In this post, we'll cover the steps needed to install the MS Graph PowerShell module, verify it works, and perform a couple examples of its use.

Prerequisites

To install the module, you need a couple things. You likely already have these if your running a later version of Windows 10, or Windows 11, but lets just throw them here as a reminder.

• PowerShell 5.1 or newer
•  
• .NTE Framework 4.7.2 or newer
•  
• Latest version of PowerShellGet

I am going to start with installing PowerShell 7. The easiest way to do this with with winget.

winget install --id Microsoft.Powershell --source winget

The install from winget will look similar to below:

Or download it from the official GitHub releases.

iex “& { $(irm https://aka.ms/install-powershell.ps1) } -UseMSI”

If you install via the msi - Just leave all of the options as their defaults.

Once the installation completes, close your existing PowerShell window and search for PowerShell 7 in your start menu.

With that out of the way, we can install Microsoft Graph

Install Microsoft Graph PowerShell Module

Use the following examples to install the latest (stable) version of the Microsoft Graph PowerShell module from the PowerShell Gallery.

To install the module for the current user scope:

Install-Module Microsoft.Graph -Scope CurrentUser

Or to install for all users on your system: (you will need local admin rights on your system):

Install-Module Microsoft.Graph -Scope AllUsers

Both commands can both be run in PowerShell 5.1 or PowerShell 7; however, installing one does not install it for the other.

Below is an example of the command being used to install for all users.

At this point, you may want to verify that everything looks good, so you can run for following command to confirm which version has been installed on your system.

Get-InstalledModule | Where-Object {$_.Name -match "microsoft.graph"}

You should see something similar to the following:

We're now set to connect to graph and perform some magic! Yay!

Connect to Microsoft Graph with PowerShell

Depending on your needs, to interact with Graph you need to outline the parameter's of whether you just need to read data, or if you need to write it as well.

If you want ‘read’ and ‘write’ access to all user accounts in your tenant:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Or if you only need to read the data you can use:

Connect-MgGraph -Scopes "User.Read.All"

This could also be applied to groups:

Connect-MgGraph -Scopes "Group.ReadWrite.All"

For a full breakdown of all the available permissions you can specify when connecting to Graph, refer to the permissions reference sheet from Microsoft: https://learn.microsoft.com/en-us/graph/permissions-reference

What can we do?

So now that we have PowerShell installed, the MS Graph module loaded, and we are connected, below are a few real life uses for the Graph Module.

Setting Azure User account passwords to expire / not expire:

Connect-MgGraph -Scopes "User.ReadWrite.All"

# Set password to never expire

Update-MgUser -UserId "user@domain.com" -PasswordPolicies "DisablePasswordExpiration"

Connect-MgGraph -Scopes "User.ReadWrite.All"

# Set password to expire

Update-MgUser -UserId "user@domain.com" -PasswordPolicies "EnablePasswordExpiration"

Verify what password policy is in effect:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Get-MgUser -UserId "user@domain.com" -Property UserPrincipalName,PasswordPolicies |
Select-Object UserPrincipalName, @{Name="PasswordNeverExpires";Expression={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}

Disable the "Force change password at next sign-in" setting for an Azure AD user:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Update-MgUser -UserId "user@domain.com" -PasswordProfile @{ ForceChangePasswordNextSignIn = $false }

This assumes the user already has a password set. If you're also resetting the password, you can include it like this:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Update-MgUser -UserId "user@domain.com" -PasswordProfile @{
    Password = "NewSecureP@ssw0rd!"
    ForceChangePasswordNextSignIn = $false
}

Finally, enable the "Force change password at next sign-in" setting for an Azure AD user:

Connect-MgGraph -Scopes "User.ReadWrite.All"

Update-MgUser -UserId "user@domain.com" -PasswordProfile @{ ForceChangePasswordNextSignIn = $true}

These are all real life use cases that I have used the MS Graph PowerShell module for. I'd love to see some of your uses - feel free to share them in the comments below.

In this blog post, I will outline the steps I used to set this setting for the big-three browsers - Edge, Chrome and Firefox.

The settings to apply are pretty self-explanatory after you get them in place, however following each vendors documentation can be a little confusing, so my hope in this post is to simplify the steps into 1-easy-to-understand tutorial.

Lets get started:

MS Edge

MS Edge is the easiest to implement.

• Login on Microsoft Intune Admin Center
• Click on Devices > Configuration
• Click on + Create Profile
• Select Platform as Windows 10 and later
• Select Policy type as Settings catalog

• Provide a Name and Description (optional) of the Policy.

• From the Configuration settings tab, select + Add settings
• In the Settings picker blade, Search for "Edge". Then use the image below.

• After the setting is selected, configure the setting to Enabled, and add the URL

• Select Next and configure any Scope tags if applicable.
• Assign the profile to your group of users.
• On the Review + Create tab, review all the settings and confirm everything looks good, then select the blue Create button at the bottom of the page.

Yay! 1 down, 2 more to go.

Google Chrome

Google Chrome is nearly identical to MS Edge to implement.

• Login on Microsoft Intune Admin Center
• Click on Devices > Configuration
• Click on + Create Profile
• Select Platform as Windows 10 and later
• Select Policy type as Settings catalog, Select the blue Create button.

• Provide a Name and Description (optional) of the Policy. Select the blue Next button at the bottom of the screen.

• From the Configuration settings tab, select + Add settings
• In the Settings picker blade, Search for "Google". Then use the image below.

• After the setting is selected, configure the setting to Enabled, and add the URL

• Select Next and configure any Scope tags if applicable.
• Assign the profile to your group of users.
• On the Review + Create tab, review all the settings and confirm everything looks good, then select the blue Create button at the bottom of the page.

That's two out of the way - now it's time for the tough one.

Unfortunately, Firefox doesn't have settings catalog parameters available in Intune as of the time of this tutorial. Here's the 50-thousand-foot-summary - We download template files from their Github, upload them into Intune, and then use those templates to assign some parameters to FireFox.

Okay, Last one best one!

Mozilla Firefox

• First we need the ADMX, and ADML files from their GitHub page here and unzip the file.
• Login on Microsoft Intune Admin Center
• Click on Devices > Configuration
• Click on Import ADMX tab at the top of the page.

• Select + Import
• Import the mozilla.admx and mozilla.adml files. Make sure the status shows Available.
• Import the firefox.admx and firefox.adml files.

NOTE - If you upload firefox.admx before mozilla.adml, the import will fail.

• Head back to : Devices > Manage devices > Configuration > Create > New policy.
• Select Platform as Windows 10 and later
• Select Policy type as Templates, then Imported Administrative templates (Preview) Select the blue Create button.

• Provide a Name and Description (optional) of the Policy. Select the blue Next button at the bottom of the screen.

• From the Configuration settings tab, navigate to the tree to "User Configuration > Mozilla > Firefox > Home page".

• Select both "URL for Home page" and "Start Page" settings.

• Select Next and configure any Scope tags if applicable.
• Assign the profile to your group of users.
• On the Review + Create tab, review all the settings and confirm everything looks good, then select the blue Create button at the bottom of the page.

This should do it. After the next sync cycle, when you open a new browser window or a new tab in any of these browsers, the default URL should be the initial web page to be displayed/loaded.

A couple followup notes in terms of expectations:

• This list isn't locked down. People will be able to navigate away from this page.
• If you open a new tab, the default page will open in the new tab
• On edge, the URL is hidden. That doesn't stop you from navigating away or opening any additional browser tabs.

Tested on :

• Windows 11 - 24H2
• OS Build : 26100.3775

• Chrome version 135.0.7049.115
• Microsoft Edge Version 135.0.3179.98
• Firefox version 137.0.2

Troubleshooting Issues

• If any settings aren't applying even if the profile appears to have deployed correctly : Confirm that you aren't attempting to apply Computer settings on Users or vice-versa. The settings I used above are all "User" targetted. Its also best practice to NOT mix deployments comprised of both.

Reference Links

• Manage Firefox with Microsoft Endpoint Manager (Intune) | Firefox for Enterprise Help
• Import custom and third-party partner ADMX templates in Microsoft Intune | Microsoft Learn

Never Fear, Microsoft has got your back. Microsoft Quick Assist to the rescue!

This is a very simple article about how to use Quick Assist.

What is it?

Quick Assist is a Microsoft Windows feature that allows a user to view or control a remote Windows computer over a network or the Internet to resolve issues without directly touching the system. It is based on the Remote Desktop Protocol (RDP). Quick Assist is installed by default on Windows clients.

Helpers and users agree to assistance by sending/accepting assistance invitations from helpers.  Quick Assist requests a code in order to match users to a session. This will allow the giver to access the computer of the receiver in Administrator mode while allowing the receiver to see the choices the giver made.

How do I use it then?

Simple! and I'm glad you asked. The following is a quick overview of starting, connecting and using Quick Assist.

Left click on the start button

With the start menu open, type "quick" in the search field, quick assist should show up as an App

The main window for Quick Assist will open. You are presented 2 options. 1 to receive help, and the other to give it.

The top part of the screen is for those who are "needing" help.

The bottom part is for those that are "giving" help.

The Helper clicks the button "Help someone" and will be presented with a time sensitive code, that they then exchange with the receiver of the help whom will enter the code in the top box.

The receiver of help will input that code into their quick assist field

After the code is entered and "Submit" is selected the two systems will begin connecting. The person requesting help, will need to allow screensharing by checking the below checkbox and then selecting allow.

The two systems will connect

After the two systems are connected the helper will see a screen similar to this

The helper can request control of the other computer by selecting the button in the admin bar

The receiver of help will see the following at the top of the screen and will need to allow the control request.

The receiver of help can cancel access, or disconnect at any time by selecting any of the options in their respective bar

And that's a quick overview of using Microsoft Quick Assist!

This tutorial will directly reference the Red Hat Satellite with AHV Integration Guide provided from Nutanix Portal. A link to the guide has been provided below.

So to begin this tutorial, I'm going to make the following assumptions about your environment. Before you dig into this guide, please review these assumtions, and make sure you are in a state that matches the below.

Assumptions

1. You have a fully functioning and configured Red Hat Satellite 6.
2. You have the following details regarding your Satellite server
   1. Org Name as it was registered in Satellite
   2. FQDN of the Satellite Server
   3. Username/Password of a user in Satellite (Preferably a service account)
3. Credentials to Prism Central or Prism Element
4. Finally - You have a subscription setup and allocated to the Satellite server.

To begin, we need to install the Nutanix virt-who agent on Satellite. (or any RHEL VM that is registered to either the Satellite server or to the Red Hat Portal.)

• Download the Nutanix virt-who agent from the Nutanix Support Portal here.
• Log into the system in which you are using.. (I used our Satellite server.)
• Upload the .rpm that you downloaded from the Nutanix Portal
• Install the Nutanix virt-who agent by running:

$ yum install rpm-file

• Next we need to create a Nutanix virt-who configuration file that included the details about the AHV cluster.
• Change directory to the /etc/virt-who.d/ directory
• Create a new file. This file can be named any way you like, however it needs to end with a .conf extension.
• Below is an example configuration file:

[ahv]
type=ahv
hypervisor_id=hostname
owner=RedHatAHVOrg01
#env=Library
server=ip.addr.of.prism
prism_central=true
update_interval=1800
username=satellitesvcaccount
encrypted_password=
rhsm_hostname=satellite.domain.net
rhsm_username=virt_whosvc
rhsm_encrypted_password=
rhsm_prefix=/rhsm
#internal_debug=true

• After saving this file, you should now be able to test your configuration to make sure everything is working.
• The agent can be run in on of the following modes:
  • One shot mode to report the VM-to-host mapping to Satellite one time only.
    • $ virt-who -o
  • Continuous mode
    • $ virt-who

At this point everything should be working. You may see some warnings. Some may require some additional configuration to resolve, others may be benign. You'll have to sort through any warnings and decide if they need additional remediation or not.

In this article, I intend to walk through the basics of setting up an initial test controller node on CentOS 7, as well as a simple configuration of a Windows Server 2016 node using a basic Ansible playbook. (perhaps building multiple playbooks for different tasks)

This is my first dive into learning Ansible, and my intent here is to share my experience, and hopefully help you start a simple Ansible environment which you can build and grow from.

Windows and Ansible documentation is located in the official Ansible documentation website.

By following the instructions in this series, you will be able to manage a Windows Server 2016 systems using Ansible as easily as managing any Linux environment.

I intend this article to be a gateway to multiple in a series which possibly will progress into a fully functional production environment. However for just this one instance, I'm simply going to focus on building a sandbox/development environment to learn some basics, then use this as a spring board to expand off of.

Lab Environment

The examples in this article will reference the following configuration:

• One Ansible controller node running CentOS 7
  • For my dev environment, I'm simply using a spare desktop PC I have.
• One Windows 2016 Server to be managed by Ansible
  • I'm using our lab environment, with a virtual machine on vmware esxi 5.5. ( I know, I know.. this is lab... sheesh.)
• One Active Directory Server providing DNS (This can be a standalone just for this environment, or an existing one, as long as you have admin access)

NOTE - You can configure these however you want. however they should be accessible to each other, and you may need to validate firewall settings allow access.

Configure Network Prerequisites

We'll need to create some Forward and Reverse lookup records in DNS for Kerberos to resolve correctly, so make sure you created an "A" record for your linux system, (you can also leverage an "alias" record if you'd like) - as well as a reverse DNS pointer. You decide what fits best in your environement.

Build and configure the Ansible System

NOTE - For the sake of brevity, I will not be coving the build of the Operating System and I am assuming that you have built a base CentOS 7 with a minimum configuration, set the IP address details, and enabled SSH access.

Install Prerequisite Packages

Update the following files. Be sure to modify as appropriate for your own environment.

1. Install GCC required for Kerberos

yum -y group install “Development Tools”

2. Install EPEL Repository

yum -y install epel-release

3. Install Ansible

yum -y install ansible

4. Install Kerberos

yum -y install python-devel krb5-devel krb5-libs krb5-workstation

5. Install Pythos PIP

yum -y install python-pip

6. Update all the system packages to insure everything is at the latest version.

yum -y update

After an full system update, I always find it a good idea to reboot the system, so go ahead and do that now.

reboot

Check that Ansible and Python is Installed and working

ansible --version | head -n 1
python --version

Configure Kerberos

While there are other options to authenticate with Windows guests, Kerberos is generally the best option to utilize in an Active Directory domain.

1. Install the Kerberos PIP Package.

pip install pywinrm[Kerberos]

2. Edit the /etc/krb5.conf file and add the following:

NOTE - Make sure to adjust these to your specific environment. Also make note that I am specifying the domain name is all UPPER CASE LETTERS. This is due to kerberos naming standards. Make sure this is all upper case, as well, when testing, pass the domain name as all upper case or you may get errors.

These following articles explain in greater detail.

• https://www.centos.org/forums/viewtopic.php?f=31&t=36729&p=165954&hilit=kinit%3A+KDC+reply+did+not+match+expectations+while+getting+initial#p165954
• https://access.redhat.com/solutions/871613

Add:

[realms]
DOMAIN.LOCAL = {
  kdc = DC1.DOMAIN.LOCAL
}

Add:

[domain_realm]
.domain.local = DOMAIN.LOCAL
domain.local = DOMAIN.LOCAL

Your completed /etc/krb5.conf file should look similar to this:

Test Kerberos

Run the follow to test kerberos:

kinit <username>@DOMAIN.LOCAL

Enter the password for the user you entered above.

You should see a kerberos KEYRING record similar to below:

At this point, our Ansible machine is now ready for us to start creating some playbooks to run against our windows server.

For my next article, I'll build the Windows Client to manage, and we'll setup some simple playbooks to experiment with. Additionally in the future, I'd like to delve into the Ansible AWX project, and see where that can fit in too! C

1. You have already built your physical/virtual machine
2. You have setup apache and the service is running without issue
3. You have iptables entries created to allow traffic for both http and https

   # iptables -I INPUT -p tcp -m tcp --dport 80 -j ACCEPT
   # iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT

4. You have installed mod_ssl and openssl by running :

   yum install mod_ssl openssl

1. After you receive the certificate from the CA, double-click on the certificate to open it. When you open the certificate, it appears as shown in the following screen shot:
2. Locate the path of the certificate on your computer and double-click on the certificate again to open it.
3. Select the Details tab.
4. Click Copy to File.
5. Click Next in the Certificate Export Wizard window.
6. Select the Base-64 encoded x.509 (.CER) option. This converts the certificate to PEM format.
7. Click Next.
8. Click Browse and select a location to store the converted PEM
9. Click Next.
10. Click Finish. After converting the certificate to PEM format, the certificate has an extension .cer.
11. To verify if the certificate is in PEM format, change the extension to .txt or .doc. The file must start with the line “ BEGIN CERTIFICATE”, as shown in the following screen shot:
12. Using WinSCP, copy the converted .pem certs to:

    /etc/pki/ca-trust/source/anchors

13. Run the following commands to import the root certs into the certificate store.

    # update-ca-trust enable

    followed by:

    # update-ca-trust extract

14. Verify the root CAs are OK

    # openssl verify LegacyIssuing.cer
    LegacyIssuing.cer: OK
    

1. # cd /tmp
   # openssl req -nodes -newkey rsa:2048 -keyout service.something.key -out service.something.csr

2. Copy the csr and key out to your windows machine via winscp.
3. Open the CA website, and request a certificate
4. Based on your specific implementation, you may need to submit an "advanced certificate request"
5. Paste the contents from the CSR file into the box
6. Retrieve the certificates from the site.

1. Copy to the following paths:

   cp service.something.cer /etc/pki/tls/certs
   cp ca.key /etc/pki/tls/private/service.something.key
   cp ca.csr /etc/pki/tls/private/service.something.csr
   

2. Update the Apache SSL configuration file :

   vi +/SSLCertificateFile /etc/httpd/conf.d/ssl.conf
   

   • Change the paths to match where the Key file is stored. If you've used the method above it will be

     SSLCertificateFile /etc/pki/tls/certs/service.something.cer

   • Then set the correct path for the Certificate Key File a few lines below. If you've followed the instructions above it is:

     SSLCertificateKeyFile /etc/pki/tls/private/service.something.key
     

3. Finally, Quit and save the file and then restart apache

   service httpd restart

Get-SCOMManagementPack | where{$_.defaultlanguagecode -notlike “ENU”} | Remove-SCOMManagementPack

• With ADUC open, select view, and then check the box next to "Advanced Features"

1. Select the user you wish to add an Alias for > Right click the name, and select properties.
2. Now, Remember that advanced features check box I mentioned above, because we selected that, you will now see a tab called, "Attribute Editor". If you don't see this tab, go back and check the box for "Advanced Features", and then kick yourself, for not paying attention.
3. Find the variable proxyAddresses – this is the one you want to edit.
   When you add new e-mail aliases, you want to make sure that your primary e-mail address will start with upper-case SMTP. Your aliases, aka, secondary addresses should be lower-case smtp.For example, I want my primary e-mail address to be chrisisawesome@example.com In the proxyAddresses attribute, I would put: SMTP:chrisisawesome@example.com As my alias, I want chrisrox@example.com… to do this, I will use lower case smtp: smtp:chrisrox@example.com
4. Apply the new settings, and click OK
5. Wait patiently for your active directory to be synchronised with Office 365 (by default this happens every 3 hours but you can force this with a bit of research. - We'll leave that for another article, here's a link to the new ADSync tool)]]> Tutorials https://chrisbmn.com/blog/how-to-perform-manual-sync-with-the-new-azure-ad-connect/ https://chrisbmn.com/blog/how-to-perform-manual-sync-with-the-new-azure-ad-connect/ Wed, 04 Nov 2015 09:57:39 -0600
6. Open an elevated Windows Azure AD Module for Powershell window.
7. Navigate to the "C:\Program Files\Microsoft Azure AD Sync\bin" folder.
8. Run either the .\DirectorySyncSlientCmd.exe with either the Initial or Delta argument.

1. So the first thing we need to do, is grab a few prerequisites.

   yum install wget sudo vim system-config-network-tui kernel-headers ntp perl gcc make unzip -y

2. Second we need to grab the public keys from VMware, here's a link to their keys. http://packages.vmware.com/tools/keys
3. Import the keys (I put mine in a folder in tmp, /tmp/vmware):

   rpm --import /key_path/key_name

4. Now, we'll create a repository file. Navigate or create the file at: /etc/yum.repos.d/vmware-tools.repo - You can name it whatever you want, as long as its meaningful to you.
5. Add the following content to the file:

   [vmware-tools]
   name=VMware Tools
   baseurl=http://packages.vmware.com/tools/esx/5.5u2/rhel6/x86_64
   enabled=1
   gpgcheck=1

   NOTE - Keep in mind, I am doing this on a CentOS 6.7 VM, on ESX 5.5 U2, 64bit. If you are using a different flavor, you'll need to adjust for your version. Refer to the VMware Tools Installation Guide for Operating System Specific Packages for more information.
6. Now, its just a matter of running the following command:

   yum install vmware-tools-esx-kmods vmware-tools-esx

7. After the installation completes, reboot.
]]> Tutorials https://chrisbmn.com/blog/enable-the-server-graphic-shell-on-server-2016-tp2/ https://chrisbmn.com/blog/enable-the-server-graphic-shell-on-server-2016-tp2/ Tue, 30 Jun 2015 13:51:30 -0500 https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-technical-preview The installation, regardless of what you select, only installs the CORE installation to reduce the OS footprint and minimize the security impact. But what if you want the GUI? You can enable the GUI or (Server Graphics Shell) from within Server Manager. See, I already learned-ya something new today! I will show you how below.
• Navigate to Add Roles and Features Wizard,
• Select Features and under "User Interfaces and Infrastructure", check Server Graphical Shell.
• Confirm the installation, and reboot if desired.
• After a reboot, look at that pretty UI! Yay!
]]> Tutorials https://chrisbmn.com/blog/setting-the-default-domain-for-vcenter-sso/ https://chrisbmn.com/blog/setting-the-default-domain-for-vcenter-sso/ Thu, 16 Apr 2015 08:51:52 -0500 For Example : MYDOMAIN\USER1 or USER1@MYDOMAIN.COM You can eliminate the need to insert the domain in the user name by following the following steps. NOTE - This has to be done in the WebClient. These options are not available in the desktop client.
1. Log in to the vSphere Web Client as administrator@vsphere.local or as another user with vCenter Single Sign-On administrator privileges.
2. Browse to Administration > Single Sign-On > Configuration.
   
3. On the Identity Sources tab, select an identity source and click the Set as Default Domain icon.
   
In the domain display, the default domain shows (default) in the Domain column. When you login to vCenter now, you can omit the DOMAIN from your username and connect as just user1. These are the exact steps as posted in the VMware KB. I added some pretty pictures to assist.]]> Tutorials https://chrisbmn.com/blog/boot-into-safe-mode-on-windows-8server-2012/ https://chrisbmn.com/blog/boot-into-safe-mode-on-windows-8server-2012/ Mon, 13 Apr 2015 13:27:27 -0500 Select the "Troubleshoot" Option. And... Select "Advanced options" Now, from the Advanced Options menu, choose the "Windows Startup Settings" option.. *How anyone is ever to find this, your guess is as good as mine... Finally, Restart. When your system restarts; Look what I found!! ]]> Tutorials https://chrisbmn.com/blog/disable-windows-aero-shake-in-windows-8-8-1/ https://chrisbmn.com/blog/disable-windows-aero-shake-in-windows-8-8-1/ Thu, 22 Jan 2015 08:09:01 -0600 ** I make no guarantee's of entering registry changes on YOUR computer -- USE AT YOUR OWN RISK! **
• Open the Run box. (Windows key + R key)
• Type gpedit.msc and click OK to open the Local Group Policy Editor
• Under User Configuration expand the Desktop folder -- Right click on Turn off Aero Shake windows minimizing mouse gesture, and select Edit, then toggle the setting to Enabled.
• Close the Local Group Policy Editor. Now you can shake windows until you experience blindness and nothing will happen.
Command Line
• Move the mouse into the lower left corner, right click and select Command Prompt (Admin)
• Type the following command, and press enter :

  reg add hkcu\Software\Policies\Microsoft\Windows\Explorer /v NoWindowMinimizingShortcuts /t REG_DWORD /d 0x1 

• Reboot the computer and Aero Shake should be disabled.
]]> Tutorials https://chrisbmn.com/blog/adding-users-to-the-local-administrators-group-using-group-policy/ https://chrisbmn.com/blog/adding-users-to-the-local-administrators-group-using-group-policy/ Wed, 26 Nov 2014 09:04:00 -0600
8. Create a Global Security Group, and name it appropriately.
9. Create / Add your user/s to this newly created group.
10. Open Group Policy Manager and Create a new group policy object (GPO) and link it to an Organizational Unit (OU).
11. Open the GPO and navigate to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups.
12. Right click and choose Add Group. Enter the name of the Active Directory security group you want to add to the local administrators group. Click "Ok" and on the next screen in the “This group is a member of:” section select "Add". Enter Administrators to add the group to the local administrators group. Select OK and close the GPO to save changes. NOTE - This process is additive and users and groups that are currently in the local administrators group are unmodified. You can add additional users to the domain group and they will automatically be part of the local administrators group on servers that apply the GPO. If you want to simply add users to the local administrators group enter Administrators. In the next window under “Members of this group:” click Add and choose the users to add to the local administrators group. NOTE - Any users that are currently in the local administrators group will be removed and replaced with the users you select here. If that is what you want click OK and close the GPO.
13. Navigate to your test server, opened an administrative command prompt and type

    gpupdate /force

14. If you now navigate to the local groups on the server, you should see that your "Local Admins" group is now in the local "Administrators" Group.

• Disable IPMI Over LAN, in iDRAC configuration, under network settings.

Microsoft’s official stance is start with a single domain and implement new domains based on your own requirements as necessary, I can find nowhere an official statement stating the fact that the empty root domain is no longer valid; but it is widely accepted in Active Directory circles that having an empty forest root is no longer best practice – this does not mean it is wrong to implement an empty forest root – it just means that it is no longer best practice.

Assumptions:

• All server will be deployed using Windows Server 2012 R2 Standard Edition.
• Both of these are currently VMs on VMWare Workstation 10.
• Basic Windows Installation is complete. NO roles or features have been installed.
• The first DC is built as a FULL GUI installation, the 2nd, as a CORE installation.
• Full GUI installation is Named RDC01, and CORE installation is named RDC02.
• Windows Firewall will be disabled on both machines.
• Static IP Addresses are set on both machines.
  • 192.168.127.130 - RDC01
  • 192.168.127.131 - RDC02

 Installing the 1st Domain Controller

High Level View

Nuts & Bolts - Installing the Role

1.  So, we have our firewall disabled, and we have a static IP address set. (If not,do that before proceeding any further)
2. Navigate up to the Grey Ribbon, and locate the Manage Link, Select Add Roles and Features
3. On the Window "Before you begin", read though the information, and Select "Next".
4. On the Select installation type tab, Select "Role-based or feature-based installation", Select "Next"
5. On the Select destination server tab, your server should already be highlighted, select "Next"
6. Now here's the good stuff! On the Select server roles tab, Select the check box next to "Active Directory Domain Services" An additional box will pop up prompting you to install the RSAT Tools, AD PowerShell Module, and the ADDS Tools. Leave everything selected, and select "Add Features"  
7. Leave the default options selected on the Select features, and select "Next"
8. ADDS Notes will appear next, Read through the notes, and select "Next"
9. Time to confirm your settings prior to installation. I have selected the Check box next to "Restart the destination server automatically if required". Select "Install" to install the AD DS role.  

Nuts & Bolts - Promoting the Domain Controller

1. Congratulations! you now have the role files installed. Now its time to promote the server to an actual domain controller.
2. In the notification flag in the ribbon, you should see a yellow exclamation, and if you hover, you should see a link to "Promote this server to a domain controller". What are you waiting for, Click that link!
3. This will open the window title "Active Directory Domain Services Configuration Wizard"
4. Under the Deployment Configuration, we are creating a new forest, so select the bubble to "Add a new forest", then enter the new name for your root domain in the text box. Then select "Next"
5. I am creating a 2012 forest and domain, and I want to install DNS on my first Domain Controller, so I will leave the forest, and domain functional levels alone, and leave the Domain Name System (DNS) server check box selected. Type in a complex password and store it in a safe location for the Directory Services Restore Mode Password. Select "Next"
6. On the DNS Options tab, You will receive a warning on the DNS Options page, that's okay! We're installing a DNS server, so select "Next"
7. On the Additional Options tab, The NetBIOS name will be filled in, and should match your Domain Name. There is really no reason to change this, unless you enjoy playing evil practical jokes on your co-workers. Select "Next"
8. On the Paths tab, Leave the Paths as default, and select "Next"
9. Review the options, and select "Next"
10. Next the installer, will check the prerequisites, and if everything checks out, select "Install"
11. On a successful prerequisite check, you have the option to Install. Select "Install" 

Nuts & Bolts - Adding the core Domain Controller

1. At the command prompt, type sconfig.
2. (I don't expect you really need pictures for this part, so I'll breeze through) -- This will open the Server Configuration Dialog. The first thing we will do is change the name of the system. So select #2, I named mine to RDC01.  IMPORTANT NOTE - At this point, you'll be prompted to reboot. Hold off for now, and we'll reboot after we set the IP address below.
3. Next, select #8, and set your Network settings. After you are done here. (you made sure to set your primary DNS server to be the first Domain Controller correct? - if not, go back and change it..)
4. Press 13 to restart the server
5. After the server reboots, log back in, and next we are going to disable the firewall. The command to do this is:

   netsh advfirewall set allprofiles state off

   You should get a simple reply of "Ok."
6. Next, just like the GUI install, we need to install the required files for AD DS. To add the ADDS service role files, we use the powershell command:

   Add-WindowsFeature AD-Domain-Services

   First, we have to switch to powershell by typing.... yep you guessed it... powershell Then Type the command above. And watch it install the components..
7. After the files are installed, we need to promote and join to the existing domain. The following command is used:

   Install-ADDSDomainController -DomainName newdomain.net -Credential (get-credential newdomain\administrator)

   You will be prompted to authenticate to the primary DC. Finally, enter the Safe Mode Password..
8. The next prompt is simply a confirmation of what we're about to do, so when your ready, select either [Y] or [A]
9. And watch it install!
10. With any luck, and if you followed all the steps properly, You now have a pair of Domain Controllers. 1 GUI mode DC, and 1 CORE mode DC! Yippee!

Dell System E-Support Tool (DSET) is a utility that collects configuration and log data for various chassis hardware, storage, software, and operating system components of a Dell PowerEdge server and consolidates the data into a .zip file.

1. Copy and unzip the OM-SrvAdmin-Dell-Web-7.1.0-<bldno>.VIB-ESX<version>i_<bld-revno>.zip file to a directory on the system. For ESXi 5.0 and ESXi 5.0 P1, copy the unzipped file to the /var/log/vmware folder on the ESXi 5.0 U1 server
2. Shut down all guest operating systems on the ESXi host and put the ESXi host in maintenance mode.
3. If you are using vSphere CLI on Windows, navigate to the directory where you have installed the vSphere CLI utilities. If you are using vSphere CLI on Linux, execute the command from any directory
4. Execute the following command: For VMware ESXi4.0/ESXi 4.1:
   vihostupdate.pl --server<IP address of ESXi host>-i -b <path to Dell OpenManage file>
   For VMware ESXi 5.0 U1:
   esxcli --server <IP Address of ESXi 5.0 host> software vib install -d /var/log/vmware/<Dell OpenManage file>
5. Enter the root username and password of the ESXi host when prompted. The command output displays a successful or a failed update.
6. Restart the ESXi host system.
7. Do this for all ESXi hosts you may want to gather this information from.