The Best Damn Windows Server 2003 Book Period- P68

Chia sẻ: Cong Thanh | Ngày: | Loại File: PDF | Số trang:10

Thêm vào BST

Báo xấu

45
lượt xem 2
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

The Best Damn Windows Server 2003 Book Period- P68:The latest incarnation of Microsoft’s server product,Windows Server 2003, brings many new features and improvements that make the network administrator’s job easier.This chapter will briefly summarize what’s new in 2003 and introduce you to the four members of the Windows Server 2003 family: the Web Edition, the Standard Edition, the Enterprise Edition, and the Datacenter Edition.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: The Best Damn Windows Server 2003 Book Period- P68

636 Chapter 19 • Ensuring Active Directory Availability Monitoring the Database It’s important to implement a consistent Active Directory monitoring strategy to ensure database integrity, reliability, and performance within your forest. Regular monitoring can also improve your knowledge of Active Directory and assist you in determining when a problem is in the early stages of unfolding.This will lead to performance and service issues being resolved in a much more timely manner. It is important to remember that Active Directory does not exist in a vacuum. Performance and service issues that seem to relate to Active Directory can be caused by other key infrastructure com- ponents, such as name resolution services. In the following sections, we look at some of the primary tools that you can use to monitor Active Directory. Using Event Viewer to Monitor Active Directory You can use the Windows Server 2003 Event Viewer tool is accessed via Start | Programs | Administrative Tools | Event Viewer, to view a variety of event logs on the DC. For moni- toring the directory service, the following event logs are of particular interest: I DNS Server This event log displays information relating to the DNS server service if it is installed on the DC. It is common in small environments and remote ofﬁces to have a single server acting as both DC and DNS server (along with other roles). Because clients running Windows 2000 and later operating systems use DNS to locate DCs and GC servers, problems with this service can severely impact Active Directory availability on the network. I System This event log displays critical information concerning the state of the operating system as a whole. Examining the System log should be part of the review procedure because underlying system stability is critical to optimum functionality of a DC.The System event log is also used to display messages that notify you when the DC’s DNS record was not registered or updated properly. I Application This event log displays extensive information from Group Policy and other related Active Directory components. I Directory Service This is the primary event log for Active Directory. It includes infor- mation related to when the directory service starts and stops, the Garbage Collection pro- cess, online defragmentation, and much more. I File Replication Service This service controls the replication of SYSVOL, which con- tains critical data such as Group Policy and replication topology connection information. In a large domain, event logs can grow quite rapidly, which makes it difﬁcult to search through them for key events. Microsoft recommends using the ﬁlter or search functionality to speciﬁcally seek out events matching the following criteria: I All records with an Error severity level in the Directory Service or FRS event logs. I All LSASS records in the System event log with a severity level of Error.The Local Security Authority subsystem (LSASS) is the primary security subsystem for Active Directory.
Ensuring Active Directory Availability • Chapter 19 637 I All Kerberos V5 Key Distribution Center (KDC) records in the System event log with a severity level of Error.The KDC is the primary logon service for Windows 2000 and later clients in Active Directory. I All USERENV records in the Application event log with a severity level of Error.This setting can indicate problems with the application of Group Policy. Using the Performance Console to Monitor Active Directory The Performance console is another tool that comes preinstalled in Windows Server 2003 and can be very helpful in monitoring Active Directory.The Performance console is accessed via Start | Programs | Administrative Tools | Performance, is capable of monitoring the server on which it is installed, and other remote servers. Data from any number of Windows Server 2003 computers can be combined for tracking or display purposes. Windows contains a variety of perfor- mance metrics that can be monitored with this utility.The Performance utility consists of the three following components: I System Monitor This portion of the utility is used to graphically display performance metrics. I Counter and Trace logs These options allow for detailed levels of logging over time. In most cases, you won’t have time to sit around all day watching the System Monitor, which charts real-time information. Instead, you’ll need data that you can review and work with when it is convenient. I Alerts The Alerts option allows you to specify critical thresholds that, when exceeded, cause some type of action to take place.The default action is to have the alert generate a message in Event Viewer.You can also have it send a network message, start logging to a preconﬁgured counter log, or execute a script, batch ﬁle, or program. The metrics that are monitored using the Performance console are called counters.These coun- ters are grouped according to the objects to which they pertain. Figure 19.5 some of the counters available for the NTDS (directory services) object. Figure 19.5 The Add Counters Dialog Box
638 Chapter 19 • Ensuring Active Directory Availability Microsoft recommends that you use the following performance counters for monitoring Active Directory: I NTDS performance object counters: I DRA inbound and outbound counters These counters are used to track the amount of replication information that ﬂows into and out of a site. Signiﬁcant changes can indicate a major increase in the amount of replication trafﬁc or a shift in the site replication topology. I DS Search sub-operations/sec Signiﬁcant changes in this counter can indicate an application that is incorrectly targeting a DC, or performance problems involving the DC. I LDAP Searches/sec This counter corresponds to the overall number of LDAP searches per second on the DC. It should be relatively consistent across all of your DCs in a well-planned and balanced environment. If it isn’t, this counter can indi- cate that an application is incorrectly targeting a DC (rather than spreading its use out across several DCs). It can also indicate uneven client loads.This counter is also useful for tracking trends over time for capacity planning. I LDAP Client Sessions This counter displays the number of clients that are con- nected to the LDAP services. It can also be used to track uneven client loads, which might be indicative of connection failures to other DCs in a well-planned and balanced environment. Like the LDAP Searches/sec counter, this counter is useful for tracking trends over time for capacity planning. I NTLM Authentications This counter indicates the number of domain authenti- cations taking place using the NTLM protocol. Windows 2000 and later clients should use Kerberos for authentication, but will fail back to NTLM when they are unable to authenticate using Kerberos.This counter can be used to indicate Kerberos authentication issues in these types of environments. I Kerberos Authentications This counter indicates the number of domain authentications that take place using the Kerberos protocol.This counter is helpful in tracking authentication trends over time for capacity planning. I Processor object counters: I % Processor Time This counter can be used to track the overall consumption of processor resources in the DC. Microsoft recommends that this counter not exceed 85 percent on a sustained basis. I % DPC Time This counter alerts you to delayed execution of processes resulting from the DC being too busy to execute them. Microsoft recommends a sustained threshold of 10 for this counter.
Ensuring Active Directory Availability • Chapter 19 639 I System object counters: I Processor Queue Length This counter indicates that the system cannot keep up with processing requests. When you see the word queue in any counter, the counter tracks the number of things “waiting in line” to use the resource. Microsoft recommends that this counter not exceed a value of 6 on a sustained basis. I Context Switches/sec Most modern processors can only execute one thread at a time. Although it appears that the computer is running many programs at once, each program is actually sharing the processor with all others. Each thread (the smallest unit of executable code in a program) uses the processor for a short period of time and then passes it on to the next.This concept is referred to as time slicing. A context switch occurs when the processor switches between waiting processes. This counter can indicate too many applications (including operating system appli- cations) for the processor to service, or applications that are too busy for the pro- cessor to keep up with. Microsoft recommends that this counter not exceed 70,000 on a sustained basis. I Memory object counters: I Page Faults/sec This counter indicates when needed program code is not resi- dent in memory and must be loaded from disk (from the page ﬁle).This is often an indication of a system in need of more physical RAM. Microsoft recommends a sustained threshold of 700 for this counter. I Available MBytes This counter indicates the amount of available system memory. Microsoft recommends using this counter to conﬁgure an alert that will notify you when the DC is running low on memory resources. I PhysicalDisk:Current Disk Queue Length counter This counter can be used to track the number of disk reads and writes that are waiting to be ﬁlled.This can be the result of a busy processor that is not able to keep up with IRQ requests, or a slow disk drive or subsystem. Microsoft recommends that this counter not exceed a value of 2 on a sustained base. Use the following steps to conﬁgure System Monitor to display the key NTDS object counters. Use System Monitor to Monitor Active Directory 1. Open the Windows Server 2003 Performance console from Start | Programs | Administrative Tools | Performance. 2. Select the System Monitor node in the left pane.
640 Chapter 19 • Ensuring Active Directory Availability 3. In the right pane, right-click on the graph and select Add Counters… in the context menu that appears. Note that you can also click the + button on the toolbar above the graph to add a new counter. 4. In the Add Counters dialog box, select NTDS from the Performance object: drop- down box. 5. In the Select counters from list: box, select the DS Search sub-operations/sec counter. 6. Click the Add button. 7. Repeating steps 5 and 6 after each addition, add the following counters: LDAP Searches/sec, LDAP Client Sessions, NTLM Authentications, and Kerberos Authentications. 8. Click the Close button in the Add Counters dialog box. 9. Your new counters should appear in the list in the right pane under the graph, as shown in Figure 19.6. Select one of these counters by clicking on it in this list. Figure 19.6 The Performance Console without Highlighting Enabled 10. Press Ctrl + H to highlight the counter in the graph.This tool is often used to display a large number of counters, making it very difﬁcult to tell them apart in the graph. Using the highlight feature makes this much easier. 11. Close the Performance console. Backing Up and Restoring Active Directory Although it’s technically just a collection of ﬁles, Active Directory has its own unique backup and restore methods. In this section, we’ll discuss backing up and restoring the Active Directory database.
Ensuring Active Directory Availability • Chapter 19 641 Backing Up Active Directory Several different methods can be used to back up Active Directory: I As part of a full system backup I As part of a partial system backup I Back up the system state data only In the past, the Active Directory database had to be backed up as system state data. Microsoft Backup and some other third-party backup programs are now able to use a new Windows Server 2003 feature known as the Volume Shadow Copy service to work around this open ﬁle issue. Volume Shadow Copy makes a read-only copy of the information in these open ﬁles, which can be used for backup purposes.The original ﬁles continue to be accessed without any interference from the backup operation. When the backup is complete, the Volume Shadow Copy is deleted.The amount of disk space required by the Volume Shadow Copy will vary, based on the amount of data that changes on the disk during the backup procedure. If the underlying disk does not have enough free space to support Volume Shadow Copy, open ﬁles are not backed up. When preparing a backup job, rather than specifying the individual ﬁles for Active Directory to be backed up, it is best to always use the system state data selection in the utility. System state will be backed up automatically when a full system backup is selected, and can be speciﬁed manually when a partial backup is selected. Using the system state backup feature ensures that all necessary ﬁles are backed up. When using the Windows Server 2003 backup utility, if you select system state data, Volume Shadow Copy is enabled by default and cannot be disabled. If you do not select system state data, you can choose to use Volume Shadow Copy (still selected by default) or not within the Backup Wizard. Backing Up at the Command Line Instead of using the graphical Backup utility, you can back up the system state data by using the command-line version of the Backup utility.This might be desirable for use with administrative scripts.The command-line utility is a full-featured backup program that can specify many of the same options covered in the previous section.To back up the system state data, open a command prompt (Start | Run and type cmd) and use the following command and options: ntbackup backup systemstate /J “Syngress Backup Job” /F “C:\backupﬁle.bkf ”. I Ntbackup is the name of the command-line backup utility. I Backup is the option to specify a backup operation. I Systemstate is the option used to specify that the system state data should be backed up. I /J speciﬁes the backup job name, which should be surrounded in quotes if it contains spaces. I /F speciﬁes the name of the backup ﬁle.
642 Chapter 19 • Ensuring Active Directory Availability Note that when you run this command, the graphical utility appears to show you the progress of the job. There are many more switches that you can use with the Ntbackup command-line utility; those described here are the ones you will most commonly use to back up the system state data. Restoring Active Directory Windows Server 2003 includes three types of directory services restore methods: I Primary I Normal I Authoritative The Active Directory restore options have seen some signiﬁcant changes since Windows 2000. In Windows 2000, there were only two methods of restoration: Authoritative and Non- Authoritative. With Windows Server 2003, Authoritative restores remain unchanged; however, Non- Authoritative restores are now referred to as Normal restores. Despite the name change, they function exactly as they always have. A new type of restore is added, the Primary restore.This is designed to be used when all DCs for a given domain have been wiped out and need to be restored. Under Windows 2000, this could be an exhaustive Authoritative restore process involving many hours of labor and double-checking. With the new Primary restore type, it is as simple as selecting a check box. Directory Services Restore Mode Before we discuss the three different restore methods that can be used, it is important to discuss the Directory Services Restore Mode. Remember that the special feature of this mode is that it allows a DC to boot without initializing its copy of the Active Directory database. Because you must always log on to a Windows Server 2003 computer before you can use the operating system, a small ver- sion of a local directory service database (called a SAM database) remains on the computer after it has been promoted to a DC.This database has a single account, the local administrator account. When you have booted to the Directory Services Restore Mode using the directions given ear- lier in the chapter, you must log on with this account. After you are authenticated, you can perform certain limited maintenance functions, such as running the Ntdsutil utility mentioned earlier.You can also run the Backup utility to perform restores of the Active Directory database. It is necessary to perform all restores while running in this mode, because the Active Directory database must be ofﬂine to be restored. In this mode, you are logged on to a local account and the Active Directory database is not in use. Normal Restore The simplest of all restore methods is the normal restore.This method can be used in the following circumstances: I When a domain only has one DC, and the DC needs to be restored.You can also opt to use the primary restore method (covered later) for this scenario.
Ensuring Active Directory Availability • Chapter 19 643 I If there are multiple DCs on the network for the domain, and at least one remains func- tional, a normal restore can be used to bring the downed DCs back to life. Like all Active Directory restores, a normal restore is performed by running the Backup utility while logged on to Directory Services Restore Mode. When the restore has completed, the DC is rebooted. When it comes back up, it begins normal replication with its replication partners. Because it was restored from a backup, some of its objects will have older version numbers than ones cur- rently on the network.This will cause updates and deletions to be replicated to the DC and will bring its Active Directory database up to date.To perform a normal restore, follow these steps: 1. Boot or reboot the computer. 2. When prompted, press F8 during Windows Server 2003 startup. 3. Select Directory Services Restore Mode (Windows DCs only) in the Windows Advanced Options menu that appears, and press the Enter key. 4. Select your operating system (for example, Windows Server 2003, Enterprise), and press the Enter key. 5. You will see a number of checks performed while the system is booting, and eventually you will receive the Safe Mode logon prompt. 6. Log on by providing the password for the local administrator account and clicking the OK button. 7. Click the OK button in the dialog box that notiﬁes you that Windows is running in safe mode. 8. Open the Windows Server 2003 Backup utility from Start | All Programs | Accessories | System Tools | Backup. 9. On the initial page of the wizard, click the Next button. 10. Select the option button next to Restore ﬁles and settings and click the Next button. 11. The What to Restore page contains an Explorer style interface similar to the one you encountered while conﬁguring your backup job. Click the plus sign next to File in the left pane.This should reveal the ﬁle to which you backed up the system state data earlier. If it doesn’t, you can click the Browse… button and select the ﬁle from the Open Backup File dialog box. Click the plus sign next to the ﬁle to which you backed up and select the check box next to the backup you want to restore that appears beneath it. Click the Next button after making your selection. 12. At this point in the wizard, you can click the Finish button and allow the restore to pro- ceed with the default advanced settings. However, we want you to see more of the settings that are available within the wizard, so click the Advanced… button. 13. The Where to Restore page appears with three options that can be selected from the Restore ﬁles to: drop-down box. I Original location This option restores all ﬁles to their original locations and is the default. When you select this option and click the Next button, a dialog box
644 Chapter 19 • Ensuring Active Directory Availability appears, informing you that restoring system state will always overwrite the current system state information unless you restore to an alternate location. Click the OK button to proceed to the next screen. I Alternate location Selecting this option reveals the Alternate location: text box and a Browse… button that opens the Restore Path dialog box.You can use this option to restore the ﬁles to a different location.This can be helpful for veriﬁ- cation and ﬁle comparison purposes. I Single folder This option reveals the Alternate location: text box and Browse… button, which opens the Restore Path dialog box. As with the Alternate location setting, you can use this option to restore the ﬁles to an alter- nate location. When this option is selected, all restored ﬁles are placed in a single directory, rather than having their directory structures restored. 14. Click the Next button after making your selection. 15. Depending on your selection, a Warning dialog box (shown in Figure 19.7) might appear to inform you that a restore of system state data will always overwrite the current system state data unless you choose to restore it to an alternate location. Click the OK button if you receive this dialog box. Figure 19.7 The System State Restore Warning Dialog Box 16. The How to Restore page contains the following three options: I Leave existing ﬁles (Recommended) This option ensures that the restore pro- cess does not overwrite any ﬁles that currently exist on the DC. I Replace existing ﬁles if they are older than the backup ﬁles This option permits the ﬁles on the disk to be overwritten, but only if the backup ﬁle is newer than the one currently on the DC. I Replace existing ﬁles Always copies the ﬁles from the backup media to the DC and replaces all ﬁles existing on the DC, regardless of whether they are newer. 17. After making your selection, click the Next button to proceed. 18. The Advanced Restore Options page contains the following ﬁve check boxes: I Restore security settings This option is selected by default, and should remain selected. It shows the power that a user with restore rights has, because any such
Ensuring Active Directory Availability • Chapter 19 645 user can, by deselecting this check box, restore the ﬁles without their associated permissions. In some circumstances, difﬁculties can arise when restoring data that was on a disk formatted in the NTFS ﬁle system, which supports ﬁle level permis- sions, to one using the FAT ﬁle system, which does not support ﬁle level permis- sions. In circumstances like these, clearing this check box has been known to resolve some of the issues.This is because selecting this box restores a wide range of extended data (permissions, auditing information, and ownership information) that is not supported by the FAT ﬁle system. I Restore junction points, but not the folders and ﬁle data they reference Among other things, junction points are used to reference mounted drives. In Windows Server 2003, volumes can be mounted in folders of another volume, instead of being accessed through a drive letter. If you do not restore junction points, you will not be able to restore the information on mounted drives unless you recreate the junction points manually. I Preserve existing volume mount points This option relates to the preceding point. When using mounted drives, it is necessary to create mount points, which are the empty folders to which the volume is mounted (thus creating the mounted drive). When selected, this box protects existing mount points on the volume being restored.This is helpful if you have already formatted the disk to which you are restoring and added these mount points prior to beginning the restore. However, if you have formatted the disk to which you are restoring and have not added these mount points back manually, clearing this check box will restore your old mount points from tape.This option is selected by default. I Restore the Cluster Registry to the quorum disk and all other nodes This option restores the cluster quorum database and replicates it to all of the nodes in the server cluster.This option will be grayed out if the DC is not part of a server cluster. I When restoring replicated data sets, mark the restored data as the pri- mary data for all replicas This option is used to perform a primary restore and is covered in detail later in the chapter. 19. Click the Next button after making your selections. 20. Click the Finish button to begin the restore. 21. The restore will take at least a few minutes and display its progress as shown in Figure 19.8. When it is ﬁnished, click the Close button (shown in Figure 19.9) to close the Restore Progress dialog box, or click the Report… button to view the backup log asso- ciated with the job. Clicking the Report… button will display the Notepad application with the log ﬁle displayed, as shown in Figure 19.10.You should review the log for any error messages, such as those pertaining to ﬁles that had to be skipped. When you have ﬁnished reviewing the log, close the Notepad application.