Windows Server
RDP Rescue: How to Fix Remote Desktop Issues Without a Reboot | Lazy Admin Blog
If you can reach a server via ping or the VM console but RDP is failing, you can often “kick-start” the service by toggling specific registry keys. This forces the Terminal Services stack to re-read its configuration without dropping the entire OS.
1. The Firewall Check
Before diving into the registry, ensure the Windows Firewall isn’t blocking Port 3389. If you have console access, try disabling it temporarily to rule it out.
- Quick Command:
netsh advfirewall set allprofiles state off
2. The “Deny” Toggle (The Most Common Fix)
Sometimes the registry says RDP is allowed, but the service isn’t honoring it. Toggling the value can reset the listener.
Path: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server
- fDenyTSConnection: Should be 0. (If it’s already 0, change it to 1, refresh, then back to 0).
- fAllowToGetHelp: Should be 0 to ensure Remote Assistance isn’t conflicting.
3. WinStation Listeners (RDP & Citrix)
If the main switch is on but the specific “listener” is disabled, you’ll get a “Connection Refused” error.
For Standard RDP: Path: HKLM\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp
- fEnableWinStation: Must be 1. Toggle this (1 -> 0 -> 1) to reset the listener.
For Citrix Servers (ICA): Path: HKLM\System\CurrentControlSet\Control\TerminalServer\WinStations\ICA-Tcp
- fEnableWinStation: Must be 1.
4. Port Verification
Ensure the server is actually listening on the standard port. If someone changed the RDP port for “security,” your connection will fail.
Path: HKLM\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp
- PortNumber: Should be 3389 (Decimal).
Test it from your workstation: tnc <ServerIP> -port 3389 (PowerShell) or telnet <ServerIP> 3389
5. The Winlogon Block
In rare cases, the entire Winlogon station for terminal services is disabled at the software level.
Path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- WinStationsDisabled: Must be 0. If set to 1, no one can log in via RDP regardless of other settings.
Lazy Admin Tip 💡
If you can’t get to the console, you can change these registry keys remotely from your workstation! Open Regedit, go to File > Connect Network Registry, and enter the target server’s name. You can perform all the toggles mentioned above without ever leaving your desk.
#WindowsServer #RDP #SysAdmin #Troubleshooting #ITOps #TechTips #Networking #RemoteDesktop #LazyAdmin #ServerManagement
Master the Forest: Top Active Directory Interview Questions & Answers | Lazy Admin Blog
Part 1: The Logical vs. Physical Structure
Understanding how AD is organized is the first step in mastering the service. Interviewers often look for the distinction between how objects are managed (logical) and how traffic flows (physical).
Logical Components
These define the administrative boundaries and hierarchy:
- Forest: The uppermost boundary. It contains one or more trees that share a common schema and global catalog.
- Tree: A collection of domains that share a contiguous namespace (e.g.,
corp.comanddev.corp.com). - Domain: The primary unit of replication and security. All objects in a domain share a common database (
ntds.dit). - Organizational Unit (OU): Containers used to organize objects within a domain. OUs are primarily used to delegate administration and apply Group Policy.
Physical Components
These define how AD exists on hardware and over the network:
- Domain Controllers (DC): The servers that host the AD database and handle authentication.
- Sites: A grouping of IP subnets connected by high-speed links. Sites are used to control replication traffic and ensure users log on to a local DC rather than one across a slow WAN link.
Part 2: The Core “Under the Hood” Mechanics
The Active Directory Database
The database is stored in %systemroot%\ntds as ntds.dit. Key files include:
- edb.log: Transaction logs (changes are written here first).
- res1.log / res2.log: Reserve logs to ensure the system can write to disk if space runs out.
- edb.chk: The checkpoint file that tracks which transactions have been committed to the database.
The Global Catalog (GC)
The GC is a partial, read-only replica of every object in the forest. It allows users to search for resources (like a printer in another domain) without needing to query every single DC in the forest.
SYSVOL Folder
The SYSVOL folder is a shared directory on every DC that stores the domain’s public files, including:
- Login scripts (Netlogon share).
- Group Policy Templates.
- It is kept in sync across all DCs using the File Replication Service (FRS) or DFSR.
Part 3: Protocols and Naming
LDAP (Lightweight Directory Access Protocol)
LDAP is the language used to talk to Active Directory. It follows the X.500 standard and uses TCP/IP.
- Distinguished Name (DN): The full path to an object (e.g.,
CN=JohnDoe,OU=Sales,DC=corp,DC=com). - Relative Distinguished Name (RDN): Just the object’s name (e.g.,
JohnDoe). - UPN (User Principal Name): The “email-style” login name (e.g.,
johndoe@corp.com).
Part 4: Essential Admin Tools
| Tool | Purpose |
| ADSIEdit | A low-level “registry editor” for Active Directory objects and attributes. |
| LDP | A tool for performing LDAP searches and operations manually. |
| Repadmin | The go-to command-line tool for diagnosing replication health. |
| Netdom | Used for managing trust relationships and joining computers to domains via CLI. |
| Dcpromo | (Legacy) The command to promote or demote a Domain Controller. |
Common Interview Scenario: “My Replication is Broken”
Answer: I would start by checking connectivity between sites. Then, I would use repadmin /showrepl to see which naming contexts (Domain, Configuration, or Schema) are failing. I’d also check the DNS SRV records to ensure the DCs can find each other.
#ActiveDirectory #SysAdmin #WindowsServer #ITJobs #TechInterview #Microsoft #Networking #ITOps #LazyAdmin
Configuring Cisco NIC Teaming on UCS B200-M3
For Windows-based Cisco UCS B-Series blades, native teaming is often handled via the Cisco-specific driver contained in the UCS Windows Utilities ISO. Here is how to install and manage teams via the Command Line Interface (CLI).
Prerequisites
- Download the Windows Utilities ISO from Cisco.com.
- Choose either the B-Series Blade or C-Series Rack-Mount software bundle.
- Ensure you have Administrator privileges on the Windows target.
Phase 1: Installing the NIC Teaming Driver
The driver is installed using the enictool. You must point it to the directory containing the .inf files from the ISO.
- Open Command Prompt as Administrator.
- Run the following command:DOS
enictool -p "C:\path\to\drivers"Example:C:\> enictool -p "c:\temp"
Phase 2: Creating and Configuring the Team
Once the driver is active, you can group your logical interfaces into a team.
- Identify your connections: Use
ipconfigorncpa.cplto find the exact names (e.g., “Local Area Connection”). - Create the Team:DOS
enictool -c "Connection 1" "Connection 2" -m [mode]
Mode Reference Table
| Mode ID | Description | Best Use Case |
| 1 | Active-Backup | Basic redundancy; one link stays idle. |
| 2 | Active-Backup (Failback) | Redundancy; always reverts to the primary link when healthy. |
| 3 | Active-Active | Transmit Load Balancing; uses both links for outgoing traffic. |
| 4 | 802.3ad LACP | Link Aggregation; requires specific configuration on the Fabric Interconnect/Switch. |
Example (Active-Backup):
C:\> enictool -c "Local Area Connection" "Local Area Connection 2" -m 1
Phase 3: Management Commands
- To Delete a Team:
C:\> enictool -d "Local Area Connection" "Local Area Connection 2" - To View All Options:
C:\> enictool /?(Use this to fine-tune Load Balancing hash methods and advanced failover settings.)
#CiscoUCS #NICTeaming #SysAdmin #DataCenter #Networking #WindowsServer #TechTutorial #LazyAdmin #ServerAdmin #Infrastructure
How to Patch Air-Gapped Windows Servers using WSUS Offline
Patching servers in an offline or “air-gapped” environment is a common challenge for SysAdmins. While Microsoft’s official WSUS role typically requires a network connection, the third-party tool WSUS Offline Update allows you to “bring the internet to the server” via a USB stick or DVD.
When to use this method?
This is an ideal solution for a one-time update or for small environments where setting up a complex, multi-tier WSUS architecture isn’t practical.
Note: This requires a “bridge” machine—a computer with internet access where you will build the update repository before moving it to the offline server.
Phase 1: Creating the Update Media (On the Online Machine)
- Download the Tool: Head to wsusoffline.net and download the latest version.
- Extract and Launch: Extract the ZIP file and run
UpdateGenerator.exe. - Select Your OS: Check the boxes for the operating systems you need to patch (e.g., Windows Server 2016, 2019, or legacy versions like 2008 R2).
- Download: Click Start. The tool will download all missing patches from Microsoft’s servers into a local folder.
- Size Tip: Expect downloads to range from 800MB to several GBs depending on the OS version.
- Transfer: Copy the entire
wsusofflinefolder to your removable media (USB Drive, External HDD, or burn it to a DVD).
Phase 2: Patching the Offline Server
- Insert Media: Plug your USB drive into the offline server.
- Navigate to Client: Open the
wsusofflinefolder, then open the “client” subfolder. - Run Installer: Execute
UpdateInstaller.exe. - Configure & Start: Select your desired options (like “Automatic reboot and recall”) and click Start.
The tool will now simulate a local Windows Update session, installing all the downloaded patches without ever needing a NIC connection.
#WSUS #AirGapped #SysAdmin #WindowsServer #CyberSecurity #ITAdmin #TechTips #OfflinePatching #LazyAdmin #ServerMaintenance
Troubleshooting Persistent AD Account Lockouts
We’ve all been there: a user’s Active Directory account keeps locking out every 5 minutes, even after a password reset. Finding the “ghost in the machine” can be a nightmare. Here are the most common culprits and how to kill them.
1. The 90% Culprit: Mobile Devices & ActiveSync
In nearly 90% of cases, the culprit is an old smartphone or tablet.
- The Scenario: The user changed their AD password on their PC, but their iPad at home is still trying to sync mail using the old password. After a few failed attempts, the account locks.
- The Fix: Have the user update the password on all mobile devices or temporarily turn off Wi-Fi on those devices to see if the lockouts stop.
2. Windows Credential Manager
Windows loves to “help” by caching credentials for printers, file shares, and SharePoint sites.
- The Fix: Go to Control Panel > User Accounts > Credential Manager. Under Windows Credentials, look for any entries related to the domain or internal web portals and remove them.
3. Stored Passwords (The Legacy Method)
Sometimes the GUI Credential Manager doesn’t show everything. You can access the legacy stored usernames and passwords directly:
- The Fix: Open a Run box (Win+R) and type:
rundll32.exe keymgr.dll, KRShowKeyMgr - Delete any stored passwords that look suspicious or outdated.
4. Background Applications & Web Services
Third-party tools, browser plugins, or internal HR portals often store AD credentials.
- The Scenario: A user opens Internet Explorer, and a background tool immediately attempts to authenticate.
- The Fix: Check the user’s “Startup” tab in Task Manager and disable non-essential third-party apps.
5. Advanced Diagnostics: LockoutStatus & ADLockouts
If the manual checks fail, you need to find out which Domain Controller is reporting the lockout.
- LockOutStatus: This tool from Microsoft’s Windows Server Resource Kit shows the lockout status across all DCs and identifies the “Source” machine.
- Netwrix Account Lockout Examiner: A great free alternative that often points directly to the process name causing the issue.
![lockoutstatus[1]](https://i0.wp.com/lazyadminblog.com/wp-content/uploads/2015/04/lockoutstatus1.jpg?ssl=1)
#ActiveDirectory #SysAdmin #ITPro #AccountLockout #WindowsServer #TechSupport #DataCenter #LazyAdmin #ExchangeServer #CyberSecurity
Mastering DsQuery: Fast Domain Controller Auditing
Using the GUI to find specific servers in a large forest can be time-consuming. DsQuery Server provides a lightning-fast way to extract this data directly from the Command Prompt. Whether you need a list of Global Catalogs or want to find the Schema Master, these commands will save you hours of clicking.
1. Locating Domain Controllers in the Forest
To get a quick list of every DC across all domains in your entire forest, you can use the -Forest switch.
- To get the full Distinguished Name (DN):
DsQuery Server -Forest - To get just the Relative Distinguished Name (RDN):
DsQuery Server -o rdn -Forest
2. Targeting a Specific Domain
If you only want to see the controllers within a specific domain, use the -domain switch: DsQuery Server -domain lazyadminblog.com
3. Finding Global Catalog (GC) Servers
Global Catalogs are vital for forest-wide searches. To find which DCs in a specific domain are configured as GCs: DsQuery Server -domain lazyadminblog.com -isgc
4. Finding FSMO Role Holders
Instead of opening multiple MMC snap-ins, you can find the FSMO role holders directly. For example, to find the server holding the Schema Master role for the forest: DsQuery Server -Forest -hasfsmo schema
Note: You can replace
schemawithnaming,pdc,rid, orinfrastructureto find other role holders.
5. Exporting your Results
The most useful way to use DsQuery is to pipe the results into a text file for documentation or further scripting. Use the > operator to save your output: DsQuery Server -Forest > C:\Logs\AllDCs.txt
#ActiveDirectory #DsQuery #SysAdmin #WindowsServer #ITPro #CodingAdmin #ServerAudit #LazyAdmin #TechTips #DataCenter
LDIFDE vs. CSVDE: How to Export Active Directory Data
Exporting Active Directory objects doesn’t require complex scripts. Windows includes built-in tools to handle this via the command line. Choosing between them depends on what you plan to do with the data.
1. LDIFDE (LDAP Data Interchange Format)
Best for: Migrations and bulk modifications.
LDIFDE exports data in the .ldf format. This format is superior for importing data back into AD because it can handle operations like add, modify, and delete.
Command Syntax:
DOS
ldifde -f Exportuser.ldf -s ADservername -d "CN=username,CN=Users,DC=domain,DC=com"- -f: The filename for the export.
- -s: The source Active Directory server.
- -d: The Distinguished Name (DN) of the root search point.
2. CSVDE (Comma Separated Value)
Best for: Reporting and Excel analysis.
CSVDE exports data into a standard CSV format. This is perfect if you need to create a spreadsheet of user attributes for a manager or an audit. Note that CSVDE cannot be used to modify existing objects; it only supports “Add” operations during an import.
Advanced Export Command:
This command filters for specific objects with mailboxes and pulls a massive list of attributes (Name, Company, Title, Phone, etc.):
DOS
csvde -m -f Mailboxes.csv -d "OU=Users,DC=domain,DC=com" -r "(&(objectClass=user)(mail=*))" -l "objectClass,displayName,memberOf,proxyAddresses,title,telephoneNumber,company,userPrincipalName,sAMAccountName"- -m: Omits binary attributes (like objectGUID) that aren’t readable in text.
- -r: The LDAP filter (e.g., only users with an email address).
- -l: The list of specific attributes you want to include in the columns.
Comparison Table: Which should you use?
| Feature | LDIFDE | CSVDE |
| Output Format | Plain Text (.ldf) | Comma Separated (.csv) |
| Best Use | Modifying/Moving Objects | Reporting / Spreadsheet Analysis |
| Readability | Harder for humans | Very easy (Excel) |
| Import Support | Add, Modify, Delete | Add only |
The LazyAdmin Tip: Always use the -m switch with CSVDE. If you don’t, your CSV file will be filled with unreadable binary strings for attributes like user certificates or SID history, making it almost impossible to use in Excel!
#ActiveDirectory #SysAdmin #ITPro #DataExport #WindowsServer #CSVDE #LDIFDE #LazyAdmin #TechTips #ServerManagement
How to Enable Remote Logins in a Windows server
🛠️ The Registry Method (Headless Activation)
By default, Windows Server hardens itself by denying Terminal Server (TS) connections. You can flip this switch manually in the Registry Editor.
- Open Registry Editor: Press
Win + R, typeregedit, and hit Enter. - Navigate to the Key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\ - Modify the Value: Locate the fDenyTSConnections DWORD.
- Value = 1: Remote Desktop is Disabled (Default).
- Value = 0: Remote Desktop is Enabled.
💻 The PowerShell Method (The Modern Way)
If you have PowerShell Remoting enabled, you don’t even need to open a GUI. You can push this change with a single line of code:
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0To verify the change:
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections"🛡️ Important: Don’t Forget the Firewall!
Enabling the registry setting is only half the battle. If the Windows Firewall is active, it will still block port 3389. You must allow the RDP traffic:
Via PowerShell:
PowerShell
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"⚠️ Security Checklist
- NLA (Network Level Authentication): For modern security, ensure the value
UserAuthenticationin the same registry path is set to1. This requires users to authenticate before a session is even created. - Permissions: Simply enabling the service isn’t enough; the user account must be part of the Remote Desktop Users group or have Administrative privileges.
- BlueKeep & Vulnerabilities: Ensure your server is fully patched if you are exposing RDP, as unpatched legacy servers are prime targets for ransomware.
#WindowsServer #RDP #RemoteDesktop #SysAdmin #ITPro #PowerShell #RegistryHacks #LazyAdmin #TechTips #ServerSecurity
Understanding Processor Queue Length
In simple terms, Processor Queue Length is the “waiting room” for your CPU. It represents the number of threads that are ready to be processed but are currently stuck waiting because the CPU is already busy handling other tasks.
🚦 The Core Concept: Threads in Waiting
Every action on your server—whether it’s a database query or a system background task—is broken down into threads. The CPU can only handle a certain number of threads at once. When more threads arrive than the CPU can handle, they line up in the Processor Queue.
📉 Identifying a Bottleneck
A high CPU utilization percentage (e.g., 90%) doesn’t always mean there is a problem. The true indicator of a performance bottleneck is a sustained or recurring queue.
- The Golden Rule: A sustained queue of more than two threads per processor is a clear symptom of a bottleneck.
- The Exception: Queues can develop even when CPU utilization is below 90% if the requests are random and the processing time for each thread varies wildly.
🔍 How to Troubleshoot a High Queue
If you notice frequent queueing, you need to dig into the specific processes causing the backup.
- Check % Processor Time: Identify which specific processes are eating up CPU cycles.
- Monitor Thread Patterns: Use Performance Monitor (PerfMon) to see if a single process is spawning too many threads.
- Evaluate Priorities: Check if certain low-priority tasks are holding up high-priority ones. While you can adjust base priorities in Task Manager, this is usually a “band-aid” fix, not a permanent solution.
🖥️ Multiprocessor Systems: Calculating the Limit
The acceptable queue length scales with your hardware. To find your target range, multiply your number of physical processors (or cores) by the thread threshold.
| System Type | Typical Usage (0–10% CPU) | Busy System (80–90% CPU) |
| Single Processor | 0 to 1 threads | 1 to 3 threads |
| Dual Processor | 0 to 1 threads | 2 to 6 threads |
| Quad Processor | 0 to 1 threads | 4 to 12 threads |
Note: For servers, also keep an eye on the Server Work Queues\Queue Length counter, which specifically tracks requests waiting for the server service.
#WindowsServer #SysAdmin #PerformanceTuning #ITPro #TechTips #CPU #DataCenter #ServerManagement #LazyAdmin #PerfMon
- ← Previous
- 1
- 2