starts the built-in FTP client.
• HOSTNAME Displays the computer name of the local system.
• IPCONFIG Displays the TCP/IP properties for network adapters installed on
   the system. You can also use it to renew and release DHCP information.
• NBTSTAT Displays statistics and current connections for NetBIOS over TCP/IP.
• NET Displays a family of useful networking commands.
• NETSH Displays and manages the network configuration of local and remote
   computers.
• NETSTAT Displays current TCP/IP connections and protocol statistics.
• NSLOOKUP Checks the status of a host or IP address when used with DNS.
• PATHPING Traces network paths and displays packet loss information.
• PING Tests the connection to a remote host.
• ROUTE Manages the routing tables on the system.
• TRACERT During testing, determines the network path taken to a remote
   host.
To learn how to use these command-line tools, type the name at a command
prompt followed by /?. Windows Server 2003 then provides an overview of how
the command is used (in most cases).

Integration of IIS and Apache Tomcat

1. Download the Tomcat IIS Connector (Jk2 binaries)

2.  There will be three directories namely bin, conf and doc. The bin folder has the isapi_redirector2.dll and an installation javascript file install4iis.js. I call the directory where you unzipped the IIS connector zip file as .

3. From IIS perspective I assume that the default web site is running and you need to redirect all URIs related to Servlets and jsps for Tomcat to execute them i.e URIs of the form

http://127.0.0.1/servlets-examples and http://127.0.0.1/jsp-examples to Tomcat servlet container URI
http://127.0.0.1:8080/jsp-examples and http://127.0.0.1:8080/jsp-examples respectively.

These are the steps to be executed from Tomcat and IIS.

From Tomcat:

I assume that you installed Tomcat properly and have a running version of Tomcat at port 8080 with jk2 at 8009. Since these are the default settings in Tomcat 5, there is virtually no need to do anything from Tomcat side once you have a running version of Tomcat.

From IIS:

1. Since the default web site is running, invoking the install4iis.js

(/bin directory)will be straightforward.

2. Configuring the jakarta filter:

To do this one should create a new virtual directory from the IIS management console.

1.Goto Settings -> Control Panel -> Administrative tools -> Internet Information Services

2.Expand the Local Computer icon.

3.Expand Web sites folder and Default Website.

4.Under the Default Web site create a new virtual directory.

1.Right click Default Web site -> Click New -> Virtual Directory -> Next

2.In the (Alias) Text field enter the name as jakarta and Click next

3.Enter /bin as the directory path and Click Next

4.Select read, run scripts and execute access permissions, Click Next and Finish.

5. Configure workers2.properties file:

This file is used to configure the connector properties, the URI pattern to be filtered, and details of the IP address and the port where the Tomcat connector is listening, etc.To map URIs of the form /Servlets-examples and /jsp-examples for Tomcat, the following settings need to be specified in the workers2.properties file.

Create a file workers2.properties in /conf directory with the following settings.

# Example socket channel, override port and host.

[channel.socket:localhost:8009]

port=8009

host=127.0.0.1

# define the worker

[ajp13:localhost:8009]

channel=channel.socket:localhost:8009

# Map the default Tomcat directory to the Web server uri space

[uri:/jsp-examples/*]

group=ajp13:localhost:8009

[uri:/servlets-examples/*]

group=ajp13:localhost:8009

6.Now you are set to execute the IIS Tomcat connector installation script install4iis.js. Either double click install4iis.js or execute it in command line as windows script using
Wscript //E:Jscript install4iis.js
The installation process using install4iis.js will take 10 – 15 steps. Click Ok for all messages in the message box one
after another and finally check for the message
Filter [jakarta] set. Click Ok to complete the installation.
Note: By Default the install4iis.js configures the filter (jakarta, the virtualdirectory configured above) for the Default
Web Site. If you want to configure the filter for other sites, you need to use the appropriate command line options.
For more help, type Wscript //E:Jscript install4iis.js –h.

7.Restart IIS (In IIS Management console, right click Local Computer -> All tasks -> Restart IIS).

8.To check the configuration of the filter, in the IIS Management console, expand Local Computer -> Web Sites and Right click Default Web Sites and Click Properties and ISAPI Filters tab. There you should see the green status of the jakarta filter indicating that the filter is loaded.

Once the above procedures are completed correctly, then typing

http://127.0.0.1/servlets-examples in browser will fetch the Tomcat page http://127.0.0.1:8080/servlets-examples and http://127.0.0.1/jsp-exampleswill fetchhttp://127.0.0.1:8080/jsp-examples page. Try executing the sample Servlets and jsp examples through IIS Connector and check the results.

Why we need Redundant Array of Independent Disks (RAID)

The need for RAID can be summarized in two points given below. The two keywords are Redundant and Array.
 

• An array of multiple disks accessed in parallel will give greater throughput than a single disk.
• Redundant data on multiple disks provides fault tolerance.

Provided that the RAID hardware and software perform true parallel accesses on multiple drives, there will be a performance improvement over a single disk. With a single hard disk, you cannot protect yourself against the costs of a disk failure, the time required to obtain and install a replacement disk, reinstall the operating system, restore files from backup tapes, and repeat all the data entry performed since the last backup was made.
With multiple disks and a suitable redundancy scheme, your system can stay up and running when a disk fails, and even while the replacement disk is being installed and its data restored.

Difference between WWW1,WWW2 and WWW3

WWW1, WWW2 or even WWW3 is nothing but a mirror of the original web server which is typical WWW. Many websites like government, banks even major search engines like Google(www1.google.com or www2.google.com) and Yahoo(www1.yahoo.com or www2.yahoo.com)! uses www1 and www2. The main purpose of this techniques is to reduce server load. Sometimes the original server need to be updated or modified but major websites like .gov, .edu, google.com, yahoo.com cannot just shut their main server down for hours to update their system. Therefore, they need to use www1 or www2 duplication of their mainframe server

Install Windows Server 2003 RIS

 

1. Click Start, point to Control Panel, and then click Add or Remove Programs.
2. Click Add/Remove Windows Components.
3. Click to select the Remote Installation Services check box, and then
   click Next.
   
   NOTE: If you are prompted for the Windows
   Server 2003 installation files, put the Windows Server 2003 CD-ROM in the CD-ROM
   drive, and then click OK. After you do so, you may receive a message with
   options for upgrading the operating system. Click No.
4. Click Finish, and then click Yes to restart your
   computer.

Set Up RIS

1. Log on as a user with administrative privileges.
2. Click Start, click Run, type risetup.exe, and then click OK to start the RIS
   Setup Wizard.
3. When the "Welcome" screen appears, click Next.
4. Type the drive letter and folder in which the RIS files are stored, and then
   click Next. For example, you might type E:\RemoteInstall,
   and then click Next.
5. After the RIS Setup Wizard copies the files, you are be prompted to enable
   or disable the RIS service, and the options are:
   
   • Respond to client computers requesting
     service. If you select this option, RIS is enabled, and it will respond
     to client computers that are requesting service.
   • Do not respond to unknown client computers. If
     you select this option, RIS only responds to known client computers.
6. Click Respond to client computers requesting
   service, and then click Next.
7. You are then prompted for the location of the client operating system
   installation files. Put the client operating system CD-ROM in the server CD-ROM
   drive, and then click Next.
   
   NOTE: Microsoft only supports
   the use of Microsoft media when creating a client operating system image. The
   use of non-Microsoft media is not supported.
8. Type the folder name for the client operating system installation files on
   the RIS server, and then click Next.
9. Type a friendly description for the operating system image. This is
   displayed to users after they start a remote client and run the Client
   Installation Wizard.
10. Click Next, click Finish, and then click
    Done.

Authorize RIS in Active
Directory

1. Click Start, point to Administrative Tools, and then click
   DHCP.
2. In the left pane, right-click DHCP, and then click Manage
   Authorized Servers.
3. If your server is not listed, click Authorize, type the name or the
   IP address of the RIS server, and then click OK.
   
   NOTE: If
   you are prompted to confirm the RIS server, verify the name and IP address, and
   then click OK.
4. Click Close, and then quit the DHCP console.

Set User Permissions

With RIS, clients can install their own client operating system. The users must
also be granted permissions for creating computer accounts in the domain. To
make it possible for users to create computer accounts anywhere in the domain:

1. Click Start, point to Administrative Tools, and then click
   Active Directory Users and Computers.
2. In the left pane, right-click your domain name, and then click Delegate
   Control.
3. In the Delegation of Control Wizard, click Next.
4. Click Add.
5. Type the name of the group that requires permission to add computer accounts
   to the domain, and then click OK.
6. Click Next.
7. Click to select the Join a computer to the domain check box, and then
   click Next.
8. Click Finish.

Install Clients By Using RIS

This section describes how to install a client operating system on a computer
that contains a network adapter that supports PXE DHCP-based boot ROM. To
install a client operating system:

1. Make sure that the network adapter is set as the primary boot device in the
   computer BIOS.
2. Restart the client computer from the network adapter.
3. When you are prompted to do so, press F12 to start the download of the
   Client Installation Wizard.
4. At the "Welcome" screen, press ENTER.
5. Type a user name that has permissions to add computer accounts to the
   domain, and then type the domain name and password for this user.
6. Press ENTER.
7. When you receive a warning message that states that all data on the client
   computer hard disk will be deleted, press ENTER.
8. A computer account and a global unique ID for this workstation are
   displayed. Press ENTER to start Setup.
9. If you are prompted to do so, follow the instructions on the screen to
   complete the client operating system installation.

Compare IIS and Apache: Common Questions from Apache Administrators

Administrators who are accustomed to working with Apache ask many of the following questions as they evaluate IIS:

Does IIS offer the performance and scalability I need?

IIS has proven its ability to handle the scalability and performance requirements of high-traffic sites. Both Apache and IIS 7.0 allow administrators to optimize performance and scalability with bandwidth throttling, compression, and some load balancing. Static and dynamic compressions are built in to IIS 7.0 in order to use bandwidth efficiently. IIS 7.0 also supports bandwidth throttling, while Windows Server 2008 includes full featured network load balancing.

Apache administrators are accustomed to installing Apache on a trimmed-down server installation. Microsoft provides a similar platform for IIS with the “Server Core” installation option. This option means that the operating system is using the fewest resources possible, which makes more resources available to handle the Web workload and ensures that fewer components are installed, requiring less management and maintenance. The modular nature of IIS also helps improve performance, allowing administrators to enable only the modules they need, resulting in a faster processing pipeline.

Caching often provides the biggest performance improvement for Web sites, and IIS provides built-in output caching and object caching that can automatically detect when the underlying database has changed. Apache administrators will find that these IIS 7.0 features are similar in functionality to the caching modules that they typically use with Apache.

The performance and scalability of IIS are proven by some of the most highly trafficked Web sites. For example, Match.com runs IIS to process its 30 million daily page views. In 2004, PlentyOfFish.com used one IIS 6.0 server running at 65 percent of capacity to handle 31 million daily page views from 40,000−50,000 concurrent users ; the site currently handles 1.2 billion page views per month. MySpace.com runs IIS to handle the whopping 23 billion page views it gets every month.

Is IIS as secure as Apache?

Microsoft developed Windows Server 2003 and Windows Server 2008 under its Security Development Lifecycle (SDL), which uses education, quality gates, threat modeling, attack surface reduction, static analysis, fuzz and penetration testing, and a final security review to ensure that products are as secure as possible. In addition, the Microsoft Security Response Center engages with external security researchers and is even involved in the security community through its participation in, for example, the Black Hat conference. These efforts have resulted in a substantial reduction in vulnerabilities across the Microsoft product suite, with particularly steep reductions in OS, Web server, and database vulnerabilities. The modular nature of IIS 7.0 further reduces the risk of exploitable flaws, as most modules are not installed by default to keep the attack surface small.

In addition to having fewer vulnerabilities, IIS includes a number of new security features. For example, IIS 7.0 isolates each Web site into its own “sandbox” to help prevent single-site exploits and failures from compromising other sites or the entire server. The IIS process, which executes requests from the web, run as a restricted user account by default, and does not require administrative privileges. To further protect the Web server, IIS 7.0 includes request filtering. Request filtering is a rules-based security module that inspects every incoming request for malicious request patterns, such as SQL injection attacks. This prevents some malicious requests from ever reaching the core Web server.

Finally, IIS is deeply integrated with Windows Server 2008, which can be installed using the Server Core installation option. In this mode, the server has no graphical user interface, and the removal of many components reduces the surface area and patching requirements of the operating system. According to Michael Leefers, systems administrator at the Information Services and Technology Division at the University of California, Berkeley, “with Server Core, we saw a way to reduce a server’s vulnerability to attack, but also its need for patches and our administrative overhead associated with patch monitoring and installation.”

IIS is a both a secure product, and has important security features. Because Microsoft developed IIS6 and IIS7 under the SDL, the Web server continues to enjoy low vulnerability counts. IIS provides the same functionality as Apache authentication, access control, and SSL modules. Plus, IIS makes these features easy to use and configure.

Is IIS harder to manage than Apache?

IIS offers administrators a relatively easy-to-use graphical user interface that can manage local and remote Web servers. IIS 7 also provides command line tools to manage the server and hosted applications. Earlier versions of IIS stored configuration information in a binary database format, but starting with IIS 6.0, the Web server began storing information in a text file. Now, with IIS 7.0, that text file is portable between machines with different machine names, thus allowing administrators simply to copy the configuration file to different Web servers to ensure that they are configured identically. Administrators can also place the configuration file on a network share, where multiple Web servers can read it.

Fortune 500 companies and high-volume Web hosts report that the management interface of IIS 7.0 meets their management needs. As Ben May, senior systems engineer at Dell, reports, “Windows Server 2008 and IIS 7.0 are absolutely cornerstone to how all this would work. We will no longer have to touch individual machines; we’ll have a cloud of servers that we can direct in an automated way.”

Jeff McGeath, CTO of Accent on Integration, explains, “With IIS 7.0 we have one centralized hosting environment so we can do single-point deployment and manage the services much more effectively. This is something we simply couldn’t do before.”

Hosters also find IIS 7.0 easy to manage. As Dominic Foster, lead engineer for MaximumASP, explains, “Before, we had to have a programmer to create batch files and automate processes. But with IIS 7.0, anyone can do it, which makes management faster and easier.”

Mike Graves, senior Windows system administrator for Adhost, says, “With Windows Server 2008 and the Shared Configuration feature of IIS 7.0, we can go from a bare-bones box to a running Web server in about one hour—a four-hour savings over Windows Server 2003. Site setup can be done in about a quarter of the time—10 minutes to activate a site via script, versus 40 minutes. And we’re expecting to cut our webmaster and administration time in half as well.”

Apache focuses on management primarily through manual editing of configuration files or using command-line routines. Apache users will be happy to know that IIS supports these techniques, too. IIS supports modification to the configuration files while the server is running, after which the server will automatically pick up the changes without requiring a server restart. The combination of administrative graphical user interfaces for local and remote administration, configuration text files, full-featured command-lines, and scriptable APIs ensures that administrators can choose the most productive method to perform a given administrative task.

Is IIS as reliable as Apache?

Users of IIS report that it is a stable and reliable Web server. Like Apache, IIS has a number of features to help ensure reliable and available operation.

Apache administrators are familiar with using open-source projects like monit to restart Apache based on failed requests, CPU usage, or other factors. IIS also enables administrators to restart the process based on simple configuration options. IIS can monitor and recycle the process based on an apparent crash, elapsed time, total number of requests, amount of memory usage, or other factors. A controlled IIS process “recycle” should not result in any dropped requests.

Fifty-six percent of Fortune 1000 companies already depend on IIS 6 or 7. Mike Graves of AdHost provides his experience with IIS7, explaining, “In terms of stability, we’ve been running Windows Server 2008 for two months now, and have been monitoring it every three minutes from five different Web servers. So far we haven’t seen even a flicker of downtime.”

Is IIS really as modular as Apache?

Yes. IIS has been re-architected to be extremely modular. Microsoft ships 40 modules with IIS 7.0, with “extensions” to IIS available from Microsoft and the developer community.

Like Apache, IIS now uses modules for core functionality, and by default, only 10 modules are installed. These modules provide:

• Common HTTP features, including static content, default document, directory browsing, and HTTP errors

• Health and diagnostics features such as HTTP logging and request monitoring

• Security features such as request filtering

• Performance features such as static content compression

• Management tools, including the IIS Management Console

• Windows Process Activation Service to start the Worker Process on the first request

Additional modules are included to provide functionality for authentication, authorization, compression, application frameworks (such as CGI and the .NET Framework), health monitoring, diagnostics, and logging.

Since the release of IIS 7.0, Microsoft has developed new modules for bit-rate throttling and URL rewriting, which provides functionality similar to the mod_rewrite module available for Apache. Outside of Microsoft, modules are available from software vendors, and open-source modules can be found on CodePlex.com.

As James Hanauer, a senior software engineer at ServiceU, explains, “The modular architecture of IIS 7.0 and its integration with the newest version of the Microsoft .NET Framework contribute to increased Web server performance. These same characteristics provide a customizable platform where specialized server components such as authentication and logging can be extended or replaced.”

Rich Korb, assistant manager of Data Center Operations for WeatherBug, says, “We really like the ability to pick which components of IIS 7.0 we need—whether it’s using the integrated mode to run ASP.NET applications, using the classic pipeline to run ASP.NET through the ISAPI filter, or just running a streamlined HTTP Web server.”

Apache is an innovative platform. What about IIS?

You can expect Microsoft, the ISV ecosystem, and the open-source developer community to continue to innovate with IIS to meet future hosting provider, developer and corporate needs. The modular architecture of IIS 7.0 ensures that important innovation can happen even outside of Microsoft, and Microsoft continues to listen to customers and partners alike.

IIS 7.0 includes a number of important innovations. It is fully scriptable and able to operate with no GUI. Microsoft also enhanced IIS 7.0 by allowing it to run FastCGI applications, such as PHP, very effectively.

To Apache administrators, these innovations may seem to imply that IIS is only catching up to Apache, but in reality, IIS has its own set of unique innovations. In addition to its new GUI administrative interface, IIS 7.0 includes many performance enhancements that permit it to host more sites and handle more traffic on the same hardware. Windows Process Activation Service can start up the Worker Process on the first HTTP request. IIS includes application pools and sandboxing to let you control reliability and isolation on a per-site basis. IIS supports editing of configuration files while the server is live, and automatically applies the changes. IIS also includes robust static and dynamic output caching, as well as object caching for back-end data.

Microsoft continues to evolve IIS to meet the needs of a diverse audience that includes companies hosting their own sites, sites hosted through co-location that require remote management, and hosters that service hundreds or thousands of customers.

According to hosting company eLinia, “Microsoft really listened to the hosting community when it developed Windows Server 2008. The changes in Internet Information Services 7.0 mean that we can tailor the system to do exactly what we want.”

Craig Tadlock, chief systems architect for Spot Runner, says, “IIS 7.0 is a more feature-rich platform than previous Web servers. IIS 7.0 reduces the amount of foundational technology, such as logging and auditing, that we need to develop on our own and thereby simplifies our services and, ultimately, our systems.”

Troubleshooting Web applications can be complicated. What does IIS offer to simplify troubleshooting?

Apache records errors in a log file that includes information from the Apache HTTP server and additional information from the relevant modules. Apache also lets users control the amount of information logged, ranging from emergency issues only to verbose debugging information. If users need additional information, they can add such things as mod_log_forensic to capture entire requests.

IIS also logs errors, and Microsoft has focused on ensuring that IIS error messages are understandable and useful. IIS defaults to providing verbose error information on the localhost and a more generic message to remote users to ensure that security information is not remotely disclosed. Error information often includes suggested causes and solutions. IIS also provides Failed Request Tracing, which lets users capture entire requests. Failed Request Tracing lets you set the number of log files to keep, which URLs should be traced, and which response codes should generate a trace. Users can even specify that requests for certain URLs be captured only if those requests take over a certain amount of time to process.

Dawn Getteau, systems architect at Continental Airlines, explains, “The troubleshooting features in IIS 7.0 have been enhanced by leaps and bounds. At the end of the day, what matters to us and our users is not just how well our IIS applications run, but also how fast we can troubleshoot them if they go down.”

Hostbasket’s Van Pottelberghe says, “There’s nothing cryptic about it. If something goes wrong, we track it, repair it, and quickly finish the configuration.”

Gregory Storme, systems engineer of COMBELL, comments, “Before, when a client’s Web site wasn’t performing well, the old debugging tools provided a lot of output. With 500 Web sites running, it was nearly impossible to find the relevant error information. Failed Request Tracing in IIS 7.0 makes it a lot easier to see just the requests that we’re interested in, with the status codes and other details that we need to debug the site or the application.”

I depend on a wide variety of Web architectures. Can I run them on IIS?

IIS provides more application choice. This may seem counterintuitive, as there are innumerable open-source Web projects such as blogs, forums, customer relationship management (CRM) systems, content management systems (CMS), and wikis. But many of these popular Web applications run on IIS and Apache. Microsoft has provided simple step-by-step instructions for running Drupal, LimeSurvey, phplist, Coppermine, Gallery2, Mambo, WordPress, XOOPS, MediaWiki, and other popular applications on IIS. SpikeSource offers simple installers for phpBB, WebCalendar, Moodle, and Mantis on IIS. SugarCRM, Alfresco, JBoss, and many other corporate-backed open-source projects are also supported on IIS.

In addition, there are a number of popular Web applications—including SharePoint, and Outlook Web Access—that run on IIS only. This lets you consolidate your Web sites onto fewer servers. For example, IIS permits you to host WordPress and SharePoint on the same machine, which is exactly what Web hoster CrystalTech does. Jon Thompson, CrystalTech’s server operations manager, explains, “We can work with whatever our customers want to write. They have access to ASP, ASP.NET, PHP, and Perl as well.”

Yes, PHP applications can run on IIS, but is it really a good idea?

Microsoft invested heavily in FastCGI and Windows Server 2008 to ensure that PHP and other CGI frameworks would run as first-class citizens on Windows.

In addition to providing the basic infrastructure for running PHP applications, IIS-specific features are also available for those workloads. For example, you can use IIS authentication mechanisms such as NTLM that integrate with Active Directory. You can use the SQL Server driver for PHP. In addition, PHP applications get the benefit of IIS application pools and sandboxing. PHP also benefits from the performance that IIS Kernel Mode Caching offers. PHP and ASP.NET can be combined for quick development by leveraging certain functionality that ASP.NET provides out of the box, such as Forms Authentication. Users can apply the exact same modules across PHP and ASP.NET sites, such as, URL Rewriter. By running PHP on Windows, you’re able to use the same management tools to monitor your PHP workloads that you use to monitor your Windows workloads.

Companies such as COMBELL are providing their customers the capability of running PHP on Windows and today are seeing the results. As Frederik Poelman, technical director of COMBELL, explains “In the past, if customers asked for PHP hosting, we offered them Linux; if they asked for ASP or ASP.NET hosting, we offered Windows Server. Now we have a bunch of test customers running PHP on IIS 7.0, and it is working very well for them. The more customer requirements we can support with one operating system, the more experts we can have developing new solutions on that operating system.”

Will IIS be more expensive than Apache?

If you do your own cost comparisons, you’ll likely find that the total cost of IIS on Windows is the same or less than Apache on Linux.

Apache may be free software, but users should keep in mind that up-front cost is not the only type of price to be paid. Software vendors often market against free software by talking about the total cost of ownership (TCO). Even though TCO has become a widely used marketing term, certain commonsense TCO concepts apply from an administrator’s perspective.

For example, although Apache is free, it does not come with support. Organizations deal with this lack of support in two ways. One method involves paying for support though a Linux subscription such as Red Hat Enterprise Linux or Novell SUSE Linux Enterprise.

But some organizations quickly find that the costs of Linux support subscriptions are comparable to, or even more expensive than, Windows licensing. These companies can turn to the second method: supporting Apache with internal expertise. This means that organizations have to hire highly skilled experts in order to run mission-critical applications on Apache—in some regions these experts are hard to find. In contrast, Windows expertise is relatively common.

Some organizations may also find that administrative tasks can be performed more quickly on IIS. Since software acquisition is 7 percent of TCO, while staffing is 60 percent, staff costs can quickly outweigh acquisition costs.

Consider one case study: “At aruba.it, Italy’s largest hosting service provider, Microsoft found that the TCO of its existing Windows-based shared hosted services was 16 percent lower than the TCO of its Linux-based offerings. Moreover, the contribution margin from the Windows-based services was 14 percent higher than the contribution margin from the analogous Linux-based services. Finally, the profit margin for Windows was 81 percent compared to 77 percent for Linux.”
Article from Microsoft

Backing Up the Group Policy Objects

Begin the process by logging on to a Windows Server 2008 domain controller, and opening the Group Policy Management console. Now, navigate through the console tree to Group Policy Management | Forest: | Domains | | Group Policy Objects. When you do, the details pane should display all of the group policy objects that are associated with the domain. In Figure A there are only two group policy objects, but in a production environment you may have many more.
Figure A

The Group Policy Objects container stores all of the group policy objects for the domain.
Now, right-click on the Group Policy Objects container, and choose the Back Up All command from the shortcut menu. When you do, Windows will open the Back Up Group Policy Object dialog box. As you can see in Figure B, this dialog box requires you to provide the path to which you want to store the backup files. You can either store the backups in a dedicated folder on a local drive, or you can place them in a folder on a mapped network drive. The dialog box also contains a Description field that you can use to provide a description of the backup that you are creating.
Figure B

You must provide the path to which you want to store your backup of the group policy objects.


To initiate the backup process, just click the Back Up button. When the backup process completes, you should see a dialog box that tells you how many group policy objects were successfully backed up. Click OK to close the dialog box, and you're all done. Backing Up Individual Group Policy Objects
In case you're wondering, Windows Server 2008 does allow you to backup individual group policy objects. The process for doing so is very similar to what I just showed you. The difference is that when you select the Group Policy Objects container, shown in Figure A, you would right-click on an individual Group Policy Object rather than on the Group Policy Objects container. From there, you would choose the Back Up command from the shortcut menu. The rest of the process is identical to what you have already seen.
The Anatomy Of The Back Up
When you create a backup, Windows creates individual folders within the target folder. Each of these individual folders bears the GUID of the Group Policy Object that contains. This is true whether you are backing up an individual Group Policy Object, or all of the Group Policy Objects in the entire domain. You can see what the backup folder looks like in Figure C.
Figure C

Windows creates a separate folder for each Group Policy Object.
The Restoration Process
When it comes to restoring a backup of any Group Policy Object, you have two options. The first option is to right-click on the Group Policy Object, and choose the Restore From Backup command from the shortcut menu. When you do this, Windows will remove all of the individual settings from the Group Policy Object, and then implement the settings found in the backup.
Your other option is to right-click on the Group Policy Object you want to restore, and choose the Import Settings option. This option works more like a merge than a restore. Any settings that presently reside within the Group Policy Object are retained unless there is a contradictory settings within the file that is being imported.
Source>> http://www.petri.co.il

FSMO Roles in Active Directory

Windows 2000/2003 Multi-Master Model

A multi-master enabled database, such as the Active Directory, provides the flexibility of allowing changes to occur at any DC in the enterprise, but it also introduces the possibility of conflicts that can potentially lead to problems once the data is replicated to the rest of the enterprise. One way Windows 2000/2003 deals with conflicting updates is by having a conflict resolution algorithm handle discrepancies in values by resolving to the DC to which changes were written last (that is, "the last writer wins"), while discarding the changes in all other DCs. Although this resolution method may be acceptable in some cases, there are times when conflicts are just too difficult to resolve using the "last writer wins" approach. In such cases, it is best to prevent the conflict from occurring rather than to try to resolve it after the fact.
For certain types of changes, Windows 2000/2003 incorporates methods to prevent conflicting Active Directory updates from occurring.

Windows 2000/2003 Single-Master Model

To prevent conflicting updates in Windows 2000/2003, the Active Directory performs updates to certain objects in a single-master fashion.
In a single-master model, only one DC in the entire directory is allowed to process updates. This is similar to the role given to a primary domain controller (PDC) in earlier versions of Windows (such as Microsoft Windows NT 4.0), in which the PDC is responsible for processing all updates in a given domain.
In a forest, there are five FSMO roles that are assigned to one or more domain controllers. The five FSMO roles are:
Schema Master:
The schema master domain controller controls all updates and modifications to the schema. Once the Schema update is complete, it is replicated from the schema master to all other DCs in the directory. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.
Domain naming master:
The domain naming master domain controller controls the addition or removal of domains in the forest. This DC is the only one that can add or remove a domain from the directory. It can also add or remove cross references to domains in external directories. There can be only one domain naming master in the whole forest.
Infrastructure Master:
When an object in one domain is referenced by another object in another domain, it represents the reference by the GUID, the SID (for references to security principals), and the DN of the object being referenced. The infrastructure FSMO role holder is the DC responsible for updating an object's SID and distinguished name in a cross-domain object reference. At any one time, there can be only one domain controller acting as the infrastructure master in each domain.
Note: The Infrastructure Master (IM) role should be held by a domain controller that is not a Global Catalog server (GC). If the Infrastructure Master runs on a Global Catalog server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a Global Catalog server holds a partial replica of every object in the forest. As a result, cross-domain object references in that domain will not be updated and a warning to that effect will be logged on that DC's event log. If all the domain controllers in a domain also host the global catalog, all the domain controllers have the current data, and it is not important which domain controller holds the infrastructure master role.
Relative ID (RID) Master:
The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. When a DC creates a security principal object such as a user or group, it attaches a unique Security ID (SID) to the object. This SID consists of a domain SID (the same for all SIDs created in a domain), and a relative ID (RID) that is unique for each security principal SID created in a domain.  Each DC in a domain is allocated a pool of RIDs that it is allowed to assign to the security principals it creates. When a DC's allocated RID pool falls below a threshold, that DC issues a request for additional RIDs to the domain's RID master. The domain RID master responds to the request by retrieving RIDs from the domain's unallocated RID pool and assigns them to the pool of the requesting DC. At any one time, there can be only one domain controller acting as the RID master in the domain.


PDC Emulator: The PDC emulator is necessary to synchronize time in an enterprise. Windows 2000/2003 includes the W32Time (Windows Time) time service that is required by the Kerberos authentication protocol. All Windows 2000/2003-based computers within an enterprise use a common time. The purpose of the time service is to ensure that the Windows Time service uses a hierarchical relationship that controls authority and does not permit loops to ensure appropriate common time usage.
The PDC emulator of a domain is authoritative for the domain. The PDC emulator at the root of the forest becomes authoritative for the enterprise, and should be configured to gather the time from an external source. All PDC FSMO role holders follow the hierarchy of domains in the selection of their in-bound time partner.
In a Windows 2000/2003 domain, the PDC emulator role holder retains the following functions:

• Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
• Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
• Account lockout is processed on the PDC emulator.
• Editing or creation of Group Policy Objects (GPO) is always done from the GPO copy found in the PDC Emulator's SYSVOL share, unless configured not to do so by the administrator.
• The PDC emulator performs all of the functionality that a Microsoft Windows NT 4.0 Server-based PDC or earlier PDC performs for Windows NT 4.0-based or earlier clients.

This part of the PDC emulator role becomes unnecessary when all workstations, member servers, and domain controllers that are running Windows NT 4.0 or earlier are all upgraded to Windows 2000/2003. The PDC emulator still performs the other functions as described in a Windows 2000/2003 environment.
At any one time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest.

For more Details click below link>>

Windows 2000 Active Directory FSMO roles - 197132

Microsoft Network Monitoring Tools

Microsoft Network Monitor
Microsoft Network Monitor is a network protocol analyzer that lets you capture, view, and analyze network traffic. Version 3.3 of Network Monitor is available in 32- and 64-bit versions.

Download it from microsoft site,

http://www.microsoft.com/downloads/details.aspx?FamilyID=983b941d-06cb-4658-b7f6-3088333d062f&displaylang=en

 

Microsoft Baseline Security Analyzer
The Microsoft Baseline Security Analyzer (MBSA) is an easy-to-use tool designed to help administrators of small and medium-sized businesses ensure that their Windows-based computers are secure. You can use MBSA to determine the security state of your computers in accordance with Microsoft security recommendations. MBSA also offers specific remedia¬tion guidance for security problems it detects, such as misconfigurations and missing security updates.
At the time of writing this, the current version was MBSA 2.1. This version is available in 32- and 64-bit versions, but it does not install on Windows 7. A new version that supports Windows 7 is due to be released sometime in the future. You can download the current version and get information regarding the a version for Windows 7 at microsoft.com/mbsa/.

Microsoft IPsec Diagnostic Tool
The Microsoft IPsec Diagnostic Tool helps network administrators troubleshoot network-related failures, focusing primarily on Internet Protocol security (IPsec).The tool checks for common network problems on the host machine and, if it finds any problems, it suggests re¬pair commands. The tool also collects IPsec policy information on the system and parses the IPsec logs to try to determine why the failure might have happened. The tool also provides trace collection for virtual private network (VPN) connections, the Network Ac¬cess Protection (NAP) client, Windows Firewall, Group Policy updates, and wireless and system events. The diagnostic report generated by the tool is derived from the system logs collected by the tool during its analysis phase. Download it now.

Windows Sysinternals Suite
The Windows Sysinternals Suite is a set of advanced tools for troubleshooting issues with Windows-based computers. These tools were originally developed by Winternals Software LP, which Microsoft acquired in 2006. Some of the useful and popular tools included in this suite are:

• Autoruns This tool lets you see what programs are configured to start up automati¬cally when your system boots. It also displays the full list of registry and file locations where applications can configure autostart settings.
• BgInfo This tool automatically generates desktop backgrounds that include important information about the system, including IP addresses, computer name, network adapt¬ers, and more.
• Process Explorer This tool lets you find out what files, registry keys, and other objects that your processes have open, which dynamic-link libraries (DLLs) they have loaded, and who owns each process.
• Process Monitor This tool lets you monitor the file system, registry, process, thread, and DLL activity on your computer in real time.
• PsTools This set of command-line tools can be used for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and performing other tasks.
• RootkitRevealer This tool lets you scan your system for rootkit-based malware.
• ShellRunas This tool allows you to launch programs as a different user using a shell context-menu entry.
• TCPView This tool lets you view active sockets on the computer in real time.

ntldr is missing press any key to restart

 

Solution :-

 
1. Change your pc boot Priority from BIOS and make first boot device as  cd rom/dvd.
2.Then restart the machine and wait till it ask you for press r for Recovery.
3. press r
4. choose which windows if you have more than one os install in your pc, then write the number and press enter key
5. provide your pc's administrator password and run below command to reslove the problem
copy f:\i386\ntldr c:\
copy f:\i386\ntdetect.com(here 'f' is cd drive)

6. if it ask for overwrite than press "y"
7. write exit press enter
9. Then it will boot from your hard disk to OS normally.

TCP/IP module missing from npqtplugin4.dll.it may be infected by virus

Solution:-
 

Step1 : download mbam from www.malwarebytes.org ,install it and get updates.
Step2 : start scan using mbean ,it shows infected files and registry enties and removes them .
Step3 : it asks for restart ,click ok.

Step4: go to c drive ,tools->folderoptions->view->select show hidden files and folders




















Step5: delete autorun.bat and thb.ico .
some times show hidden files and files option will not work though you selected option .
so in this case u need to delete above files using dos commands.
Step6: Restart you machine .