This FAQ is copyright © 2000 John Savill (SavillTech Ltd) all rights reserved. No part of this document should be reproduced, distributed or altered without my permission. You may print it for your own use personnel use.
The Web version of the Windows NT FAQ is at http://www.ntfaq.com. To subscribe to the Windows NT FAQ send a mail to nt-faq@ed-com.com with subscribe in the body of the message to receive the updated single file version of the FAQ once a week.
This single file version of the FAQ is available for download from http://www.ntfaq.com/faqcomp.zip.
Q. What is the Active Directory?
A. The Active Directory is Microsoft's implementation of a 'Directory Service' and a directory service is basically something that stores data in an organized format and has the mechanisms needed to publish and access the data.
Active Directory is not a Microsoft innovation, but rather an implementation of an existing model (X.500), an existing communication mechanism (LDAP) and an existing location technology (DNS), and each of these are covered in the FAQ.
Before the details of Active Directory are considered, it is important to have an overview of what it is trying to achieve. A directory in its most basic sense is just a container for other information, such as a telephone directory has various entries, and each entry has values. An example would be a name, address and telephone number that would make up a single entry in the directory.
Name: John Savill
Address: 2 SavTech Way, (yeah right :-))
London
Tel: 353 3523
E-mail: john@serverfaq.com
In a large directory these entries may be grouped by location or by their type, e.g. lawyers, pest control, etc, or both which would lead to a hierarchy of each type of person in each location. The actual telephone directory would be a directory service as it contains not only the data but also a means to access and use it. The telephone operator would also constitute a directory service as it has access to the data and presents it to you where you can request data and an answer to your query is given.
Active Directory is a type of Directory Service, it holds information about all resources on the network and clients can query the Active Directory for information about any aspect of the network. Active Directory has a number of powerful features:
The last point regarding partitioning the information in the Directory into different stores does not mean that the Active Directory cannot be queried for information from other domains. Global catalogs are used which contain information about every object in the enterprise forest allowing forest wide searches.
Q. A number of Active Directory descriptions.
A. Below are some definitions for the active directory:
ONE SENTENCE SUMMARY OF DNS AND ACTIVE DIRECTORY:
A dns server is used by a client to provide the address of the client's nearest domain controller, which has a copy of Active Directory, which the client then uses to locate whatever object it's looking for.
ONE PARAGRAPH SUMMARY OF DNS AND ACTIVE DIRECTORY:
First a client contacts a dns (domain name system) server which looks up the client's domain, and provides him with the address of the closest dc in that domain. The client proceeds to contact the dc which can then authenticate him. Once authenticated, the client can search Active Directory (a database on the dc) to find objects the client is looking for, like an address for mail, a file, printer, or list of users in a group, etc. If the client cannot contact a dns server, it won't be able to find its domain controller, since only the dns server has the address of it.
ONE PAGE SUMMARY OF DNS AND ACTIVE DIRECTORY:
When dcpromo is performed on a W2K machine named, say, "fido" for the first time creating a new domain, say, "narnia", dcpromo creates two different kinds of "domains". First it creates a domain on the dns server, in our example: "narnia.extest.microsoft.com". This will be found on the extest dns servers, which are in exlab's minilab in bldg 43. Exlab maintains these as community dns servers to save testers the trouble of installing a dns server every time they want to install W2K. Simplified a little, the dns domain on the extest master dns servers looks like this:
extest.microsoft.com
narnia.extest.microsoft.com
bigthud dc 172.30.224.34
blackie dc 172.20.32.13
etc. (this is very approximate,
but functionally identical)
Clients contact the dns server and it looks up the client's domain. Looking for "narnia" the dns server also discovers "bigthud" and "blackie", both dc's of "narnia". Let's say "bigthud" is the closest dc to the client. The dns server would send the client the address of the dc "bigthud", namely, 172.30.224.34. The client connects and accesses the Active Directory domain database stored on "bigthud" to find objects (like printers, file servers, users, groups, organizational units, etc) in the "narnia" domain. "bigthud" also stores links to other domains in the tree "com". Thus, the client can search a whole tree of domains.
If the search needs to go beyond the client's tree of domains, then a version of Active Directory listing the objects in the whole forest is also available. It is called the Global Catalog. The GC can be kept on any dcs in the forest you may choose, or all, but it does not have to be kept on all.
GC is a shorthand way to access an object ANYWHERE in the forest, but it only provides a few of its attributes, you have to go to the domain AD (always on a dc in that domain) to get the whole object. The GC can be configured to provide whatever object attributes you choose, too, not just a rigid default set of them.
To help in creating objects in AD, the dc also keeps a copy of the classes and hierarchy of classes for the whole forest, too. For example, if we had a class of "baseball players", and a derived class "pitchers" (which is just a player with a few records added of strikeouts and no-hitters, etc) then the class structure would be kept in AD in the part called the "Schema". If we then created an actual group of players we would use our Schema classes to make the players as objects (instances of the classes) in Active Directory. We can also add more classes, eg: "football players" and "quarterbacks" to the Schema, and we call that freedom an "extensible Schema".
The schema is a part of the W2K "configuration namespace" kept on all dcs in a forest. A namespace is a range of labels you put on things, eg: a supermarket "aisle" namespace: aisle=cookies, shelf=top, item=oreo. The configuration namespace in W2K consists of a number of defined items such as physical locations, W2k "sites" (a site is a child of a forest, and can contain machines from any domain, only condition being that all machines in a site have fast reliable net connections for dc replication), and "subnets" which are IP address groupings assigned to sites which help further speed up AD replication amongst dc's, eg: "your dc rocks if it's in the IP subnet and W2K site where its friends are".
Active Directory employs LDAP (Lightweight Directory Access Protocol, a standard Internet protocol that many applications use) to access its records. Why? Because its records are STORED on the dc in "LDAP distinguished name format". But what is LDAP distinguished name format? In the following LDAP distinguished name format example "fred" is a user in the "programming" organizational unit in "narnia" domain in "extest" domain in "microsoft" domain in "com" domain:
cn=fred,ou=programming,dc=narnia,dc=extest,dc=microsoft,dc=com
where cn stands for common name, ou stands for organizational unit, and dc in this case stands for "domain component", NOT domain controller. This is how "fred" appears in Active Directory, and a client such as an administrator can access attributes about fred using that syntax, assuming the client has security permissions to do so.
The client's actions are straightforward, as long as the client talks LDAP to Active Directory. However, an action may be done from a client running an application that uses a different name format. To support this, there are two other name formats that can be used (with a little translating) to access Active Directory:
1. "LDAP URL":
Example:
LDAP://server1.narnia.extest.microsoft.com/cn=fred,ou=programming,dc=narni
a,dc=extest,dc=microsoft,dc=com.
2. "Active Directory Canonical name":
Example:
narnia.extest.microsoft.com/programming/fred. This last one, "Active
Directory Canonical name" is what you'll see in user interfaces in W2K.
A. X.500 is the most common protocol that is used for Directory Management and there are currently 2 main standards, the 1988 and 1993 standards with the 1993 standard providing a number of advances over the older standard. The Windows NT 5.0 implementation of its Directory Services is derived from the 1993 X.500 standard as described below.
The X.500 model uses a hierarchical approach to the objects in the name space with a root at the top of the namespace with children coming off of it. Domains in Windows 2000 are DNS names, for example savilltech.com is a domain name, legal.savilltech.com is a child domain of savilltech.com. Child domains are covered elsewhere.

The example shows a root of the directory service and then a number of children. In this case the first layer or children represent countries, however there are no rules and you may break these down however you want. Imagine each country as a child domain of the root, for example usa.root.com and england.root.com. Each child domain can then be broken into a number of organizations. These organizations can be broken down further into organizational units and various privileges/policies can be applied to each Organization unit. Each Organizational Unit has a number of objects such as users, computers, groups etc.
While the directory service is based on X.500, the access mechanism actually uses LDAP (Lightweight Directory Access Protocol) which solves a number of problems with X.500.
X.500 is part of the OSI model however this does not translate well into a TCP/IP protocol environment so LDAP uses TCP/IP for its communication medium. LDAP cuts down on the functions available with a full X.500 implementation making a leaner faster directory service while keeping the overall structure of X.500.
LDAP is actually the mechanism used to communicate with the Active Directory and performs basic read, write, and modify operations.
More on X.500 can be found at http://www.salford.ac.uk/its024/X500.htm
Q. What is the Global Catalog?
A. The Global Catalog contains an entry for every object in the enterprise forest (the term forest is explained later) but contains only a few properties of each object. The entire forest shares a global catalog with multiple servers holding copies. Searches in the whole enterprise forest can only be done on the properties in the Catalog where as searches in the users own domain tree can be for any property. Only Directory Services (or Domain Controllers) can be configured to hold a copy of the Global Catalog.
Do not configure too many global catalogs in each domain, as you will waste network bandwidth with the replication. One global catalog server per domain in each physical location is sufficient, however NT will set servers as Global Catalogs as it thinks are necessary so there should be no need for you to modify this unless you notice slow query response times.
Since full searches involve querying the whole domain tree rather that the global catalog, grouping the enterprise into a single tree will improve your searches as it will allow you to query on items not in the global catalog, thus a larger search criteria.
Q. How do I configure a server as a Global Catalog?
A. To configure a Windows 2000 domain controller as a global catalog server perform the following:

A. The Schema is a blueprint of all objects in the domain and when first created a default Schema exists which contains definitions for users, computers, domains etc. Because of this, you can only have one schema per domain as you cannot have multiple definitions of the same object.
The default schema definition is defined in the SCHEMA.INI file that also contains the initial structure for the NTDS.DIT (storage for the Directory data). This file is located in the %systemroot%\ntds directory. This file is a plain ASCII format file and can be typed out.
A. In Windows 2000 one domain can be a child of another domain, e.g. child.domain.com is a child of domain.com (a child domain always has the complete domain name of the parent in it), and a child domain and its parent share a two way transitive trust.
When you have a domain as a child of another, a domain tree is formed. A domain tree has to have a contiguous name space.
Notice in the second diagram the lack of contiguous names means they are not
part of the tree
The name of the tree is the root domain name, so in the example the tree would be referred to as root.com. Since the domains are DNS names and inherit the parent part of the name, if a part of the tree is renamed, then all of its children will implicitly also be renamed, for example if parent ntfaq.com of sales.ntfaq.com was renamed to backoffice.com the child would be renamed to sales.backoffice.com. This is not actually currently possible though.
Domain trees can currently only be created during the server to Domain Controller promotion process with DCPROMO.EXE, this may change in the future.
There are a number of advantages in placing domains in a tree. The first and most useful is that all members of a tree have kerberos transitive trusts with its parent and all its children. These transitive trusts also mean that any user or group in a domain tree can be granted access to any object in the entire tree. This also means that a single network logon can be used at any workstation in the domain tree.
A. You may have a number of separate domain trees in your organization that you would like to share resources and this can be accomplished by joining trees to form a forest.
A forest is a collection of trees that do not have to form a contiguous name space (however each tree still has to be contiguous). This may be useful if your company has multiple root dns addresses.

As can be seen from the example, the two root domains are joined via a transitive, two-way Kerberos trusts as in the trust created between a child and its parent. Forests always contain the entire domain tree of each domain and it is not possible to create a forest containing only parts of a domain tree.
Forests are created during the server to Domain Controller promotion process with DCPROMO and can currently not be created at any other time, this will change in the next version.
You are not limited to only 2 domain trees in a forest, you can add as many trees as you want and all domains within the forest will be able to grant access to objects for any user within the forest. Again this cuts back on having to manually manage the trust relationships. The effect of creating a forest is the following:
You may of course choose not to join trees to become a forest and may instead create normal trusts between individual elements of the tree's.
A. Windows NT 4.0 trust relationships are not transitive so if domain2 trusts domain1, and domain3 trusts domain2, domain3 does not trust domain1.

This is not the case with the trust relationships used to connect members of a tree/forest in Windows 2000, trust relationships used in a tree are two-way, transitive Kerberos trusts which means any domain in a tree implicitly trusts every other domain in the tree/forest. This removes the need for time-consuming administration of the trusts as they are created automatically when a domain joins a tree.
Kerberos is the primary security protocol for Windows NT. Kerberos verifies both the identity of the user and the integrity of the session data. The Kerberos services are installed on each domain controller, and a Kerberos client is installed on each Windows NT workstation and server. A user's initial Kerberos authentication provides the user a single logon to enterprise resources. Kerberos is not a Microsoft protocol and is based on version 5.0 of Kerberos. For more information see IETF RFCs (Requests For Comments) 1510 and 1964. These documents are available on the web from http://www.isi.edu/rfc-editor/rfc.html.
Q. How do I create a new Active Directory Site?
A. Active Directory has the concept of sites which can be used to group servers into containers which mirror the physical topology of your network, and allow you to configure replication between domain controllers (among other things). A number of TCP/IP subnets can also be mapped to sites which the allow new servers to automatically join the correct site depending on their IP address and for clients to easily find a domain controller closest to them.
When you create the first domain controller a default site, Default-First-Site-Name is created to which the domain controller is assigned. Subsequent domain controllers are also added to this site however they can then be moved. This site can be renamed if you wish.
Sites are administered and created using the "Active Directory Sites and Services Manager" MMC snap-in. To create a new site perform the following:
Now the site is created you can assign various IP subnets to it as follows:


You now have a subnet linked to a site. You can assign multiple subnets to a site if you wish.
If you are confused about the bits masked in the subnet name it can be between 22 and 32 and is just the number of bits set in the subnet mask. The subnet mask is made up of 4 sets of 8 bits. To convert the subnet mask to bits you can use the illustration below.

Therefore the subnet mask 255.255.255.0 would be 11111111.11111111.11111111.00000000 in binary which therefore uses 8+8+8 bits (24) to define the subnet mask. A subnet mask of 255.255.252.0 would be 11111111.11111111.11111100.00000000 which is 8+8+6 or 22.
Once you have multiple sites defined new domain controllers created via DCPROMO will automatically join the site that matches their IP address. In the event of their not being a site for their IP subnet they will join the same site that authorized its promotion.
Q. How do I move a server to a different site?
A. If your sites and subnets are configured then new servers will automatically get added to the site that owns the subnet however you can also manually move a server to a different site:

The move will take immediate effect.
Q. How can a server belong to more than one site?
A. By default a server will belong to one site however you may want to configure a server to belong to multiple sites.
Bear in mind sites are used for replication, for clients to find resources and to cut down on traffic on inter-site connections so just modifying the site membership may cause performance problems.
To configure a server to have multiple site membership perform the following:
The above does not create the objects in the Active Directory to evaluate the sites and these need to be added manually.
Q. How can I backup the Active Directory/System State?
A. The Active Directory is backed up using the NTBACKUP.EXE utility. The Active Directory is part of the machines System State which is defined as follows:
For all Windows 2000 machines the System State includes the registry, class registration database and the system boot files. For a Windows 2000 Server that is a certificate server it also contains the Certificate Services database. Finally for a Windows 2000 machine that is a domain controller it includes the Active Directory and the SYSVOL directory also.
To backup the System State using the Backup Wizard perform the following:
If you don't want to use the wizard it can be manually backed up as follows:

To backup only the System State from the command line use the command
C:\> ntbackup backup systemstate /f d:\active.bkf
Of course this is the most basic backup to file and you can use more complex options.
Q. How can I restore the Active Directory?
A. The Active Directory cannot be restored to a domain controller while the Directory Service is running so to restore perform the following:
The computer will boot into a special safe mode and will not start the Directory Service. Be warned that during this time the machine will not act as a domain controller and will perform not perform authentication etc.
Once you have restored the backup reboot the computer and start in normal mode to start using the restored information. You may find a hang after the restore has completed and I found a 30 minute wait on some machines.
Q. What are the FSMO roles in Windows 2000?
A. In Windows 2000 all domain controllers are equal and through a process known as multi-master replication changes are replicated to all domain controllers in the domain. However in keeping with George Orwell's Animal Farm some Domain Controllers are more equal than others.
Multi-master replication resolves conflicts however in some situations it is better to stop the conflict before it happens and to this end there are five difference Flexible Single Master of Operations (FSMO) roles (formally known as Floating Single Master of Operations as the roles were originally going to be dynamically changeable) each managing an aspect of the domain/forest. These roles can be moved between domain controllers but not dynamically, they must be manually moved in the same manner as a BDC has to be manually promoted to a PDC.
There are two types of roles, some are per domain, some are per forest. Only a domain controller in the domain can hold a domain specific FSMO role, any domain controller in the forest can hold a forest FSMO role. Domain controllers cannot hold FSMO roles in other domains/forests.
These roles are assigned in different GUI ways or using the NTDSUTIL utility.
The five roles are defined below:
| Role name | Description | Per domain/forest |
| Schema master | At the heart of the Active Directory is the schema which is like the blueprint of all objects/containers. Since the schema has to be the same throughout the entire forest only one machine can authorize modifications to the schema. | One per forest |
| Domain naming master | To add a domain to the forest its name has to be verifiably unique and so the Domain naming master FSMO's of the forest is contacted to authorize the domain name operation. | One per forest |
| RID master | Any domain controller can create new objects
(such as a user, group, computer account) however after creating 512 user
objects the domain controller must contact the domains RID master for another
512 RID's (it actually contacts when it has less than 100 RID's left, this
means the RID master can be unavailable for short periods of time without
causing object creation problems). This is to ensure each object has a unique
RID. When a DC creates a security principal object it attaches a unique SID to the object. The SID is created using the domain SID and a relative ID (the RID). The RID master has to be available when attempting to move objects between domains with the resource kit movetree utility. |
One per domain |
| PDC emulator | For backwards compatibility reasons one domain controller in each 2000 domain must emulate a PDC for the benefit of 4.0 and 3.5 domain controllers and clients. | One per domain |
| Infrastructure master | When a user and group are in different domains there can be a lag between changes to the user (e.g. name) and its display in the group. The infrastructure master of the groups domain is responsible for fixing up the group-to-user reference to reflect the rename. The infrastructure master performs is fixups locally and relies upon replication to bring all other replicas of the domain up to date. | One per domain |
The PDC emulator also has some special roles even in native mode:
Q. How can I change the RID master FSMO?
A. The RID master is defined here.
To modify the role perform the following:


This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold
C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer rid master
Click Yes to the role transfer dialog
Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com
fsmo maintenance: quit
ntdsutil: quit
Q. How can I change the PDC emulator FSMO?
A. The PDC emulator is defined here.
To modify the role perform the following:


This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold
C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer pdc
Click Yes to the role transfer dialog
Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com
fsmo maintenance: quit
ntdsutil: quit
Q. How can I change the Infrastructure master FSMO?
A. The Infrastructure master is defined here.
To modify the role perform the following:


This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold
C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer infrastructure master
Click Yes to the role transfer dialog
Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com
fsmo maintenance: quit
ntdsutil: quit
Q. How can I change the Domain naming master FSMO?
A. The Domain naming master is defined here.
To modify the role perform the following however make sure the machine is a global catalog:


This can also be accomplished using the NTDSUTIL.EXE utility. Enter the commands it bold
C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer domain naming master
Click Yes to the role transfer dialog
Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com
fsmo maintenance: quit
ntdsutil: quit
Q. How can I change the Schema master FSMO?
A. The Schema master is defined here.
To modify the role perform you must use the 'Active Directory Schema Manager' and you must first register the .dll for the MMC snap-in
C:\> regsvr32 schmmgmt.dll
You can now start the Schema Manager via the Resource Kit Tools console or by creating a custom MMC and add the Active Directory Schema snap-in to it (Start - Run - MMC - Console menu - Add/Remove Snap-in - Add - Active Directory Schema - Add - Close - OK)


To modify the role from the command line enter the commands in bold
C:\> ntdsutil
ntdsutil: roles
fsmo maintenance: connections
server connections: connect to server <server name>
server connections: quit
fsmo maintenance: transfer schema master
Click Yes to the role transfer dialog
Server "titanic" knows about 5 roles Schema - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS
Settings,CN=TITANIC,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=savilltech,DC=com
fsmo maintenance: quit
ntdsutil: quit
Q. What is Multi-master replication?
A. In a Windows 2000 domain, all domain controllers are equal which means changes can be made on ANY domain controller and each servers complete domain directory has to be kept up-to-date with each other through a process of multi-master replication.
Each time a change is made to the Active Directory the servers Update Sequence Number, or USN, where the change is implemented is incremented by one and this USN is also stored along with the change to the property of the object modified. These changes have to be replicated to all domain controllers in the domain and the Update Sequence Number provides the key to the multi-master replication.
Update Sequence Number increments are atomic in operation which means that the increment to the USN and the actual change occurs simultaneously, if one part fails the whole change fails which means its not possible for a change to be made without the USN to be incremented, which means changes will never be "lost". Each domain controller keeps track of the highest USN's of the other domain controllers that it replicates with so it can calculate which changes it needs to be replicated on each replication cycle.
At the start of the replication cycle each server checks its Update Sequence Number table and then queries the domain controllers it replicates with for their latest USN's. For example the table below represents the USN table for server A
| DC B | DC C | DC D |
| 54 | 23 | 53 |
Server A then queries the domain controllers for their current USN's and gets the following:
| DC B | DC C | DC D |
| 58 | 23 | 64 |
From this server A can calculate the changes it needs from each server:
| DC B | DC C | DC D |
| 55,56,57,58 | Up-to-date | 54-64 |
It would then query each server for the changes needed.
It is possible for multiple changes to the same property of an object to occur, and collisions are detected via a Property Version Number (PVN) which every property has. These work like the USN's and each time a property is modified, the PVN is incremented by one.
In the event of a modification to the same property of the same object then the change with the highest PVN takes precedence, and if the PVN's are the same for a property update then a collision has occurred. If the PVN's match then the time stamp is used to resolve any conflicts. Each change is time stamped and this highlights the need for the domain controllers time to be accurate with one-an-other. In the highly unlikely event that the PVN's match AND the time stamp is the same then a binary buffer comparison is carried out with the larger buffer size change taking precedence. Property Version Numbers are only incremented on original writes and not on replication writes (unlike USN's) and are not server specific but rather travels with the property.
A propagation-dampening scheme is also use to stop changes being repeatedly sent to other servers which already have the change and to this end each server keeps a table of up-to-date vectors which are the highest originating writes that are received from each controller and take the form of:
<the change>,<domain controller making the original change>,<USN of the change>
For example
<object savillj, property Password xxx>,Titanic,54
Domain controllers then also send this information with the USN's so they can calculate if they already have the change the other domain controllers are trying to replicate.
Q. How can I move objects within my Forest?
A. The Windows 2000 Resource Kit ships with the MOVETREE.EXE utility which can be used to move organization units, users or computers between domains in a single forest. This is useful for the consolidation of domains or to reflect organization restructuring.
Certain objects cannot be moved with MOVETREE such as Local and Domain Global groups and if the container they are in is moved these objects will be placed in an "orphan" container in the "LostAndFound" container in the source domain.
Associated data is not moved with MOVETREE such as policies, profiles, logon scripts and personal data. To accomplish the movement of these items you should write custom scripts using the 'Remote Administration Scripts'.
The syntax of MOVETREE is
MoveTree [/start | /continue | /check] [/s SrcDSA] [/d Dst] [/sdn SrcDN] [/ddn DstDN] [/u Domain\Username] [/p Password] [/quiet]
| /start | Start a move tree operation with /check option by default. Instead, you could be able to use /startnocheck to start a move tree operation without any check. |
| /continue | Continue a failed move tree operation. |
| /check | Check the whole tree before actually move any object. |
| /s <SrcDSA> | Source server's fully qualified primary DNS name. Required |
| /d <DstDSA> | Destination server's fully qualified primary DNS name. Required |
| /sdn <SrcDN> | Source sub-tree's root DN. Required in Start and Check case. Optional in Continue case |
| /ddn <DstDN> | Destination sub-tree's root DN. RDN plus Destinaton Parent DN. Required |
| /u <Domain\UserName> | Domain Name and User Account Name. Optional |
| /p <Password> | Password. Optional |
| /quiet | Quiet Mode. Without Any Screen Output. Optional |
You should first run in /check mode as this will perform a test without actually performing the move. Any errors will be displayed and also written to the file movetree.err in your current directory. If the test is OK run with the /start option.
An example use would be
C:\> movetree /check /s titanic.market.savilltech.com /d pluto.legal.savilltech.com /sdn OU=testing,DC=Market,DC=Savilltech,DC=COM /ddn OU=test2,DC=Legal,DC=Savilltech,DC=COM
This would move the OU testing from domain market.savilltech.com to test2 in domain legal.savilltech.com.
Q. How do I allow modifications to the Schema?
A. The Schema is extensible which means it can be changed but modifying the Schema is a dangerous task as it will affect the entire domain Forest (since a forest shares a common schema) and someone at Microsoft once said the following:
"If you find you have to change the schema find another way. If you still have to, look again. If after all that you find you still need to change the schema you better make sure your managers are fully aware of the implications"
That being said to allow modifications there are two ways.
If you want to use the GUI first register the .dll for the MMC snap-in (if you haven't all ready)
C:\> regsvr32 schmmgmt.dll
You can now start the Schema Manager via the Resource Kit Tools console or by creating a custom MMC and add the Active Directory Schema snap-in to it (Start - Run - MMC - Console menu - Add/Remove Snap-in - Add - Active Directory Schema - Add - Close - OK)

This can also be accomplished by directly editing the registry
Other related FAQ items:
Q. What are Tombstone objects?
A. Because of the complex replication available in Windows 2000 and the Active Directory just deleting an object would result in it potentially being recreated at the next replication interval and so deleted objects are 'Tombstoned' instead. This basically marks them as deleted and applies to all objects.
Objects marked as tombstoned are actually deleted 60 days after their original tombstone status setting, however this time can be changed by modifying tombstonelifetime under cd=DirectoryServices,cn=WindowsNT,cn=Services,cn=Configuration,dc=DomainName however it is not advised.
Q. How do I switch my 2000 domain to native mode?
A. Windows 2000 domains have two modes, mixed and native. Mixed mode domains allow Windows NT 4.0 Backup Domain Controllers to participate in a Windows 2000 domain.
In native mode only 2000 based domain controllers can participate in the domain and 4.0 based Backup Domain Controllers will no longer be able to act as domain controllers. Also the switch to native mode allows use of the new "Universal" groups which unlike global groups can be nested inside each other. Older NetBIOS based clients will still be able to logon using the NetBIOS domain name even in native mode.
To perform the switch perform the following:


You will need to check all other domain controllers in the domain and when the domain operation mode says "Native Mode" (instead of mixed mode) reboot them. This can take 15 minutes (or more if contact is not able to be made).
If a domain controller cannot be contacted (if on a remote site and only connects periodically) when you make the change the remote DC will switch mode the next time replication occurs.
Q. How can I force replication between two domain controllers in a site?
A. In Windows NT 4.0 replication between domain controllers could be forced using Server Manager. Replication can also be forced with Windows 2000 domain controllers as follows.

This would replicate from TITANIC to the VENUS domain controller
The replication is one way and if you want two way replication you will need to replicate in each direction.
Q. How can I change replication schedule between two domain controllers in a site?
A. By default domain controllers will replicate once an hour the schema/configuration information (see 'Q. How does replication work intra-site in Windows 2000?' for information on the type of replicated data) but this can be changed as follows. This is only for domain controllers in a single site, cross site replication is configured differently.

This replication schedule is one way and would to be repeated for the other direction. Remember this is the minimum replication. Any changes made will cause a notification to be made after 5 minutes causing replication.
Q. Can I rename a site? - Windows 2000
A. Basically yes. When you install your first domain controller it creates a default site of Default-First-Site-Name which is not very helpful and can be changed as follows:

That's it!
Q. What DNS entries are added when a Windows 2000 domain is created?
A. Windows 2000 domains rely heavily on DNS entries however the entries are created automatically providing you have enable dynamic update on the relevant DNS zones. Below are explanations of what the entries are used for:
_ldap._tcp.<DNSDomainName>
Allows a client to localte a Windows 2000 domain controller in the domain named
by <DNSDomainName>. A client searching for a DC in domain savilltech.com
would query the DNS server for _ldap._tcp.savilltech.com
_ldap._tcp.<SiteName>._sites.<DNSDomainName>
This allows a client to find a Windows 2000 domain controller in the Domain and
site specified, e.g. _ldap._tcp.london._sites.savilltech.com for a DC in the
London site of savilltech.com
_ldap._tcp.pdc._ms-dcs.<DNSDomainName>
Allows a client to find the Primary Domain Controller (PDC) FSMO role holder of
a mixed-mode domain. Only the PDC of the domain registers this record.
_ldap._tcp.gc._msdcs.<DNSTreeName>
Allows a client to find a Global Catalog (GC) server. Only domain controllers
serving as GC servers for the tree will register this name. Should a server
cease to be a GC it will deregister the record.
_ldap._tcp.<site>._sites.gc._msdcs.<DNSTreeName>
Allows a client to find a Global Catalog (GC) server in the specified site, e.g.
_ldap._tcp.london._sites.gc._msdcs.savilltech.com.
_ldap._tcp.<DomainGuid>.domains._msdcs.<DNSTreeName>
Allows a client to find a domain controller in a domain based on its Globally
Unique IDentifier (GUID). A GUID is a 128-bit (8 byte) number this is generated
automatically for referencing objects in the Active Directory.
<DNSDomainName>
Allows clients to find a Domain Controller by a normal Host record.

Example DNS screen for a domain
Q. How can I manually defragment the Active Directory? - Windows 2000 only
A. By default Windows 2000 servers running directory services will perform a directory online defragmentation every 12 hours (by default) as part of the garbage collection process. This defragmentation only moves data around the database file (NTDS.DIT) and does not reduce its size.
To create a new, smaller NTDS.DIT and offline defragmentation must be performed as follows:
Below is an example of the entire procedure
Microsoft Windows 2000 [Version 5.00.2031]
(C) Copyright 1985-1999 Microsoft Corp.
D:\>ntdsutil
ntdsutil: files
file maintenance: info
Drive Information:
C:\ FAT (Fixed Drive ) free(1.2 Gb) total(1.9 Gb)
D:\ NTFS (Fixed Drive ) free(152.4 Mb) total(1.9 Gb)
DS Path Information:
Database : D:\WINNT\NTDS\ntds.dit - 8.1 Mb
Backup dir : D:\WINNT\NTDS\dsadata.bak
Working dir: D:\WINNT\NTDS
Log dir : D:\WINNT\NTDS - 30.0 Mb total
res2.log - 10.0 Mb
res1.log - 10.0 Mb
edb.log - 10.0 Mb
file maintenance: compact to c:\temp
Opening database [Current].
Using Temporary Path: C:\
Executing Command: D:\WINNT\system32\esentutl.exe /d "D:\WINNT\NTDS\ntds.dit" /
/o /l"D:\WINNT\NTDS" /s"D:\WINNT\NTDS" /t"c:\temp\ntds.dit" /!10240 /p
Initiating DEFRAGMENTATION mode...
Database: D:\WINNT\NTDS\ntds.dit
Log files: D:\WINNT\NTDS
System files: D:\WINNT\NTDS
Temp. Database: c:\temp\ntds.dit
Defragmentation Status ( % complete )
0 10 20 30 40 50 60 70 80 90 100
|----|----|----|----|----|----|----|----|----|----|
...................................................
Note:
It is recommended that you immediately perform a full backup
of this database. If you restore a backup made before the
defragmentation, the database will be rolled back to the state
it was in at the time of that backup.
Operation completed successfully in 17.896 seconds.
Spawned Process Exit code 0x0(0)
If compaction was successful you either need to
copy "c:\temp\ntds.dit" to "D:\WINNT\NTDS\ntds.dit"
or run:
D:\WINNT\system32\ntdsutil.exe files "set path DB \"c:\temp\"" quit quit
file maintenance: quit
ntdsutil: quit
D:\>copy c:\temp\ntds.dit %systemroot%\ntds\ntds.dit
Overwrite D:\WINNT\ntds\ntds.dit? (Yes/No/All): y
1 file(s) copied.
Q. How can I audit the Active Directory?
A. It is possible to configure auditing on the Active Directory to produce both successful and failed entries in the Directory Service event log.
To configure perform the following:

The logs can be viewed in the Security Log (using Event Viewer). The policy change may take a while to take effect as domain controllers poll for policy changes every five minutes. Other domain controllers in the enterprise receive the changes at this interval plus the time of replication.
Q. How can I automate a server upgrade to a Domain Controller during installation?
A. Its possible to run the DCPROMO.EXE utility automatically during an unattended installation using the following method:
The Dcpromo process can be scripted by using the dcpromo /answer:%path_to_answer_file% command. In the following example, the [DCInstall] section and parameters are added directly to the unattended answer file. The parameters for the DCInstall section are detailed in the Unattend.doc supplied with the resource kit but below are the main entries:
| AdministratorPassword | The new password for the domain Administrator account |
| AutoConfigDNS | Indicates if the wizard should configure DNS |
| ChildName | Name of the child part of domain |
| CreateOrJoin | Specifies if the domain will join an existing forest or create a new one |
| DatabasePath | Location for the Active Directory database |
| DNSOnNetwork | Used when a new forest of domains is being installed and no DNS client is configured on the computer |
| DomainNetBiosName | NetBIOS name for the domain |
| IsLastDCInDomain | Only valid when demoting an existing domain controller to a member server |
| LogPath | Path for the DS logs |
| NewDomainDNSName | Name of the new tree or when a new forest is being created |
| ParentDomainDNSName | Specifies name of parent domain |
| Password | Password for username being used to promote server |
| RebootOnSuccess | Whether an automatic reboot should be performed |
| ReplicaDomainDNSName | Name of the domain to be replicated from |
| ReplicaOrMember | Specifies if a 3.51 or 4.0 BDC being upgraded should become a replica domain controller or be demoted to a regular member server. |
| ReplicaOrNewDomain | Specifies if this is a new DC in a new domain or if its a replica of existing domain |
| SiteName | Name of the site, by default this is "Default-First-Site" |
| SysVolPath | Path of SYSVOL |
| TreeOrChild | If this is a new tree of child of existing domain |
| UserDomain | Domain for the user being used in promotion |
| UserName | Name of user performing the upgrade |
Because this process occurs after setup, the answer file created is named $winnt$.inf and is copied to the \system32 folder. Because the parameters are in this file, you must add the following text to the [GUIRunOnce] section of the unattended Setup answer file:
[GUIRunOnce] "DCpromo /answer:%systemroot%\system32\$winnt$.inf"
[GUIUnattended] Autologon = yes ; automatically logs on the administrator account AutoLogoncount = n ; number of times to perform auto-admin logon
Easy :-) Don't use items like %systemroot% or %windir% etc as they are not understood during unattended installations.
You can just create a [DCInstall] section directly in your unattend.txt file and to avoid having multiple unattended setup files.
[DCInstall]
AdministratorPassword = cartman
CreateOrJoin = Create
DomainNetBiosName = savtech
NewDomainDNSName = savtech.com
RebootOnSuccess = Yes
ReplicaOrNewDomain = Domain
SiteName = "London"
TreeOrChild = Tree
The script above would create a new forest with domain savtech.com at the top with the created domain controller in site London. Default locations for the SYSVOL, logs and Active Directory files will be used. The new domain Administrator account password would be cartman (Southpark rules!).
You can of course use this outside of an unattended installation if you wish after you've installed by just typing:
DCPROMO /answer:<DCInstall answer filename>
A small dialog saying DCPROMO is running in unattended mode will be displayed and then it will reboot.
Q. How do I enable circular logging for the Active Directory?
A. Active Directory can record either sequential or circular logs, although sequential is the default and is preferred. Circular logs overwrite transactions at specific intervals, whereas sequential logs are never overwritten (but data in sequential log files whose transactions have been committed to the database are deleted during garbage collection intervals.)
Sequential log files are not overwritten with new data. They grow until they reach a specified size. Once all the transactions in a log file are committed to the database, this log file is no longer needed. Active Directory’s garbage collection process deletes unnecessary log files every 12 hours (the default garbage collection interval). If your server never stays up longer than 12 hours between reboots, the old log files are never cleaned up and they take up more and more space on the disk (but you have bigger problems :-) ).
Some administrators prefer circular logging because it helps minimize the amount of logged data stored to the physical disk. Imagine circular logs as a donut with new data overwriting the oldest as needed. You must edit the registry to enable circular logging.
Q. I can't add a 4.0 BDC to my Windows 2000.
A. A 4.0 BDC in a Windows 2000 is a supported configuration however a problem exists when the 4.0 BDC machine account tries to be created.
The Machine Account for This Computer either does not exist or is inaccessible.If you attempt to add the computer account from an already installed Windows NT 4.0-based BDC using the Srvmgr tool, the following message occurs:
The Network Request is not supported.The following error message is logged on the Windows 2000-based PDC:
Source: SAM
EVENT ID: 12298
DESCRIPTION:The Account "COMPUTER$" Cannot be converted to be a domain
controller account as its object class attribute in the directory is not a
computer or is not derived from computer. If this is caused by an attempt to
install a pre Windows 2000 Domain, then you should recreate the account for the
domain controller with the correct object class.
To workaround this problem use the SRVMGR tool that is shipped with Windows 2000 to create the account.
Q. I can't have spaces in my Windows 2000 NetBIOS domain name, why?
A. In a Windows NT 4.0 based domain a space is a legal character in the NetBIOS domain name. Windows 2000 domains are DNS based are therefore DNS names however a NetBIOS name is also given for backwards compatibility. DNS does not allow a space in a name and so to keep consistency Microsoft have now removed the space as a legal character in a 2000 NetBIOS domain name.
It can contain the following special characters:
! @ # $ % ^ & ( ) - _ ' { } . ~
The Following characters are not allowed:
\ * + = | : ; " ? < > ,
Q. How can I create trusts from the command line in Windows 2000.
A. Windows 2000 Resource Kit ships with TRUSTDOM.EXE which enables trust relationships to be defined between Windows 2000 domains and one way relationships with 4.0 domains.
The trustdom syntax is:C:\> trustdom [[domain[:dc],]target_domain[:dc]] [Options]The default switch is "-out." There are two methods a one-way trust is created:
There are a number of other switches which can be listed with the /? switch.
See Knowledge Base article Q232050 (http://support.microsoft.com/support/kb/articles/Q232/0/50.ASP) for more information and examples.
Q. How can I modify the number of objects searched in Windows 2000?
A. By default Active Directory searches are limited to 10,000 objects in a search however this can be changed as your organization grows. This policy affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users & Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. To change use either of the following two methods:
To set for a group policy object:

To set directly for a user via the registry:
The change for both methods will take effect at next logon for the user.
Q. I can't create an OU/child domain with the same name from a single parent, why?
A. While X.500 does all both an OU and child domain to share a common name this is not possible with Active Directory as it would cause problems with the relative distinguished name. If you attempt to create an OU where a child domain already exists with the same name you will get error:
Active Directory
Windows cannot create the object because: An attempt was made to add an object
to the directory with a name that was already in use.
Name-related properties on this object might now be out of sync.
Contact your network administrator.
If you try and create the child domain and an OU already exists with the same name the error below will be displayed:
Active Directory Installation Failed
The operation failed because: The Directory Service failed to create the object
CN=Sales, CN=Partitions, CN=Configuration, DC=Savilltech, DC=Com. Please check
for possible system errors. "The directory service is busy"
There is no workaround to this and is a known restriction.
Q. How are objects named in the Active Directory?
A. There are a number of methods available to name objects in the Active Directory, the most popular of which is the Distinguished Name or DN. An excellent RFC exists for DN explanation at http://www.cis.ohio-state.edu/htbin/rfc/rfc1779.html but I'll run over the basics here.
Every object in the Active Directory has a distinguished name and it uniquely identifies the object in the directory service, for example:
/O=Internet/DC=COM/DC=SavillTech/CN=Users/CN=John Savill
This breaks down as follows:
You could also see OU for Organizational Unit.
A Relative Distinguished Name (RDN) is also used which is also known as the friendly name, for example the RDN of the above for John Savill would be CN=John Savill, the RDN for the users container would be CN=Users.
Also supported are LDAP URL names which begin with LDAP:\\, a LDAP server then a DN (of sorts) identifying the object, e.g.
LDAP://titanic.savilltech.com/cn=JSavill,ou=Sales,dc=SavillTech,dc=com
Finally are LDAP Canonical names which are the LDAP name without the ou=,cn= etc which are used by many of the admin tools, for example:
savilltech.com/Sales/JSavill
Of course in actual fact objects are stored using a GUID (Globally Unique IDentifier) which as a 128 but number generated at object creation time and is stored in object attribute objectGUID and can NEVER change but lets not worry about that :-)
Finally we have the User Principal Name and SAM account name. The UPN is of the format <user>@<DNS domain name>, e.g.
The SAM name is the old 4.0 format and must be unique throughout the entire organization due to its single layer convention, e.g. savillj.
Q. How does replication work intra-site in Windows 2000?
A. Windows 2000 includes a component called the Knowledge Consistency Checker (KCC) which automatically manages the replication within a site.
A bi-directional ring topology is used intra-site using RPC (Remote Procedure Call) over TCP/IP without any kind of compression. This is because domain controllers within a site are thought to be on a fast network (as per the definition of a site) and the extra processing required to compress/uncompress is undesirable.
The KCC runs every 15 minutes adjusting the topology as needed and as new domain controllers are created they are automatically placed in the ring. You can view these links using the Active Directory Sites and Services MMC snap-in by expanding the site, expand the Servers container, expand the server and under the ‘NTDS Settings’ leaf are the created connection objects.
The rings are ordered by the domain controller's GUID (Globally Unique IDentifier) as a means to ensure convergence on a single topology as the KCC runs on all domain controllers.
There is an exception to the ring rule. There can never be more than 3 hops between any two domain controllers within the ring and so of there are 7 or more domain controllers extra links are added to protect the 3 hop rule.

Notice in the above two extra non-ring links have been added to enable no more than 3 hops to any domain controller.
These rings are for same naming context (domains) in a single site. If you had multiple domains in a site there would be rings for each domain within the site.
There is a second type of ring however which replicates schema and configuration information between the domain controllers and as this information is shared between all domains (its forest wide) there is only one ring for each site. This means if you had two domains in a site you would have 3 rings, one each for the two domains and one for the schema/configuration information. If you only have a single domain in a site the two rings are actually one and the same.

Any manual configuration of intra-site replication should not be needed and is not recommended by Microsoft. The only task you may ever find yourself performing is to add extra connection objects to reduce the hop count between domain controllers.
When a change is made to the naming context (domain) data the domain controller waits a configurable interval that is 5 minutes by default. The change is written to the domain controller’s local copy of the Active Directory, a timer is started that determines when the domain controller's replication partners should be notified of the change (the 5 minutes). When this interval elapses, the domain controller initiates a notification to each intra-site replication partner that it has changes that need to be propagated. In this 5 minutes changes can continue to be made to the local Active Directory enabling all changes to be grouped and sent after the 5 minutes.
If no changes are reported for a configurable period (as defined in the intra-site connection object schedule) a replication sequence will be initiated to ensure no changes have been missed.
There is a concept of urgent replication that can be triggered by the SAM or the LSA (Local Security Authority) and is initiated for the following events:
Any of the above causes a notification to be sent within the site triggering immediate replication. As this uses notification this is only intra-site however you can modify site links to enable notification, as normally they will only replicated as per the schedule.
An exception to the multi-master normal replication is user passwords. As with any other attribute change the password can be changed at any domain controller however the change is then pushed to the PDC FSMO role holder on a best attempt basis. Any other domain controllers receive the password through normal replication.
The reason for this extra password work is that in the event of password validation failing the domain controller validating will pass the request to the PDC FSMO in case the password has been changed and it has now yet received via standard replication.
The schema/configuration data is replicated once an hour by default between domain controllers but can be changed as seen in 'Q. How can I change replication schedule between two domain controllers in a site?'.
Q. How can I change the intra-site replication interval in Windows 2000 for domain information?
A. As we saw in 'Q. How does replication work intra-site in Windows 2000?' replication for naming context data is replicated intra-site 5 minutes after the change is made to allow any further changes to be grouped and sent together. This 5 minute pause can be changed via the registry:
You will also notice another parameter, ‘Replicator notify pause between DSAs (secs)’ under the same registry key which determines the number of seconds to pause between notification of the Directory Service Agents. This parameter prevents simultaneous replies by the replication partners.
Q. How can I set the RPC port used for Intra-site replication?
A. By default the port used for the RPC replication is dynamically set as a secure measure. It may be desirable to set the port however (for the purposes of monitoring data etc.) and this can be enabled by performing the following registry change:
After monitoring is complete be sure to remove this entry to regain the security of dynamic RPC port allocation.
Q. What tools are available to monitor/change replication?
A. The first tool you use is the Sites and Services MMC snap-in which enable the viewing/creation/deletion of connection objects however there are other tools available.
The Windows 2000 resource kit provides REPLMON.EXE and REPADMIN.EXE which are very useful.
Repadmin.exe is a command line tool which enables replication consistency to be checked, for a KCC recalculation etc. A good switch is /showreps which displays a list of replication partners. The invocation ID is the database GUID and will also show reason for problems.
D:\>repadmin /showreps
London\TITANIC
DSA Options : IS_GC
objectGuid : 221d9d34-540e-4a7b-bd26-054c11e2d1ad
invocationID: 221d9d34-540e-4a7b-bd26-054c11e2d1ad
==== INBOUND NEIGHBORS ======================================
CN=Schema,CN=Configuration,DC=savilltech,DC=com
London\TITUS via RPC
objectGuid: 2000eb93-cc24-4af7-9ad2-c52129c98c7a
Last attempt @ 1999-12-06 20:32.20 failed, result 8524:
Can't retrieve message string 8524 (0x214c), error 1815.
Last success @ 1999-09-17 20:53.45.
463 consecutive failure(s).
London\TRINITY via RPC
objectGuid: df3694d2-b4e9-4d9a-a560-3e8c26c48a89
Last attempt @ 1999-12-06 20:32.21 failed, result 8524:
Another neat option is /showmeta which will have all object information, version numbers etc.
C:\>repadmin /showmeta cn=garfield,DC=savtech,DC=com
45 entries.
Loc.USN Originating DSA Org.USN Org.Time/Date Ver At
tribute
======= =============== ======= ============= === ==
=======
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 ob
jectClass
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 cn
99650 London\MORPHEUS 99650 1999-12-08 09:50.10 1 de
scription
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 gi
venName
99649 London\MORPHEUS 99649 1999-12-08 09:50.10 1 in
stanceType
Replmon.exe is a GUI tool used to display and monitor replication status on selected domain controllers.
Q. How do I remove a non-existent domain controller?
A. Windows 2000 tracks each domain controller in the metadata and if you just throw away a domain controller either by reinstallation or removal of the hardware without running DCPROMO to clean up its metadata its information will not be cleaned up and connection objects will not be removed.
You can remove a server from the metadata using the NTDSUTIL as follows (enter the commands in bold):
D:\>ntdsutil
ntdsutil: metadata cleanup
metadata cleanup: select operation target
The first step is to connect to a server. Here we do it by selecting a domain:
select operation target: connections
server connections: connect to domain savilltech.com
Binding to \\TITANIC.savilltech.com ...
Connected to \\TITANIC.savilltech.com using credentials of locally logged on user
server connections: quit
Next we have to select a site, then a server (the server we want to delete) then finally the domain the server is in (the order is not important)
select operation target: list sites
Found 2 site(s)
0 - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
1 - CN=Kent,CN=Sites,CN=Configuration,DC=savilltech,DC=com
select operation target: select site 0
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
No current domain
No current server
No current Naming Context
select operation target: list servers in site
Found 4 server(s)
0 - CN=TITANIC,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=c
om
1 - CN=TITUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
2 - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=
com
3 - CN=TRINITY,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=c
om
select operation target: select server 2
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
No current domain
Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltec
h,DC=com
DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,
CN=Configuration,DC=savilltech,DC=com
DNS host name - MORPHEUS.deleteme.savilltech.com
Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savil
ltech,DC=com
No current Naming Context
select operation target: list domains
Found 3 domain(s)
0 - DC=savilltech,DC=com
1 - DC=dev,DC=savilltech,DC=com
2 - DC=deleteme,DC=savilltech,DC=com
select operation target: select domain 0
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
Domain - DC=savilltech,DC=com
Server - CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltec
h,DC=com
DSA object - CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,
CN=Configuration,DC=savilltech,DC=com
DNS host name - MORPHEUS.deleteme.savilltech.com
Computer object - CN=MORPHEUS,OU=Domain Controllers,DC=deleteme,DC=savil
ltech,DC=com
No current Naming Context
select operation target: quit
The server we selected above will now be deleted.
metadata cleanup: remove selected server
Now click yes to the confirmation

"CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
" removed from server "\\TITANIC.savilltech.com"
metadata cleanup: quit
ntdsutil: quit
Disconnecting from \\TITANIC.savilltech.com ...
You should then delete the server from the Sites and Servers MMC snap-in (Start - Programs - Administrative Tools - Active Directory Sites and Services)
Expand the Sites branch, select the site, expand the Services container, right click on the server and select Delete. Click Yes to the confirmation.
Q. How do I remove a non-existent domain from the Active Directory?
A. As with domain controllers, Windows 2000 tracks each domain in the metadata and if you remove all the domain controller's for a domain and never select "This is the last domain controller in the domain" when running DCPROMO to demote to a normal server its information will not be cleaned up and its domain information will remain.
You can remove a domain from the metadata using the NTDSUTIL as follows (enter the commands in bold):
D:\>ntdsutil
ntdsutil: metadata cleanup
metadata cleanup: connections
Connect to a server (or domain) that knows about the domain to be deleted (the parent domain is good)
server connections: connect to server titanic
Binding to titanic ...
Connected to titanic using credentials of locally logged on user
server connections: quit
metadata cleanup: select operation target
Now we select to the domain we are going to delete
select operation target: list domains
Found 3 domain(s)
0 - DC=savilltech,DC=com
1 - DC=dev,DC=savilltech,DC=com
2 - DC=deleteme,DC=savilltech,DC=com
select operation target: select domain 2
Site - CN=London,CN=Sites,CN=Configuration,DC=savilltech,DC=com
Domain - DC=deleteme,DC=savilltech,DC=com
No current server
No current Naming Context
select operation target: quit
metadata cleanup: remove selected domain
Click Yes to the confirmation.

"DC=deleteme,DC=savilltech,DC=com" removed from server "titanic"
metadata cleanup: quit
ntdsutil: quit
Disconnecting from titanic ...
There are no further actions, all trace of the domain will now have been removed.
Q. How does Inter-site replication work in Windows 2000?
A. Sites can be linked using RPC over IP or SMTP. Once you define the site links, schedules, cost factors and any site link bridges (if appropriate) the Knowledge Consistency Checker can then create the connection objects providing the site links are transitive in nature.
There are some restrictions on the usage of SMTP however, it can be used to replicate the global catalog information, schema and configuration data, but it cannot replicate full domain name context data such as the data exchanged between domain controllers in the same domain. This is because some domain operations require the File Replication Server (FRS) such as the global policy which SMTP does not currently support.
Inter-site replication uses a spanning tree topology and as long as a replication route can be established between all sites in the enterprise forest the replication tree is complete. The actual links between sites are created manually by the Administrator and involves defining costs with each link (the cost relates the speed and/or reliability of the network) and a schedule of when replication can occur.
Site links are created and maintained using the Sites and Services MMC snap-in and by default you will have one site link, DEFAULTIPSITELINK to which your original site will be part of and further sites can be added during their creation (sites have to be part of a site link when created).
Replication data sent inter-site is compressed to between 10-15% of its original size! This is important as inter-site links are usually over slower WAN links.
Basically you only need to create links between sites as required and the KCC will take care of creating the required connection objects. Ignorance is bliss :-)
Q. How do I create a new site link?
A. After creating sites of IP subnets they need to be linked. By default an IP site link exists called DEFAULTIPSITELINK which new sites can be added to during the creation (or select any other existing site link). To create a a new site link perform the following:

Double clicking on an existing site link will allow other sites to be add/removed. It will also enable a cost to be allocated to the site link and a schedule to be configured.
Q. How do I disable site link transitivity?
A. By default all site links are bridged together making them all transitive in nature so the KCC (Knowledge Consistency Checker) can create connection objects between any domain controllers. Its possible to disable this site link transitivity and then manually bridge selected site links giving you more control.

You now need to manually create site link bridges to enable connection objects to be created by the KCC.
Q. How do I create a site link bridge?
A. If you disabled site link transitivity you must manually bridge sites so replication can complete and the KCC can create the necessary connection objects.

Site link bridges are very important as imagine you had 3 sites, Kent, Liverpool and London and you have two site links, Liverpool-London and Kent-London. If site link transitivity is disabled then there is no way for Liverpool and Kent to talk. The site link bridge enables London to act as a router for communication between Liverpool and Kent.

Q. How do I specify a bridge head server?
A. In order to minimize bandwidth usage, communication between sites is carried out by a pair of servers (one from each site) and these bridgehead servers are dynamically chosen by the KCC (Knowledge Consistency Checker) however there may be some situations where you would prefer to nominate a specific domain controller from each site as it may have better network connectivity or act as the proxy server in a firewall environment.
These manually chosen servers are known as preferred bridgehead servers and its possible to select multiple preferred bridgehead servers for a site but only one is active at any one time. If the active preferred bridgehead servers fails then another preferred bridgehead server will become the active server. If no preferred bridgehead servers are available a normal Windows 2000 domain controller will become active for inter-site replication but this may cause problems if it lacks sufficient resources.
To nominate a server as a bridgehead server perform the following:

At the next KCC run the connection objects will be changed to use the bridgehead server specified.
A. In 'Q. How does replication work intra-site in Windows 2000?' we saw how the KCC automatically creates and maintains the connection objects for intra and inter-site replication however these can be manually maintained if you wish by disabling the KCC, this is NOT recommended!
We use LDP.EXE for this change which is part of the support tools so make sure these are installed.

Expanding base 'CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com'...
Result <0>: (null)
Matched DNs:
Getting 1 entries:
>> Dn: CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
-----------
***Call Modify...
ldap_modify_s(ld, 'CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com',[1] attrs);
Modified "CN=NTDS Site Settings,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com".
-----------To check if the has worked you can use Active Directory Replication Monitor (REPLMON.EXE) to generate a report on the site configuration. Included in this information is output similar to the following example:
Site Name: London
---------------------------------------
Site Options : NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED
Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
Site Topology Renewal :
Site Topology Failover :
To undo the change and re-enable the KCC perform the above but set the value to 0. If KCC is fully enabled the output from the report will be (notice Site Options are blank):
Site Name: London
---------------------------------------
Site Options :
Site Topology Generator: CN=NTDS Settings,CN=MORPHEUS,CN=Servers,CN=London,CN=Sites,CN=Configuration,DC=savtech,DC=com
Site Topology Renewal :
Site Topology Failover :
To generate the report perform the following:

Q. How can I change the NetBIOS name of my Windows 2000 domain?
A. Even though Windows 2000 names are DNS based, e.g. savilltech.com, a NetBIOS name is also specified during DCPROMO execution for backwards compatibility with older clients/domain controllers and is normally the left most part of the DNS name, e.g. savilltech, although it can be changed to a user specified name.
Once this NetBIOS name has been set during DCPROMO execution you cannot change it. The only way would be to demote all domain controllers and recreate the domain but you would lose all objects (although you could dump them out first and them import in again).
If you are upgrading a 4.0 domain then during the DCPROMO execution the NetBIOS name cannot be changed. You are stuck with the NetBIOS name of the 4.0 domain but you can of course have a totally different DNS name.
Q. How can I monitor when the Knowledge Consistency Checker (KCC) is run?
A. The KCC which manages the connection objects for inter and intra site replication runs periodically and ascertains if any new objects need creating or existing objects deleted.
If you want you can monitor exactly when its execution starts and finishes by performing the following actions:
With this value set to 3 or greater, the KCC will log extra events which you can view using the Event Viewer and viewing the 'Directory Service' branch.
Common and useful events are:

Q. What backup software is available for Windows NT?
A. Windows NT ships with NTBACKUP.EXE which is suitable for backing up most installations however its features are quite basic, for the larger more complex installations one of the following may be worth a look
A. Before you can add a tape drive you should first ensure that the correct SCSI driver is loaded for the card the tape drive is connected to. Once the SCSI driver is loaded you should perform the following
Q. What types of backup does NTBACKUP.EXE support?
A. NTBACKUP.EXE supports 5 different types of backups
Q. What backup strategies are available?
A. The main backup strategy is on a weekly plan as follows
As you know an incremental backup only backs up those files that have changed since the last backup and then sets them as backed up so this type of backup should be quite fast. In the event of a failure you would have to first restore the normal backup and then any subsequent incremental backups.
An alternative would be as follows
Differential backups and incremental backups are the same except that differential does not mark the files as backed up, therefore files backed up on Monday will still be backed up on Tuesday etc. Therefore to restore the backup you would only need to restore the normal backup and the latest differential backup.
It is important to not just have on week's worth of tapes, you should have a tape rotation and have maybe 10 tapes and rotate on a fortnightly basis.
If you wanted an extra backup as a one off you would use a copy backup as this does a full backup but does not mark files as backed up and therefore would not interfere with other backup schemes in use.
Q. What options are available when using NTBACKUP.EXE?
A. Once you start NTBACKUP a list of all drives on the machine will be shown. You can either select a whole drive or double click on the drive and then select directories. Once you have selected the drives/directories click the Backup button.
When performing a backup there are a number of fields that should be completed.
Q. Can I run NTBACKUP from the command line?
A. NTBACKUP is fully usable from the command line using the format below
ntbackup <operation> <path> /a /b /d "text" /e /hc:<on/off> /l "<filename>" /r /t <backup type> /tape:n /v
The parameters have the following meanings
| <operation> | This will be backup . If you wanted to eject a tape you could enter eject (but must also include the /tape parameter) |
| <path> | The list of drives and directories to be backed up. You may not enter file names or use the wildcard character. To backup multiple drives just put a space between them, e.g. ntbackup backup c: d: etc... |
| /a | Append backup sets to the end of the tape. If /a is omitted then the tape will be erased |
| /b | Backup the local registry |
| /d "text" | A description of the tape |
| /e | Logs only exceptions |
| /hc:<on/off> | If set /hc:on then hardware compression will be used, if /hc:off then no hardware compression will be used. |
| /l "<filename>" | Location and name for the logfile |
| /r | Restricts access (ignored if /a is set) |
| /missingtape | Specifies that a tape is missing from the backup set when the set spans several tapes. Each tape becomes a single unit as opposed to being part of the set. |
| /t <backup type> | The type of backup, normal, Incremental, Differential, Copy or Daily |
| /tape:n | Which tape drive to use (from 0 to 9). If omitted tape drive 0 is used |
| /v | Performs verification |
Q. How do I schedule a backup?
A. Before a backup can be scheduled, you must ensure the scheduler service is running on the target machine, it does not have to be running on the issuing machine. For information on the schedule service see Q. How do I schedule commands?
Once the scheduler service has been started it is possible to submit a backup command using the ntbackup.exe image (image is a name for an executable)
at 22:00 /every:M,T,W,Th,F ntbackup backup d: /v /b
The command above would schedule a backup at 10:00 p.m. on weekdays of drive D: and the local registry with verification.
If you are having problems with the scheduling you may want to use the /interactive switch so in the event of a problem you can interact with the backup program.
A. To restore a backup saveset is simple and will depend on what was backed up, however the basics are
Q. How do I backup open files?
A. Sometimes files can be corrupted as a backup program will try to backup an open file and when restored the file is corrupt. To stop NTBACKUP from backing up open files perform the following
If you do have "Backup files in use" set to 1 then you should also set the following parameter
HKEY_CURRENT_USER\Software\Microsoft\Ntbackup\User Interface\Skip open files
The values for this are
0 - Do not skip the file, wait till it can be backed up
1 - Skip files that are open/unreadable
2 - Wait for open files to close for Wait time (which
is another registry value in seconds)
For more information have a look at Q159218 (http://support.microsoft.com/support/kb/articles/q159/2/18.asp)
To backup open files without corruption you should look at Open File Manager software from http://www.stbernard.com (yeah the advert with the cute dog!). You can download a 15 day free trial.
Q. What permissions do I need to perform a backup?
A. The operator performing the backup requires the "back up files and directories" user right. This can be given directly using user manager, or the preferred way is to make the user a member of either the Administrators group or the backup operators group.
Q. How do I backup the registry?
A. Most of the registry hives are open, making them unable to be copied in the normal way, however there are several methods available to you
NT does not automatically rename the old Registry to .DA0 as does Windows 95. However, you can use RDISK, the Emergency Recovery Disk utility, to generate fresh duplicates of the Registry, and use this script to keep three old versions on hand:
REM REGBACK.BAT note: change M: to home directory on LAN
REM pkzip25 is a product of PKWARE, see www.pkware.com for details
rdisk /s-
if exist m:regback.old del m:regback.old
ren m:regback.sav regback.old
ren m:regback.zip regback.sav
pkzip25 -lev=0 -add -attr=all m:regback %systemroot%\repair\*.*
exit
Q. How can I erase a tape using NTBackup that reports errors?
A. When NTBackup starts and when a tape is inserted a scan of the device is performed and if any errors are found one of the following messages will be displayed
You will not be able to perform any actions on the tape including erasing it. It is possible to force NT to not check a tape when inserted using the /nopoll parameter, e.g.
c:\>ntbackup /nopoll
You will now be able to erase the tape within NTBackup. If you have multiple tape drives you may want to use the /tape:n parameter to instruct NTBackup to ignore a certain tape drive, otherwise no other parameters should be used.
Once you have erased the tape you should exit ntbackup and restart to use the tape (without specifying /nopoll).
Q. How can I remove a dead submitted Backup process?
A. If you submit a backup using the AT command (the schedule command) and the ntbackup program has a problem, you run Task Manager but are unable to kill the process as an error along the lines of you don't have authority to end the process will be shown. The only solution is to reboot the server.
If you had submitted the ntbackup command with the /interactive switch you would see some kind of error.
Rather than rebooting the server you can create a "special" version of task manager which will be able to kill the rogue NTBACKUP process. Simply submit task manager to start one minute in the future using the AT command or even better using the Resource Kit SOON.EXE utility:
C:\> soon 30 /interactive taskmgr
In 30 seconds task manager will be displayed and you will be able to kill the NTBACKUP process.
The AT syntax would be
C:\> at [\\<computer name>] <time in future> /interactive taskmgr
The \\<computer name> is optional and would start Task Manager on another machine.
An alternate method is as follows:
use the TLIST.EXE and the KILL.EXE provided in the Resource kit.
From the command prompt issue...
C:\> tlist -t | more
The output is .... <snip>
ATSVC.EXE (315)
CMD.EXE (345)
NTVDM.EXE (348)
NTBACKUP.EXE (314)
(the PID will vary from system to system)
(the "-t" option is important. It provides a tree-like-output to
determine which process is the parent and child process)
Use the KILL.EXE to end the parent process CMD.EXE and NTBACKUP.EXE
C:\> kill -f 345
By killing the parent process it DOES NOT kills the children process it created. Once you kill the CMD.EXE process you then need to kill the children processes that the CMD.EXE called.
Just don't kill the ATSVC.EXE process!!! If you do you no longer have the schedule service running, and you will have to restart it.
You must have Administrative privileges to run the KILL.EXE program.
You may find this better than fumbling with the AT command and waiting for it to start the TASKMGR as a system account.
If this is on a remote server where you can't get to the console load the RKILLSRV.EXE as a service on the remote machine, and use the RKILL.EXE on your local machine. Both programs are from the resource kit. You must have Administrative privileges on the target system to kill the processes.
RKILL.EXE syntax...
Usage : rkill /view \\servername
to get the process list on servername
Usage : rkill /kill \\servername pid
to kill process pid on servername
Usage : rkill /token \\servername
to get your remote security token on servername
Another useful use for this is as part of a scheduled NTBACKUP and to always run the command "kill.exe -f ntbackup.exe" first in the scheduled NTBackup-batch job. I've been told it works great but have never used myself. Basically if there is an old stray backup job running it will kill it first.
A. A batch file is just a text file with a .bat or .cmd extension that adheres to a syntax and a set of valid commands/instructions. To run a batch file just enter the name of the file, you don't need to enter the .cmd or .bat extensions. In line with programming tradition the first batch file we write will output "Hello World".
Q. What commands can be used in a batch file?
A. Windows NT 4.0 introduced some extensions to cmd.exe, so to use these make sure HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions is set to 1. The following is a list of the more common commands you will use
| call <batch file> | This is used to call one batch from inside another. The execution of the current batch file is suspended until the called batch file completes |
| exit | Used to stop batch file execution. If a batch file is called from inside another and exit is called both batch files are stopped |
| findstr <string> <filename(s)> | Used to find a string in a file. There are a number of parameters from this and is quite powerful |
| for | Standard for loop for /L %n IN (1,1,10) DO @ECHO %n Would print 1 to 10 |
| goto <label> | Causes the execution of a program to skip to a given
point. The actual label name must be preceded with a colon (:), e.g. goto label1 ... :label1 ... |
| if <condition> .. | The if statement has a great deal of functionality.
Some of the more common ones are: if /i <string1> <compare> <string2> <command> The /i makes the comparison case insensitive and compare can be one of: EQU equal NEQ not equal LSS less than LEQ less than or equal GTR greater than GEQ greater than or equal if errorlevel if exist <file name> |
| rem <string> | A comment |
| start <window title> <command> | Starts a new command session and runs a given command. Unlike call the execution of the current batch file is not halted and continues |
There are some extra utilities supplied with the NT Resource Kit which can be useful.
Q. How can I perform an action depending on the arrival of a file?
A. This is a common request as users on hosts have files FTP'd from a host and need to action it when it arrives. Below is a simple batch file to do this:
:filecheck
if exist e:\upload\file.txt goto actionfile
sleep 100
goto filecheck
:actionfile
...
This would check for file.txt every 100 seconds. The program sleep.exe is supplied with the resource kit so you would need the resource kit installed.
There may be a problem if the file is large and being created when its
existance is checked for, for example if the file is being ftp'd and is
still writing into it.
To get around this try to RENAME the file to itself, e.g.:
RENAME e:\upload\file.txt file.txt
if not errorlevel 0 goto actionfile
... or something like that. RENAME throws an error whether the file doesn't
exist or whether it's not available to write to (because it's still being
written to).
The errorlevel is the same, but the error message changes, if one cares to
distinguish in the .BAT file.
Q. How can I access files on other machines?
A. You can use the UNC naming conventions, e.g. \\<server name>\<share name>\<dir>\<file>. Alternatively you could map the drive, access the file using a drive letter and then unmap the drive, e.g.
net use g: \\savilltech\filetosee
... g:\dir\file.txt
net use g: /d
Q. How can I send a message from a batch file?
A. Use the NET SEND command, e.g.
net send <machine> "<message>"
Q. The command I enter asks for input, can I automate the response?
A. Most commands have a switch to confirm an action however if a command requires a response when run, for instance a logon may want you to enter a password try the following:
echo <password> | logon savillj
This runs the command "logon savillj" and assuming it then asked for a password, the echo would then echo the password with a return thus entering your password for you.
You can also echo a return using
echo.|cmd.exe
Q. How can I pass parameters to a batch file?
A. When you call a batch file you may enter data after the command which the batch file refers to as %1, %2 etc, for example the batch file hello.bat
@echo hello %1 boy
Would output
hello john boy
if called as "hello.bat john" (you don't need to enter .bat extension, I just use it here as I used bad file names :-) )
You can actually modify the passed parameter in the following ways
| Parameter | Description |
| %1 | The normal parameter. |
| %~f1 | expands %1 to a fully qualified path name. If you only passed a file name from the current directory it would expand to the drive/directory as well |
| %~d1 | extracts the drive letter from %1. |
| %~p1 | extracts the path from %1 |
| %~n1 | extracts the file name from %1 without the extension |
| %~x1 | extracts the file extension from %1 |
| %~s1 | changes the meaning of n and x options to reference the short name. You would therefore use %~sn1 for the short file name, or %~sx1 for the short extension |
You can combine some of the above as follows
| Parameter | Description |
| %~dp1 | expands %1 to a drive letter and path only. |
| %~sp1 | for short path |
| %~nx1 | expands %1 to a file name and extension only. |
To see all of these in actions put this into a batch file testing.bat
@echo off
echo fully qualified name %~f1
echo drive %~d1
echo path %~p1
echo file name %~n1
echo file extension %~x1
echo short file name %~sn1
echo short file extension %~sx1
echo drive and directory %~dp1
echo file name and extension %~nx1
Run the file with a long file name, for example the batch file run on file c:\temp\longfilename.long would produce output
fully qualified name c:\TEMP\longfilename.long
drive c:
path \TEMP\
file name longfilename
file extension .long
short file name LONGFI~1
short file extension .LON
drive and directory c:\TEMP\
file name and extension longfilename.long
Obviously all the above also work on the second, third parameter etc, and you just substitute 1 for the parameter, e.g. %~f2 for the second parameters fully qualified path name.
Within a batch file %0 holds information about the file when it is run and that the command extensions can also be used with it (e.g. %~dp0 will give the drive and path of the batch file).
Q. How can I stop my batch files outputing the command to screen as it runs it?
A. This is stopped by just placing
@echo off
at the top of your batch file. To stop a single command being output to the screen just put @ in front of the command.
Q. How do I call a batch file from within another batch file?
A. It is possible to just enter the name of the batch file in a batch file which will run the called batch file however once completed it will not pass control back to the calling batch file leaving the rest of the calling batch file unrun. For example suppose we had the batch files
calling.bat
@echo off
echo Calling bat here
called.bat
echo Back to Calling bat
called.bat
@echo off
echo called bat here
If you then run calling.bat you would not get the line "Back to
Calling bat" displayed as after called.bat terminates it does not
return to calling.bat. To call a batch file and have it return to the
calling batch file once completed use call . For example
if calling.bat was modified to have "call called.bat" instead of
"called.bat" the line "Back to Calling bat" would be
displayed as once called.bat was completed control would return to
calling.bat.
Q. .bat files have lost their association.
A. This is easily fixed. Enter the commands:
ftype batfile="%1" %*
assoc .bat=batfile
Q. How do I search files for a string from a batch file/command line?
A. There is the basic find command which allows you to search one file at a time for string, however findstr is far more versatile. The command has the following switches
FINDSTR [/B] [/E] [/L] [/R] [/S] [/I] [/X] [/V] [/N] [/M] [/O] [/F:file] [/C:string] [/G:file] [strings] [[drive:][path]filename[ ...]]
| Parameters | Meaning |
| /b | Match pattern if at the start of a line |
| /e | Match pattern if at the end of a line |
| /l | Search literally |
| /r | Use text as a regular expression (default) |
| /s | Search current directory and all sub-directories |
| /i | Ignore case |
| /x | Selects lines that are an exact match |
| /v | Selects lines that do not match |
| /n | Displays the line number before the matched line |
| /m | Displays only the matching file names |
| /o | Displays the offset of the match before the matched line |
| /g:<file> | Gets the search string from the specified file. /g:argument.txt |
| /c:"<string>" | Use text as a literal. /c:"string" |
| /f:<file> | Gets the file list from the specified file. /f:filelist.txt |
| strings | The search string (in double quotes if multiple words) |
| files | Files to be searched |
Use spaces to separate multiple search strings unless /c is used
findstr "Windows NT FAQ" ntfaq.html - searchs for
Windows, NT or FAQ in ntfaq.html
findstr /c:"Windows NT FAQ" ntfaq.html - searchs for
"Windows NT FAQ" in ntfaq.htm