Mastering DsQuery: Fast Domain Controller Auditing

Posted on Updated on

Using the GUI to find specific servers in a large forest can be time-consuming. DsQuery Server provides a lightning-fast way to extract this data directly from the Command Prompt. Whether you need a list of Global Catalogs or want to find the Schema Master, these commands will save you hours of clicking.

1. Locating Domain Controllers in the Forest

To get a quick list of every DC across all domains in your entire forest, you can use the -Forest switch.

  • To get the full Distinguished Name (DN): DsQuery Server -Forest
  • To get just the Relative Distinguished Name (RDN): DsQuery Server -o rdn -Forest

2. Targeting a Specific Domain

If you only want to see the controllers within a specific domain, use the -domain switch: DsQuery Server -domain lazyadminblog.com

3. Finding Global Catalog (GC) Servers

Global Catalogs are vital for forest-wide searches. To find which DCs in a specific domain are configured as GCs: DsQuery Server -domain lazyadminblog.com -isgc

4. Finding FSMO Role Holders

Instead of opening multiple MMC snap-ins, you can find the FSMO role holders directly. For example, to find the server holding the Schema Master role for the forest: DsQuery Server -Forest -hasfsmo schema

Note: You can replace schema with naming, pdc, rid, or infrastructure to find other role holders.

5. Exporting your Results

The most useful way to use DsQuery is to pipe the results into a text file for documentation or further scripting. Use the > operator to save your output: DsQuery Server -Forest > C:\Logs\AllDCs.txt

#ActiveDirectory #DsQuery #SysAdmin #WindowsServer #ITPro #CodingAdmin #ServerAudit #LazyAdmin #TechTips #DataCenter

This entry was posted in Windows and tagged , , , , , , , , .

LDIFDE vs. CSVDE: How to Export Active Directory Data

Posted on Updated on

Exporting Active Directory objects doesn’t require complex scripts. Windows includes built-in tools to handle this via the command line. Choosing between them depends on what you plan to do with the data.

1. LDIFDE (LDAP Data Interchange Format)

Best for: Migrations and bulk modifications.

LDIFDE exports data in the .ldf format. This format is superior for importing data back into AD because it can handle operations like add, modify, and delete.

Command Syntax:

DOS

ldifde -f Exportuser.ldf -s ADservername -d "CN=username,CN=Users,DC=domain,DC=com"
  • -f: The filename for the export.
  • -s: The source Active Directory server.
  • -d: The Distinguished Name (DN) of the root search point.

2. CSVDE (Comma Separated Value)

Best for: Reporting and Excel analysis.

CSVDE exports data into a standard CSV format. This is perfect if you need to create a spreadsheet of user attributes for a manager or an audit. Note that CSVDE cannot be used to modify existing objects; it only supports “Add” operations during an import.

Advanced Export Command:

This command filters for specific objects with mailboxes and pulls a massive list of attributes (Name, Company, Title, Phone, etc.):

DOS

csvde -m -f Mailboxes.csv -d "OU=Users,DC=domain,DC=com" -r "(&(objectClass=user)(mail=*))" -l "objectClass,displayName,memberOf,proxyAddresses,title,telephoneNumber,company,userPrincipalName,sAMAccountName"
  • -m: Omits binary attributes (like objectGUID) that aren’t readable in text.
  • -r: The LDAP filter (e.g., only users with an email address).
  • -l: The list of specific attributes you want to include in the columns.

Comparison Table: Which should you use?

FeatureLDIFDECSVDE
Output FormatPlain Text (.ldf)Comma Separated (.csv)
Best UseModifying/Moving ObjectsReporting / Spreadsheet Analysis
ReadabilityHarder for humansVery easy (Excel)
Import SupportAdd, Modify, DeleteAdd only

The LazyAdmin Tip: Always use the -m switch with CSVDE. If you don’t, your CSV file will be filled with unreadable binary strings for attributes like user certificates or SID history, making it almost impossible to use in Excel!

#ActiveDirectory #SysAdmin #ITPro #DataExport #WindowsServer #CSVDE #LDIFDE #LazyAdmin #TechTips #ServerManagement

This entry was posted in Active Directory, Windows and tagged , , , , , , , , .

How to Get Hardware Serial Numbers Remotely (WMIC & PowerShell)

Posted on Updated on

As a SysAdmin, you often need a serial number or UUID for a warranty check or asset tracking. Instead of walking to the user’s desk or remoting into their session, you can pull this data directly from your workstation using these simple commands.

1. Using WMIC (Legacy Command Line)

WMIC is incredibly efficient for quick, one-off queries against remote systems.

To get a remote serial number:

DOS

wmic /node:"RemoteComputerName" bios get serialnumber

To export results to a central text file: If you are auditing multiple machines, use the /append switch to create a running list:

DOS

set myfile=\\Server\Share\Inventory.txt
wmic /append:%myfile% /node:"RemoteComputerName" bios get serialnumber

2. Using PowerShell (Modern Method)

PowerShell is the preferred method for modern Windows environments (Windows 10/11 and Server 2016+). It returns objects that are much easier to manipulate.

Standard Command:

PowerShell

Get-WmiObject -ComputerName "RemoteComputerName" -Class Win32_BIOS

The “Lazy” Short Version:

PowerShell

gwmi -comp "RemoteComputerName" -cl win32_bios

3. Bonus Hardware Commands

Sometimes the serial number isn’t enough. Use these WMIC commands to get a deeper look at the hardware specs:

  • CPU Details: Get the exact model and clock speeds. wmic cpu get name, CurrentClockSpeed, MaxClockSpeed
  • System Product Info: Pull the motherboard name and the system’s unique UUID. wmic csproduct get name, identifyingnumber, uuid
  • Full BIOS Audit: Get the BIOS name, version, and serial number in one go. wmic bios get name, serialnumber, version

Troubleshooting Connectivity

If these commands fail with “Access Denied” or “RPC Server Unavailable,” check the following:

  1. Admin Rights: Your shell must be running with Domain Admin or local administrator permissions on the target.
  2. Firewall: Ensure “Windows Management Instrumentation (WMI)” is allowed through the Windows Firewall on the remote machine.
  3. WMI Service: Ensure the WinMgmt service is running on the target.

#SysAdmin #PowerShell #WMIC #WindowsServer #ITPro #TechTips #InventoryManagement #LazyAdmin #RemoteAdmin #HardwareHack

This entry was posted in Windows and tagged , , , , , , , , .

Installing ADSI Edit on Windows Server 2003

Posted on Updated on

Whether you are performing a schema extension or manually cleaning up metadata after a failed Domain Controller demotion, ADSI Edit is the tool you need. Because it interacts directly with the Active Directory database, it is powerful—and dangerous.

Warning: ADSI Edit does not have “undo” functionality. Always ensure you have a valid System State backup before making manual attribute changes.

Step 1: Locating the Installation Files

On Windows Server 2003, ADSI Edit is not installed by default. It is part of the Windows Support Tools package.

  • From the CD: Insert your Windows Server 2003 installation media and navigate to: [CD-DRIVE]:\SUPPORT\TOOLS\
  • Run the Installer: Double-click SUPTOOLS.MSI and follow the installation wizard.
  • No CD? You can download the “Windows Server 2003 Service Pack 2 Support Tools” directly from the Microsoft Download Center.

Step 2: Launching the Console

Once the Support Tools are installed, you can launch the editor:

  1. Go to Start > Run.
  2. Type adsiedit.msc and press Enter.

Step 3: Troubleshooting “adsiedit.msc not found”

If you have installed the tools but still receive an error that the file cannot be found, the system likely hasn’t registered the required library (.dll) file properly.

To manually register the DLL:

  1. Go to Start > Run.
  2. Type the following command: regsvr32 adsiedit.dll
  3. You should see a success message stating that the DllRegisterServer succeeded.

What can you do with ADSI Edit?

ADSI Edit allows you to view and edit the three primary partitions of the Active Directory database:

  • Domain Partition: Contains the users, groups, and OUs.
  • Configuration Partition: Contains forest-wide configuration data (like site topology).
  • Schema Partition: Contains the definitions for every object type and attribute in the forest.

#ActiveDirectory #ADSIEdit #WindowsServer #SysAdmin #ITPro #Microsoft #TechSupport #LazyAdmin #ServerManagement #VintageTech #ADTroubleshooting

This entry was posted in Active Directory, Windows and tagged , , , , , , , , .

How to change the thick or thin provisioning of a virtual disk

Posted on Updated on

🟢 Converting Thin to Thick (Inflation)

If your datastore has plenty of space and you need to eliminate the performance “write penalty” of a thin disk, you can Inflate it.

  1. Preparation: Power off the VM. Ensure there are no snapshots attached to the VM, as inflation only works on the base .vmdk.
  2. Locate the File: Go to the VM’s Summary tab. Under Resources, right-click the datastore and select Browse Datastore.
  3. The “Inflate” Action: Open the VM folder and find the .vmdk file. Right-click it and select Inflate.
    • Note: If “Inflate” is greyed out, the VM is likely still powered on or is already thick-provisioned.
  4. Finalize: Once the task finishes, you may need to Reload the .vmx file to ensure the vSphere UI reflects the new “Thick” status.

🔵 Converting Thick to Thin (Migration)

Converting back to Thin provisioning is slightly more complex because you cannot “deflate” a disk in place. You must move the data to a new location to reclaim the space.

Method A: Migration (Requires two Datastores)

This is the cleanest way to convert a disk using Storage vMotion or an offline migration.

  1. Power Off the VM (required for standard Migration; not required for Storage vMotion if licensed).
  2. Migrate: Right-click the VM and select Migrate > Change Datastore.
  3. Select Format: In the migration wizard, look for the Select Virtual Disk Format dropdown and choose Thin Provision.
  4. Target: Select a different datastore than the current one. vSphere will copy the blocks, only writing the actual data to the destination, effectively “thinning” the disk.

Method B: Cloning (Single Datastore)

If you only have one datastore, you cannot migrate the VM to itself to change the format.

  1. Right-click the VM and select Clone.
  2. During the clone wizard, select your current datastore as the destination.
  3. In the Disk Format section, select Thin Provision.
  4. Once complete, delete the old “Thick” VM and keep the new “Thin” one.

⚠️ Important Considerations

  • Backups: Always have a fresh backup. Moving or inflating disks is a heavy I/O operation.
  • Lazy vs. Eager Zeroed: When inflating to Thick, vSphere usually defaults to “Lazy Zeroed” (space is reserved, but blocks aren’t cleared until written to). For maximum performance (e.g., for Database logs or VSAN), “Eager Zeroed” is preferred.
  • Space Check: Before converting from Thin to Thick, ensure your datastore can handle the immediate consumption of the entire disk size.

#VMware #vSphere #Storage #ThinProvisioning #ThickProvisioning #SysAdmin #ITPro #Virtualization #LazyAdmin #CloudStorage #TechTips

This entry was posted in VMware and tagged , , , , , , , , .

How to Enable Remote Logins in a Windows server

Posted on Updated on

🛠️ The Registry Method (Headless Activation)

By default, Windows Server hardens itself by denying Terminal Server (TS) connections. You can flip this switch manually in the Registry Editor.

  1. Open Registry Editor: Press Win + R, type regedit, and hit Enter.
  2. Navigate to the Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\
  3. Modify the Value: Locate the fDenyTSConnections DWORD.
    • Value = 1: Remote Desktop is Disabled (Default).
    • Value = 0: Remote Desktop is Enabled.

💻 The PowerShell Method (The Modern Way)

If you have PowerShell Remoting enabled, you don’t even need to open a GUI. You can push this change with a single line of code:

PowerShell
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

To verify the change:

PowerShell
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections"

🛡️ Important: Don’t Forget the Firewall!

Enabling the registry setting is only half the battle. If the Windows Firewall is active, it will still block port 3389. You must allow the RDP traffic:

Via PowerShell:

PowerShell

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

⚠️ Security Checklist

  • NLA (Network Level Authentication): For modern security, ensure the value UserAuthentication in the same registry path is set to 1. This requires users to authenticate before a session is even created.
  • Permissions: Simply enabling the service isn’t enough; the user account must be part of the Remote Desktop Users group or have Administrative privileges.
  • BlueKeep & Vulnerabilities: Ensure your server is fully patched if you are exposing RDP, as unpatched legacy servers are prime targets for ransomware.

#WindowsServer #RDP #RemoteDesktop #SysAdmin #ITPro #PowerShell #RegistryHacks #LazyAdmin #TechTips #ServerSecurity

This entry was posted in Windows and tagged , , , , , , , .

How to Fix: Keyboard or Mouse Not Working in a VMware Virtual Machine

Posted on Updated on

It’s a frustrating classic: you click into your VM, and… nothing. The cursor doesn’t move, or the keyboard acts like it’s unplugged. Usually, this is a “focus” or driver issue rather than a hardware failure.

Here is the “Lazy Admin” checklist to get your inputs back online.

1. The “Focus” Check (The Most Common Culprit)

Virtualization software intercepts your hardware inputs. If the VM window doesn’t have “Focus,” your typing is still going to your host OS.

  • Action: Click anywhere inside the VM console window.
  • Pro Tip: Look at the bottom status bar of your VMware window. If the mouse icon isn’t lit up, the VM isn’t “grabbing” the input.

2. The Wireless Device “Passthrough” Trap

If you are using a wireless USB mouse/keyboard, the VM might have accidentally “claimed” the USB receiver for itself, cutting it off from the host.

  • Action: Go to VM > Removable Devices and ensure your HID (Human Interface Device) is Disconnected from the VM so the host can manage it and pass the input through the software layer instead.
  • Alternative: Remove the USB Controller from the VM settings and re-add it to reset the bus.

3. Driver Conflicts & Optimization

Sometimes, fancy “Gaming” drivers (Logitech G-Hub, Razer Synapse) inside the guest OS conflict with the VMware virtual driver.

  • Action: Uninstall any non-standard mouse/keyboard software inside the VM.
  • Optimization: In VMware Workstation settings, go to Preferences > Input and set “Optimize mouse for games” to Always or Automatic.

4. The Nuclear Option: Reinstall VMware Tools

The VMware Tools package includes the specialized vmmouse driver that handles smooth cursor movement and keyboard mapping. If this is corrupted, your input will fail.

  • Action: 1. Press Ctrl + Alt to release your mouse to the host. 2. Go to VM > Install (or Reinstall) VMware Tools. 3. Use the keyboard (Tab and Spacebar) if the mouse isn’t working to navigate the installer.

5. Troubleshooting the Host (OS-Specific)

If the issue persists, the problem might be a service on your physical computer blocking the input stream.

  • Windows Hosts: Run msconfig to perform a “Clean Boot,” disabling non-Microsoft services to see if a background app is interfering.
  • Linux Hosts: Drop to Run Level 2 to disable start daemons and test the raw input.

#VMware #Virtualization #SysAdmin #ITSupport #TechTips #LazyAdmin #VMwareWorkstation #vSphere #WindowsTips #LinuxTips

This entry was posted in VMware and tagged , , , , , , , .

Understanding Processor Queue Length

Posted on Updated on

In simple terms, Processor Queue Length is the “waiting room” for your CPU. It represents the number of threads that are ready to be processed but are currently stuck waiting because the CPU is already busy handling other tasks.

🚦 The Core Concept: Threads in Waiting

Every action on your server—whether it’s a database query or a system background task—is broken down into threads. The CPU can only handle a certain number of threads at once. When more threads arrive than the CPU can handle, they line up in the Processor Queue.

📉 Identifying a Bottleneck

A high CPU utilization percentage (e.g., 90%) doesn’t always mean there is a problem. The true indicator of a performance bottleneck is a sustained or recurring queue.

  • The Golden Rule: A sustained queue of more than two threads per processor is a clear symptom of a bottleneck.
  • The Exception: Queues can develop even when CPU utilization is below 90% if the requests are random and the processing time for each thread varies wildly.

🔍 How to Troubleshoot a High Queue

If you notice frequent queueing, you need to dig into the specific processes causing the backup.

  1. Check % Processor Time: Identify which specific processes are eating up CPU cycles.
  2. Monitor Thread Patterns: Use Performance Monitor (PerfMon) to see if a single process is spawning too many threads.
  3. Evaluate Priorities: Check if certain low-priority tasks are holding up high-priority ones. While you can adjust base priorities in Task Manager, this is usually a “band-aid” fix, not a permanent solution.

🖥️ Multiprocessor Systems: Calculating the Limit

The acceptable queue length scales with your hardware. To find your target range, multiply your number of physical processors (or cores) by the thread threshold.

System TypeTypical Usage (0–10% CPU)Busy System (80–90% CPU)
Single Processor0 to 1 threads1 to 3 threads
Dual Processor0 to 1 threads2 to 6 threads
Quad Processor0 to 1 threads4 to 12 threads

Note: For servers, also keep an eye on the Server Work Queues\Queue Length counter, which specifically tracks requests waiting for the server service.

#WindowsServer #SysAdmin #PerformanceTuning #ITPro #TechTips #CPU #DataCenter #ServerManagement #LazyAdmin #PerfMon

This entry was posted in Windows and tagged , , , , , , , .

Syslog Server storage logs size calculation

Posted on Updated on

Upgrading your syslog retention is a great move for troubleshooting depth, but as your math shows, it comes with a significant increase in storage demands. Moving from 4GB to 40GB is a 10x jump, so ensuring your volume can handle the growth is critical.

Here is the breakdown of the calculation and the step-by-step guide to applying these changes.

📊 Syslog Storage Planning

Before modifying configuration files, verify your available disk space. Using your specific requirements for 100 hosts:

VariableCurrent SettingDesired Setting
Max Log Size2 MB10 MB
Rotation Count20 Files40 Files
Retention per Host40 MB400 MB
Total Storage (100 Hosts)4,000 MB (4GB)40,000 MB (40GB)

⚠️ A Note on Scalability

While you are planning for 100 hosts, keep in mind that the VMware Syslog Collector for Windows is officially supported for up to 30 hosts.

  • The Risk: Beyond 30 hosts, the service may stop responding or drop logs without an error message.
  • The Fix: If you need to support 100 hosts reliably, consider deploying multiple collectors or moving to a high-scale solution like VMware vRealize Log Insight.

🛠️ How to Modify Syslog Collector Configuration

To apply your new 10MB / 40 Rotate policy, you must manually edit the configuration XML.

1. Locate and Backup

Before editing, create a copy of the configuration file.

  • vCenter 6.0: %PROGRAMDATA%\VMware\vCenterServer\cfg\vmsyslogcollector\config.xml
  • vCenter 5.5 & older: %PROGRAMDATA%\VMware\VMware Syslog Collector\vmconfig-syslog.xml

2. Edit the XML

Open the copy in a text editor (like Notepad++) and locate the <defaultValues> section. Update the values as follows:

XML
<defaultValues>
    <port>514</port>
    <protocol>TCP,UDP</protocol>
    <maxSize>10</maxSize>
    <rotate>40</rotate>
    <sslPort>1514</sslPort>
</defaultValues>

3. Swap and Restart

  1. Stop the Service: Open services.msc and stop the VMware Syslog Collector.
  2. Replace File: Delete the original config.xml and rename your modified copy to the original filename.
  3. Start the Service: Restart the VMware Syslog Collector.

Lazy Admin Tip: If the logs don’t start flowing immediately, you may need to restart the syslog service on the ESXi hosts themselves to re-establish the connection to the server.

#VMware #vSphere #Syslog #DataCenter #Storage #SysAdmin #ITPro #Virtualization #LogManagement #LazyAdmin #TechGuide

This entry was posted in VMware, Windows and tagged , , , , , , , .

How to Restart Management Agents on an ESXi Host?

Posted on Updated on

When an ESXi host appears as “Not Responding” in vCenter, or the Web Client becomes sluggish, you don’t always need to reboot the entire server. Often, simply restarting the Management Agents (hostd and vpxa) will restore connectivity without interrupting your running Virtual Machines.

Method 1: Using the Direct Console User Interface (DCUI)

If you have physical access to the server or a remote management console (like iDRAC, ILO, or IPMI), this is the safest method.

  1. Connect to your ESXi host console and press F2 to customize the system.
  2. Log in as root.
  3. Navigate to Troubleshooting Options using the arrow keys.
  4. Select Restart Management Agents.
  5. Press Enter, then press F11 to confirm the restart.
  6. Once finished, press Esc to log out.

Method 2: Using SSH or Local Shell

If SSH is enabled, you can restart the specific agents individually. This is the preferred “Lazy Admin” method as it provides granular control.

For ESXi 5.x, 6.x, and 7.x/8.x: Run these two commands to restart the host agent and the vCenter agent:

Bash

/etc/init.d/hostd restart
/etc/init.d/vpxa restart

For legacy ESXi 4.x:

Bash

/etc/init.d/hostd restart
service vmware-vpxa restart

Method 3: The “Nuclear” Option (services.sh)

If the individual agent restarts don’t work, you can restart all management services on the host.

Command:

Bash

services.sh restart

⚠️ CRITICAL CAUTION

If LACP is enabled on your Distributed Virtual Switch (DVS), do not use services.sh restart. Doing so can disrupt network connectivity. Instead, restart independent services or schedule a maintenance window.

Method 4: Resetting the Management Network

Sometimes the issue isn’t the agent, but the VMkernel interface itself. You can bounce the management interface (usually vmk0) with this one-liner:

Bash

esxcli network ip interface set -e false -i vmk0; esxcli network ip interface set -e true -i vmk0

The semicolon ensures the interface comes back up immediately after being disabled.

#VMware #ESXi #vSphere #SysAdmin #ITPro #Virtualization #Troubleshooting #LazyAdmin #DataCenter #TechTips #CloudAdmin

This entry was posted in VMware and tagged , , , , , , , , , .