The Best Damn Windows Server 2003 Book Period- P67

Chia sẻ: Cong Thanh | Ngày: | Loại File: PDF | Số trang:10

Thêm vào BST

Báo xấu

36
lượt xem 2
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

The Best Damn Windows Server 2003 Book Period- P67:The latest incarnation of Microsoft’s server product,Windows Server 2003, brings many new features and improvements that make the network administrator’s job easier.This chapter will briefly summarize what’s new in 2003 and introduce you to the four members of the Windows Server 2003 family: the Web Edition, the Standard Edition, the Enterprise Edition, and the Datacenter Edition.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: The Best Damn Windows Server 2003 Book Period- P67

Chapter 19 Ensuring Active Directory Availability In this chapter: Understanding Active Directory Availability Issues Performing Active Directory Maintenance Tasks Backing Up and Restoring Active Directory Troubleshooting Active Directory Availability Introduction In earlier chapters, we looked at the Active Directory (AD) infrastructure, as well as var- ious interacting elements, such as forest, sites, domains, and trusts. We also examined the Global Catalog, Schema, and Group Policy in order to fully understand AD in a Windows Server 2003 environment. Now that we’ve thoroughly reviewed this informa- tion, we can discuss how to ensure AD availability. This chapter deals with how to maintain high availability of your Active Directory services.You’ll learn about the Active Directory database, and the importance of system state data to Active Directory availability. We’ll discuss fault tolerance plans as well as Active Directory performance issues.You’ll ﬁnd out how to perform necessary mainte- nance tasks, such as defragging the database, and you’ll learn how to monitor or move the database. Next, we’ll address backup and restoration of the Active Directory, and show you the different restoration methods that you can use and when each is appropriate. We’ll walk you through the steps of performing both an authoritative and a normal restore. Finally, you’ll learn how to troubleshoot Active Directory availability problems. 627
628 Chapter 19 • Ensuring Active Directory Availability Understanding Active Directory Availability Issues In this section, we look at the core components of the Windows Server 2003 Active Directory ser- vice. First, we discuss the structure and type of database, including its ﬁles and related components. You’ll also learn how updates are written to the Active Directory database, and how it recovers in the event of a failure during the update process. We will review the key system conﬁguration com- ponents that comprise the system state data, and look at fault tolerance and performance issues involving Active Directory. The Active Directory Database The Active Directory service is based on a transactional database system.The word transactional refers to the transaction logs that enable the system to have robust recovery and data tracking in the event of unscheduled hardware outages, data corruption, and other problems that can arise in a complex network operating system environment.The heart of the Active Directory service is the database and its related transactional log ﬁles, which include the following: I Ntds.dit This ﬁle is the primary Active Directory database ﬁle (sometimes referred to as the data store) that resides on each domain controller (DC). It stores all of the objects, attributes, and properties for the local domain, as well as the conﬁguration and schema portions of the database. By default, this ﬁle is installed into the %SYSTEMROOT%\NTDS folder. Although not required, it is recommended that you store this ﬁle on an NTFS partition for security purposes. I Edb*.log This ﬁle format identiﬁes transaction logs.Transaction log names can take one of several forms, including edb.log, edb00001.log, edb00002.log, and so forth. Each log ﬁle is a ﬁxed 10MB in size, regardless of the amount of actual data stored in it.The current log ﬁle that is receiving updates to Active Directory is named edb.log. When this ﬁle is full, it is renamed to edb00001.log (or whatever the next number is in the sequence, if 00001 is taken), and a new empty edb.log is created. However, these logs don’t keep piling up for- ever; they are regularly purged through a process called garbage collection, discussed later in the chapter. I Res1.log and Res2.log These ﬁles are known as the reserved (Res) log ﬁles.Their pri- mary purpose is to ensure that Active Directory does not run out of disk space to use when logging transactions. If there is not enough free space to create a new transaction log, the reserved log is used. Because of this role, these log ﬁles are often referred to as placeholders. Like the edb.log ﬁles mentioned previously , these ﬁles are 10MB each. I Edb.chk The “checkpoint” ﬁle is used to track the updates that have been written to the Active Directory database.You can think of this ﬁle as a list that is checked off as updates are ﬂushed to disk from the Active Directory log ﬁles. If you shut down the system before all transactions have been written to the database, the checkpoint ﬁle will be consulted when you reboot the system so that any remaining transactions can be written to Active Directory.
Ensuring Active Directory Availability • Chapter 19 629 Microsoft recommends that you place the database and the log ﬁles on different physical disks, for performance purposes. Now, let’s take a deeper look at how Active Directory works, and the roles these ﬁles play in the process of updating and storing data. Data Modiﬁcation to the Active Directory Database The Extensible Storage Engine (ESE) lies at the heart of the Active Directory database system. Changes to the Active Directory database on a DC occur through two primary means: I An administrator creates, deletes, or updates objects in the database. I Replication information, which contains new objects, deletion requests, or changes to existing objects is received from other DCs. When changes to the database occur, the ESE captures each change as a single unit known as a transaction. A transaction contains the changed data and a set of metadata.This metadata can include the Globally Unique Identiﬁer (GUID) assigned to the object, a timestamp, version, and other infor- mation. It’s important to note that this update procedure applies to all changes in Active Directory, including objects, properties, and attributes. A write request occurs when a change is made to the Active Directory.This initiates a transac- tion that consists of the changes, as well as the metadata described previously. ESE writes the trans- action to the transaction buffer in memory, and then writes the transaction to the Edb.log ﬁle. After it has been successfully written in the log ﬁle, it is written to the Active Directory database ﬁle. If a failure occurs, when Active Directory recovers, it examines the Edb.chk ﬁle to determine which transactions have not been written to the database.Transactions are not marked as written in this ﬁle until they have been fully committed to the database.This ensures that a failure that occurs partially through the process of writing data will not be marked as completed and leave inconsistent data in the Active Directory database. When a transaction has been committed, Active Directory compares the information written to the database with the information contained in the log ﬁle(s). When the two have been veriﬁed as identical, the Edb.chk ﬁle is updated and the transaction is marked as committed to the database. Windows Server 2003 uses circular transaction logging.This means that, with the exception of the Edb.log, Res1.log, and Res2.log ﬁles, the log ﬁles are deleted after all of the transactions they contain have been committed to the database. Another important note about logging is that when you back up Active Directory by backing up the system state data (a process we discuss in the next section of this chapter), all events currently waiting to be written in your transaction logs are com- mitted.The logs are fully committed when you shut down or reboot your server. Figure 19.1 illus- trates this process.
630 Chapter 19 • Ensuring Active Directory Availability Figure 19.1 The Active Directory Data Commitment Process Additions, Check point Changes, file (Edb.chk) and Deletions updated Extensible Storage Engine Transaction (ESE) creates committed to transaction database Transaction Transaction written to written to log memory file (Edb.log) The Tombstone and Garbage Collection Processes The use of transaction logs is designed to ensure the integrity of data that changes on a single DC. Other mechanisms assure the integrity of changed information in relation to the Active Directory replication process. One of these is the tombstone process, which is used to replicate deletions from one DC to another. When an object is deleted within Active Directory, the ESE engine creates a transaction for it (as described in the previous section) and it is moved to the deleted object’s container within the database. It is important to note that the object is not immediately purged from the database.There is a delay between when the item is deleted and when it is ﬁnally removed from the database alto- gether.This delay is known as the tombstone interval and is set at 60 days by default.The tombstone process exists to support the multimaster replication strategy of Windows Server 2003’s Active Directory service. Each DC holds the object in its deleted items container for the length of the tombstone interval.The default of 60 days allows for plenty of time to pass and ensures that all DCs on the network have sufﬁcient time to receive the delete request. When this interval is reached, the object is marked as expired. You should ensure that backups are performed during the tombstone interval. Restores of direc- tory service data older than the tombstone interval should not be performed to prevent the reintro- duction of objects that were deleted during this period but have since been purged from the database. The garbage collection process works in conjunction with the tombstone process. It runs every 12 hours on DCs by default, and one of its primary functions is to purge expired objects from the database. After the expired objects are purged, any remaining unnecessary log ﬁles are deleted and an online defragmentation of the database occurs.This consolidates the free space that was generated by the deletions and increases the performance of the database.
Ensuring Active Directory Availability • Chapter 19 631 System State Data System state data is a term Microsoft uses to refer to a set of core conﬁguration information in Windows 2000, XP, and 2003.The actual information included in the system state depends on the underlying conﬁguration of the operating system, and which components are installed. System state data is most commonly associated with backup and restore operations.The backup tool released with Windows 2000 (and all subsequent versions) included the option to back up all of these critical open resources by selecting the system state backup option. Fault Tolerance and Performance You can take several key actions to ensure fault tolerance and maximize performance for the Active Directory database. Maintaining proper backups is, by far, the most important action you can take to provide fault tolerance. We discuss this in more detail later in the chapter. Defragmentation of the Active Directory database is also is a key performance component, and we cover this later in the chapter as well. For performance reasons, Microsoft recommends that the Active Directory database and log ﬁles be on separate physical disk drives attached to separate hard drive controllers or channels. In other words, they recommend that each disk be in its own data path so that there is no contention between these components in the ﬁle system.This means that both drives can be read from and/or written to at the same time.This provides both fault tolerance and improved performance. Performing Active Directory Maintenance Tasks In this section, we’ll look at some of the day-to-day and less routine tasks that you can expect to perform in the process of managing your Active Directory environment including ofﬂine and online AD defragmentation, moving the database ﬁles and backing up and restoring AD. Defragmenting the Database As mentioned previously, by default, Windows Server 2003 begins a maintenance cycle every 12 hours, known as the garbage collection process.The ﬁnal portion of the Garbage Collection process is the performance of an online defragmentation and re-index of the Active Directory database.This is done to improve the performance of the database. The Ofﬂine Defragmentation Process Although Windows Server 2003 runs an online defragmentation twice per day by default, there might be times when you need to actually recover available free space from the Active Directory database ﬁle.This can only be done by performing an ofﬂine defragmentation.This type of defragmen- tation process is much more invasive than its online counterpart, and should be done only when absolutely necessary. For example, when the GC role is removed from a server, this information is deleted from its Active Directory database ﬁle, leaving a large amount of free space that can be recovered.
632 Chapter 19 • Ensuring Active Directory Availability As with many invasive Active Directory database operations, you must be booted into a special mode known as the Directory Services Restore Mode to perform an ofﬂine defragmentation.The local administrator account is used when performing database maintenance operations in Directory Services Restore Mode. You can access the Directory Services Restore Mode by booting or rebooting the computer, pressing the F8 key when prompted, and selecting Directory Services Restore Mode from the Windows Advanced Options menu.You will be prompted to log on, and you must use the adminis- trator account. Note that this account is not the domain administrator account; it is a special local account.The password for this local account is set during the installation of directory services on the local computer. After you are authenticated by the local SAM, you can perform advanced directory services maintenance functions. Many of these are performed with the Ntdsutil utility. To perform an ofﬂine defragmentation of the Active Directory database, use the following steps. Perform an Ofﬂine Defragmentation of the Active Directory Database 1. Back up the system state data for fault tolerance purposes. See the Backing Up Active Directory section later in this chapter for more information. 2. Boot or reboot the computer. 3. When prompted, press F8 during Windows Server 2003 startup. 4. Select Directory Services Restore Mode (Windows DCs only) on the Windows Advanced Options menu that appears, and press the Enter key. 5. Select your operating system (for example, Windows Server 2003, Enterprise), and press the Enter key. 6. You will see a number of checks performed while the system is booting, and you eventu- ally will receive the Safe Mode logon prompt. 7. Log on by providing the password for the local administrator account and clicking the OK button. 8. Click the OK button in the dialog box that notiﬁes you that Windows is running in safe mode. 9. Open a command prompt. 10. Type ntdsutil to enter the Ntdsutil utility. Note that this is a command-line utility, so the command prompt will change to ntdsutil:. 11. Type ﬁles.The command prompt should change to display ﬁle maintenance. 12. Type compact to :\ to create a defragmented and compacted copy of the Active Directory database in the speciﬁed new location. For example, compact to C:\ADTemp creates a defragmented, re-indexed, and re-sized database ﬁle in the C:\ADTemp directory, as shown in Figure 19.2.The location speciﬁed can be on a local disk or on a mapped network drive. If there are spaces in the path where the ﬁle needs to be placed, it must be surrounded in quotes; for example, “compact to c:\ad\july defrag”.
Ensuring Active Directory Availability • Chapter 19 633 Figure 19.2 The Ntdsutil Compact To Command 13. Type quit to return to the ntdsutil: prompt. 14. Type quit again to exit the utility. 15. Open Windows Explorer and rename the previously used ntds.dit ﬁle to ntds.old.dit. NOTE Step 15 is not speciﬁed in Microsoft’s instructions, but we recommend it for fault tol- erance purposes. As mentioned, an ofﬂine defragmentation is very invasive. It is pos- sible that the compacted ﬁle will be corrupt and that Active Directory will not start after the procedure. If you don’t take this step, you will be forced to do a system state restore to recover the previous database ﬁle. By simply renaming the ﬁle, you can boot back into Directory Services Restore Mode, delete the corrupt ﬁle, and rename ntds.old.dit back to ntds.dit to recover the system. 16. In Windows Explorer, copy the new ntds.dit ﬁle from the location you speciﬁed, using the compact to command to specify the location of the primary ntds.dit ﬁle location. 17. In Windows Explorer, delete all ﬁles that end with the .LOG extension in your Active Directory log ﬁles folder. 18. Close the command prompt window and reboot the server normally. Moving the Database or Log Files At some point, it might become necessary to move the Active Directory database or log ﬁles. Most often, this occurs because you need to move the ﬁles to a new hard drive or array of hard drives. Performance might dictate this decision. New faster drives and controllers can be used to replace slower ones as usage increases.The decision might also be dictated by a lack of free space as the Active Directory database and components grow.
634 Chapter 19 • Ensuring Active Directory Availability Moving the database or log ﬁles is relatively simple. It is done from the command line using the Ntdsutil utility. Because the database and log ﬁles cannot be open when they are moved, the opera- tion must be carried out while in Directory Services Restore Mode.The following steps outline how to move the Active Directory database and log ﬁles. 1. Back up the system state data for fault tolerance purposes. See the Backing Up Active Directory section later in this chapter for more information. 2. Boot or reboot the computer. 3. When prompted, press F8 during Windows Server 2003 startup. 4. Select Directory Services Restore Mode (Windows DCs only) on the Windows Advanced Options menu that appears, and press the Enter key. 5. Select your operating system (for example, Windows Server 2003, Enterprise), and press the Enter key. 6. You will see a number of checks performed while the system is booting, and eventually you will receive the Safe Mode logon prompt. 7. Log on by providing the password for the local administrator account and clicking the OK button. 8. Click the OK button in the dialog box that notiﬁes you that Windows is running in safe mode. 9. Open a command prompt. 10. Type ntdsutil to enter the Ntdsutil utility.This is a command-line utility so the command prompt will change to ntdsutil:. 11. Type ﬁles.The command prompt should change to display ﬁle maintenance:. 12. Use one of the following commands to move the Active Directory database or log ﬁles, or update their paths. I Type move DB to :\ to move the ntds.dit database ﬁle to the new location speciﬁed. For example, move DB to C:\AD moves the database ﬁle to the C:\AD directory and updates the Registry to point to this new location, as shown in Figures 19.3 and 19.4. I Type move logs to :\ to move the Active Directory log ﬁles to the new location speciﬁed. For example, move logs to C:\AD moves the log ﬁles to the C:\AD directory and updates the Registry to point to this new location.
Ensuring Active Directory Availability • Chapter 19 635 Figure 19.3 Moving the Active Directory Database with Ntdsutil, First Screen Portion Figure 19.4 Moving the Active Directory Database with Ntdsutil, Second Portion of the Screen 13. Ensure that the database (or log ﬁles) is now referenced in the proper location by typing info. 14. Type quit to return to the ntdsutil: prompt. 15. Type quit again to exit the utility. 16. Close the command prompt window and reboot the server normally.