EmailRSS

Tag Archives: Server

Enable AD Authentication on Network Switches

Posted on by

Do you password protect your network devices? If so, are you using the same generic password? Wouldn’t it be awesome to leverage your Active Directory logon to sign into your switches?

In this guide, we are going to enable AD authentication on network switches and routers. The workhorse will be the Network Policy Server role in Server 2012/R2. After our server configuration, we will then configure our switches to point to our NPS (RADIUS) device and change their authentication method.

 

Install and Configure Network Policy Server

As a best practice, use a dedicated server to handle device authentication. In the past, I made the mistake of adding the role to a Domain Controller – this complicated by environment later.

Start the Add Roles and Features Wizard and proceed to the Server Roles screen. Expand Network Policy and Access Services and check the Network Policy Server box. Continue through the Wizard.

NPS1

From the tools menu, launch the Network Policy Server MMC. For this particular use of NPS, we are going to deal with three specific sections.

The first section, RADIUS Clients, will contain a list of the devices needing to authenticate against Active Directory. The second section, Connection Request Policies, determines what devices can authenticate. The final section, Network Polices, determines who can authenticated and how it is done.

Continue reading →

Excluding and Filtering in Server Manager: Quick Tip

Posted on by


Have you ever used a technology for years and suddenly found an awesome hidden feature? This has happened quite a few times to me such as here or here. This post marks another one of those experiences. When you first load machines into Server Manager (like you did in the Best Practices post), you likely freaked out! Dozens of servers were marked as offline and hundreds of services were stopped/disabled.

Capture

Most of these will be false alarms. Under Manageability, you will likely see 2008/2008R2 servers that do not have WinRM installed and configured. If you have 2003 boxes still around, you will see errors with them as well. Services errors will mostly be those that are automatic but stop until they are needed (ex: Microsoft .NET Framework NGEN or Software Protection). Any legitimate issues should be resolved now.

To get rid of the remaining Server Manager errors, you will need to exclude and filter Server Manager. Select the category with the errors. In the top of the window, you will see different methods of filtering. For example, I am filtering out the Software Protection service from the All Servers group.

01

Continue filtering either servers or services until you are at a clean environment! From here, address future alerts or exclude them from display. And that is your Server Manager Quick tip! Are you using Server Manager yet?

 

Best Practice Analyzer (BPA): Consulant in a Box

Posted on by

Are your servers still generating short file names? Are your forward lookup zones configured for 2008+ domains? Ever wish you had an easy way to check your servers against Microsoft’s recommend best practices? By using the Best Practice Analyzer (BPA) in Server Manager, you can identify common misconfigurations and fix them (without even having to hire a consultant)!

02


What is the Best Practice Analyzer (BPA)?

Microsoft introduced BPAs in Server 2008 R2. BPAs are a collection of settings and configurations for each Windows Server Role (DHCP, Hyper-V, Active Directory, etc). As a whole, they represent the most common misconfigurations that “can result in poor performance, poor reliability, unexpected conflicts, increased security risks, or other potential problems.”

Remember the first two questions at the top of this article? Both of those are common issues identified by a BPA scan. The first one is a common misconfiguration on file servers and is easily fixed with a registry change/Group Policy Preference. The second one is created in when you take an older domain and upgrade your domain controllers. It falls under a DNS BPA scan. Each best practice has corresponding pages explaining the issue and how you can resolve it.

There are dozens of configuration checks for each role. On a server running just File/Print services, Microsoft has over 100 best practices! You can read all about BPAs and each individual best practice here:

The first link above includes all of the common serve roles that exist on 2008 R2 and above. Best practices listed there apply to 2012 and 2012 R2. The second link contains the best practices for roles introduced in 2012/R2 (ex: Work Folders). Of course, you probably just want to see what best practices apply to your servers. Let’s do that!


How Can I Use the Best Practice Analyzer (BPA)?

Launch Server Manager from your machine. If Server Manager has always been that annoying popup when you RDPed into a server, get ready to have your mind blown! Start by adding servers to your Server Manager console. You can filter by OS, names, OUs, etc. Server Manager will then connect to those machines, discover the roles running on them, and begin grouping them by role. You can create your own custom groups (ex: grouping servers by physical sites). While Server Manager scans, read the What’s New and Learn More tabs. Server Manager is awesome tool that should be in your daily arsenal!

01

After the server scan has finished, select All Servers. Find any Server 2008 R2+ machine, select it and scroll down to the Best Practices Analyzer section. Select Tasks and Start BPA Scan. From here, you can start the BPA scan on the single machine that you selected or add other servers. Regardless, a BPA scan will be performed on each role that the server has. You can check the status of your scan by selecting the Flag icon in the top right of Server Manager. Any errors are listed here as well.

03Once the scan completes, refresh server manager – select your server – and scroll down to the Best Practices Analyzer section. Any scans that triggered a warning or error should now be listed. You can select each item to read the problem and potential impact. Each result also includes a link to resolve the issue. Continue this process for each machine, resolve the issue, and start optimizing your server setups!

 

Delete Old Files with File Management Tasks

Posted on by

I am really good at reinventing the wheel! Most of the time the wheel isn’t even better – just more complicated. Back in May, I posted a script that to clean up old files. I used this on Windows Server 2003 box for a few years and moved it to a 2012 R2 server. The script used PowerShell and basically compared the LastAccessTime attribute to some date. A reader named Jeff took one look at my script and basically said, “Joseph – just use File Management Tasks”.

And Jeff was right! File Management Tasks are easier to setup and provide a lot more flexibility out of the box. Today, let’s look at how the File Server Resource Manager can keep our shares clean of old data!

 

Configuring a File Management Task

First, your file server does have to be running Windows Server 2008 R2 or higher. For those of you kicking it old school, I’ll wait while you upgrade. 🙂

Next, add the File Server Resource Manager role to your server. Accept the defaults during the installation.

Delete Old Files with File Management Tasks

Launch the File Server Resource Manager MMC and navigate to File Management Tasks. Select Create File Management Task. Name your task Expire Stale Data. Under scope, select Add. Add any folders/volumes that need to be cleaned up.

Delete Old Files with File Management Tasks

Under the Action tab, ensure that Type is set to File Expiration. When a file is marked to expire (more on that in a bit), it is never deleted. Instead, it is moved out of the scope (C:\public in the screenshot above) and into your expiration directory. Don’t worry about accidently deleting files because you can’t do it! In the screenshot below, I am moving expired data to a local folder.

Delete Old Files with File Management Tasks

Select the Condition tab. In this window, you can set criteria for what files are considered stale. By creation multiple tasks for different scopes, you can have more restrictive or aggressive cleanups as needed. Each check box functions as an AND statement. Our conditions below ensure that files are not moved they haven’t been modified for 3 years and haven’t been accessed for two years.

Delete Old Files with File Management Tasks

If desired, you can use the Notification tab to alert users of pending changes. In your notification, you can include a list of files that will be removed and provide additional instructions to your staff on what they should do. You can use the Report tab to email IT staff members a list of changes after a task has completed.

For your task to run, it must have a schedule. Press the Schedule Tab – then Edit. I recommend a schedule of once per month at the most. You can run it now for testing or wait until the schedule. As it is running, you can watch your Expired Files Directory populate. To make restoration easier, the files are moved to the expired directory using their previous folder structure. From here, you can schedule a permanent deletion by using a schedule task to empty the folder. You can also use this PowerShell script:

$Date = (Get-Date).AddMonths(-6) | get-date -UFormat "%Y-%m" $ExpiredDirectory = Get-ChildItem "C:\Expired Files\FQDN of Server" | where name -like "Expire Stale Data_$Date*" $ExpiredDirectory | Remove-Item -Recurse -whatif

Adjust the .AddMonths(-6) to change how long you wish to keep folders in the Expired Directory. This script is designed to be ran monthly and will delete the folder that is six months old.

Cleaning and Deleting Old Files with PowerShell

Posted on by

Summer time approaches and the days seem to get just a bit easier! People are starting to catch up on things, delete old emails, and clean out old files. What? Your people don’t automatically delete files that aren’t needed anymore? You are telling me that they expect you to keep and backup everything that they have ever created! It is time to clean out the trash and free up some space. Lucky for us, this whole process becomes super easy when we start deleting old files with PowerShell!

Before we jump to the script, you will need to decide on two things. First, what is the oldest file that you want? We will measure this by the date accessed attribute.  For our environment, we delete any file that hasn’t been used for three years. If today is June 1st, we only want files newer than 06/01/2011.

Second, you will need to think about any files to exclude. For example, you might have log files, videos, or records that should never be deleted. If you have files like this, you will need to create a CSV to exclude them.

Cleaning and Deleting Old Files with PowerShell

At the top of your CSV, enter Name. In the lines below, you can either specify folder names, file names, or a mixture. The screenshot above shows a few different examples including some with wildcards. Got your maximum age in mind and your exclusion CSV create? Great – let’s create our PowerShell cleanup script.

 

Our Deleting Old Files with PowerShell Script

Launch PowerShell ISE and paste the script below. On the second $exclusions line, change the import-csv command so that it points to your new CSV. In the $Directory line, replace \\SERVER\SHARE and specify the share that you want to clean up. In that same line, change the Last Access Time date to match your maximum file age.

# The line below is the path to the exceptions file - one entry per line
$exclusions = @()
$exclusions = import-csv .\exclusions.csv

#The line below deletes everything EXCEPT what is in the exclusion file.
Clear-Variable Directory -ErrorAction SilentlyContinue
$Directory = Get-ChildItem \\SERVER\SHARE -Recurse | where-object { $_.LastAccessTime -lt "06/01/2011" } | sort Name |select name,fullname,lastaccesstime


foreach ($exclusion in $exclusions){
$Exclusion = $exclusion.name
$Directory = $Directory | Where-Object {$_.FullName -notlike "*$exclusion*"}

}

$Directory | export-csv .\Deleted.csv -NoTypeInformation -Append
$Directory.fullname | remove-item -Recurse -whatif -Verbose

You can now run this script to test your results. Any file that will be deleted will be recorded in a Deleted.CSV file. This file is created in the current run path of your PowerShell console. When you get ready to run this script in live action mode, remove the -whatif parameter in the very last line. If you have multiple shares to clean up, you can create a new variable name $Shares and have the script walk through each item.

This is how we keep our file hoarders at bay! If you have any suggestions to improve this script, leave a comment below. If you use another method, I would love to hear about it!