Úplná obnova serveru na stejný nebo úplně jiný hardware

A server that is not a domain controller has gone for a burton, the whole server is a melted heap, or is gently rocking back and forth in the corner muttering about its childhood. You need to restore the whole server. I’m assuming at this point you have a replacement server you can use, this might be the same hardware with a component replaced (similar), or a brand new server (dissimilar).

These instructions have been tested on a Dell PowerEdge R410 Server with a H200 RAID controller and a Dell PowerEdge R410 Server with a SAS6i RAID controller, both running Microsoft Windows 2008 R2, although the procedure is the same for Microsoft Windows 2012 server.

1. Hook up the server, connect a monitor, keyboard and mouse (or use a KVM), start the server up and insert the Windows 2008 R2 Disc (which should have the same service pack slipstreamed in as the server you are restoring.)

2. If you need any RAID or Network card drivers you should have these on a USB memory stick, you may or may not need these depending on if your server has a generic Windows driver support or not. Either way prepare this if you need it.

3. Power up the server, ensure it boots up and configure the RAID to how you want it.

NOTE: The hard disk space on the server you are recovering to must be the same size or larger than that from which you took the backup. I.e. if you had a 100GB server, you can restore to a server with 100GB disk space or larger, you can’t restore a server with 60GB disk space.

4. Boot off the Microsoft Windows 2008 R2 DVD you have shoved in the drive. Wait for it to get to the Windows Setup screen.

5. Once it’s booted, select the “Time and Currency Format” as English (United Kingdom) and the “Keyboard” as UK and click on next.

6. Rather than clicking on “Install Now”, you should click on the “Repair your Computer” button in the bottom left of the screen.

7. Select “Restore your computer using a system image that you created earlier” and click on “Next >”

NOTE: If you need to load a driver you should do it now, by clicking on “Load Drivers” and shoving in the USB memory stick.

8. When prompted click on “Select a System Image” and click on “Next >” you should then see the images on the USB hard disk, click the one you want, then click on “Next >.”

9. Now you’ll see the recovery points (if there’s more than one) for your server, with the times. In our example, we have two of the buggers. Let’s use the oldest one in this case, so click on the one you want, then click “Next >.”

10. Now you’re prompted to “Format and repartition disks”, you should do this unless you really have a reason not to. This will wipe the kack of the server so your restore will be as clean as possible. If say you had data on a separate disk you don’t want wiping click on “Exclude disks..” and tick the drive you want excluding.

11. You might want to add extra drivers, now is the time to do this, click on “Install Drivers…” and select the driver files from a USB memory stick. “Advanced…” allows you to specify extra options, unless you have a reason to you don’t need to change these.

 

12. Click on “Next >” then review you have the correct backup selected, then click on “Finish” to start the ball rolling. Confirm by clicking on “Yes” and your server will start to restore. It will reboot when it’s all done.

Time for a cuppa!

13. Once the restoration has been completed, the server will reboot itself, and if all is well will boot up into your newly restored Windows image.

Oh, Balls!

Blue Screen of Death STOP: 0x0000007B (0xFFFFF880009A9928,0xFFFFFFFFC0000034,0x00000000000000000, 0x00000000000000000)

Now what, it appears that the 0x00000007B means “Inaccessible Boot Device”, in this example this is caused because we’ve gone from a R410 with a H200 RAID controller to a R410 with a SAS6i RAID controller, it doesn’t like it, we therefore need to make some changes to the server to make it boot.

14. Right, the fecker isn’t working, so when it reboots, you should find that it ends up at the “Windows Error Recovery” screen as shown below:

If it doesn’t come up, you should boot off the Windows 2008 R2 disc instead, but if you do this you’ll need to wait until you get to the Windows setup screen, and then press Shift F10 to get a command prompt, then carry on as below.

15. Select “United Kingdom” as the keyboard method, then click on “Next >” you’ll then be prompted for the Administrator password of the server. Now on a member server this is just the local administrator account password, on a domain controller, this is the restore mode password. Enter it and click on “Next >” to continue.

16. Click on “Command Prompt” from the set of three options.

A quick aside: To disable the auto-reboot function so you can have a good butchers at the BSOD, you need to open the registry, to do this perform these steps: 1. Open Command Prompt. 2. regedt32 3. Highlight HKEY_LOCAL_MACHINE, File>Load Hive>[restored volume]:\Windows\System32\Config\SYSTEM ->Open->Key Name = Restored_HKLM>OK. 4. Expand Restored_HKLM\ControlSet001\Control\CrashControl and ensure the “AutoReboot” DWORD value has been set to 0 (setting it to 0 means autoreboot is turned off) then click OK. 5. Click on the “Restored_HKLM” hive and then select File>Unload Hive to disconnect from the registry. 6. Reboot the server and you’ll see the BSOD in all its shitty glory.

17. Now perform the following steps within the command prompt:

1. regedt32 2. Highlight HKEY_LOCAL_MACHINE, File>Load Hive>[restored volume]:\Windows\System32\Config\SYSTEM>Open>Key Name = Restored_HKLM>OK. 3. Expand Restored_HKLM\ControlSet001\services and ensure the following keys “Start” are set to 0 (zero) instead of whatever value they currently have. You are basically turning them all on by setting it to 0 (zero.) aliide (changed), amdide (changed), atapi, cmdide (changed), iastorv (changed), intelide (changed), msahci (changed), pciide, viaide (changed), LSI_SAS (changed).  If restored to a (VMWare) VM then ensure intelide>Start = 0 and LSI_SAS>Start = 0; msahci>Start = 3 and pciide>Start = 3 NB: I have only tested this with VMWare VMs (Player/Workstation and vSphere) but will likely translate across to Microsoft (e.g. HyperV) VMs. The LSI_SAS value is definitely required, I couldn't boot in a VM until this was changed to 0. Or if restoring to a physical machine with native HDD controller  then ensure msahci>Start = 0 and pciide>Start = 0; intelide>Start = 3 and LSI_SAS>Start = 3 4. Highlight Restored_HKLM and then File>Unload Hive. 5. Close windows and restart.

This is discussed here in more detail

http://social.technet.microsoft.com/Forums/windowsserver/en-US/b4d45d9d-4c90-4ab0-ae38-f1257ce9c608/windows-7-server-2008-r2-bare-metal-restore-0x0000007b-stop-error

Note: Turning them all on, isn’t the best thing, but it will get the server up, you should then experiment by turning each one off one by one (i.e. setting it to 3) until you stop the server booting, we don’t want stuff running that we don’t actually use.

18. Okay bitching, we are cooking on gas now! We have it booting up.

19. The server is up and running, you should now login to ensure all is well. You’ll need to logon locally, because the network card settings may have gone walkabout and you’ll need to reconfigure them.

20. Go to the command prompt.

1. Type: ” SET DEVMGR_SHOW_NONPRESENT_DEVICES=1 “ and press 2. Type: ” Start devmgmt.msc ” and press 3. In the Device Manager go to View and click on ” Show Hidden Devices “ 4. Navigate to the Network Adapters and expand it, there should be your old NIC 5. Select and delete. 6. Remove all the NICs (even the live ones), then rescan for new devices.

By doing the above you'll remove the old NICs from the image, these will have been from the server from which you imaged from. If of course you are restoring onto the identical hardware this is unlikely to be the case. its good to get rid of these ghost adapters because they can cause problems.

21. Now the devices will have re-appeared, you just need to configure their network settings as per the old server configuration. Disable any unused NICs to avoid weird-ness.

22. Reboot the server to confirm, and that’s it, you should have your server working again. It is advised that you check everything and then troubleshoot any errors, but as this is an image of the server, then these should be minimal unless of course you are restoring a domain controller, in which case you have more to do.

NOTE: if this server is staying in production, don’t forget to turn off the unneeded services from step 17. This is trial and error.

Zdroj: http://www.geekmungus.co.uk/microsoft-windows/fullserverrecoverybaremetalrecoverytosimilarordissimilarhardware

Obnovení smazaného objektu Active Directory

Get-ADObject -Filter {Name -like "*Novak*"} -IncludeDeletedObjects | Restore-ADObject -NewName novak

Restrict computer logons to a group of users.

Certain computers in open areas such as a laboratory need to be locked down to only allow those users to logon that are authorized to use that computer. This is easily done with group policy.

1.	Create or select an organizational unit to which the policy will apply. If you already have an organizational unit (OU) which contains the computers you wish to restrict, select it. otherwise, create an OU for the policy and move the computers that require restricted access into that OU. be sure to apply your other required group policy objects to the OU as well. To create an OU, open "active directory users and computers" right click on the domain, select "new" and then select "Organizational unit" name the OU and click "OK"
2.	Create a global security group to contain users. You can apply your group policy to individual users but it is more readable if you have a group called "allowed users for restricted lab" and apply the policy to that. then you will get feedback when looking at users that they are a "member" of the lab and are allowed to logon to the computers. in active directory users and computers,
3.	Create the group policy object (GPO) Open the Group Policy Management plug-in, right click on "Group Policy Objects" and select new, then. name the policy something like "restricted lab allowed logons." or another appropriate name. I like to create lots of little policies that implement a few settings as opposed to one huge policy with far reaching settings because they are easier to implement and troubleshoot..
4.	Add your policies to the GPO You are going to configure two "Local Policies" right click on your GPO and select "edit" expand "computer configuration" and "Local policies" click "User Rights Assignment" and double click "Allow log on locally"
5.	Add the group of allowed users Once the properties for Allow log on locally are open, check define these policy settings and add "allowed users for restricted lab" you must also add the local administrators and also the "domain admins" groups.
6.	You must require CTRL+ALT+DEL for the policy to work If you do not require the three finger salute to Microsoft, all log ons are allowed and you will get a notice that the "Member of attribute is missing" the polcy setting is in Security options and is called "Do not require CTRL+ALT+DEL" define the setting and disable it.
7.	Link the GPO to the OU and set the filtering Now that you have your GPO built and applied to the group you created, it needs to be linked to the OU and apply the policy to your "domain users". back in Group policy management, right click on the OU where you want the policy to apply and select "link an existing GPO" select the "restricted lab allowed users" policy from the list and click OK. in GPM you will see your policy under the OU and if you select the policy entry and select the scope tab you will see that the policy is linked to your OU but it is not enforced. right clickon the link and select "enforced" Then, under Security filtering, add "domain users"

Conclusion

Now you have your policy that enforces that only one group is allowed to log on locally to computers that are contained in the OU you created.add your allowed users to the security group you created and add the computers to the organizational unit. any user not in the group will be restrict3ed from logging on to the computer. This policy can be circumvented by local administrators by making someone who is not a member of the group a local administrator. and of course, domain admins have access. Be very careful where and to whom you apply this policy as one could theoretically make an entire domain inaccessible.

http://community.spiceworks.com/how_to/show/2797-restrict-computer-logons-to-a-group-of-users

Import/Export rezervací DHCP

To export DHCP reservations, from the source server

netsh dhcp server [ip address] scope [scope address] dump > reserv.txt
netsh exec C:\reserv.txt

Odpojení ppp nebo vpn spojení z příkazového řádku

rasdial /disconnect

Security Recommendations for Folder Redirection

http://technet.microsoft.com/en-us/library/cc736916(WS.10).aspx