Monday, August 21, 2017

How to use Portqry to troubleshoot Active Directory connectivity issues

Summary

Portqry is a command-line utility that you can use to help troubleshoot TCP/IP connectivity issues. The utility reports the port status of target Transition Control Protocol (TCP) and User Datagram Protocol (UDP) ports on a remote computer. You can run Portqry on Windows Server 2003, Windows 2000, and Windows XP.

You can also use Portqry in the following ways: 
  • To troubleshoot Active Directory issues in which you have to verify basic TCP/IP connectivity. This can be especially useful in environments with firewalls.
  • To verify connectivity to TCP/IP ports that are used by Active Directory for Lightweight Directory Access Protocol (LDAP), remote procedure call (RPC), and Domain Name Service (DNS).
Note Version 2 of Portqry.exe is now available. The Microsoft Download Center link at the end of this article has been updated to reflect the new version. Version 1.0 of Portqry.exe has been removed from the Microsoft Download Center.

Overview

Portqry reports the status of a port in one of three ways: 
  • Listening: A process is listening on the target port on the target system. Portqry received a response from the port.
  • Not Listening: No process is listening on the target port on the target system. Portqry received an Internet Control Message Protocol (ICMP) "Destination Unreachable - Port Unreachable" message back from the target UDP port. Or, if the target port is a TCP port, Portqry received a TCP acknowledgement packet with the Reset flag set.
  • Filtered: The target port on the target system is being filtered. Portqry did not receive a response from the target port. A process may or may not be listening on the port. By default, TCP ports are queried three times and UDP ports are queried one time before reporting the target port is filtered.
With Portqry, you can also query an LDAP service. It knows how to send an LDAP query (by using UDP and TCP) and interpret an LDAP server's response to the query. The response from the LDAP server is parsed, formatted, and returned to the user.

Example 1

When you run the following command
portqry -n myserver -p udp -e 389
Portqry automatically resolves UDP port 389 using the %SystemRoot%\System32\Drivers\...\Services file that every Windows Server 2003 computer has by default. If it resolves the port to the LDAP service, it sends an unformatted user datagram to UDP port 389 on the target system. Portqry will not receive a response from the port, because the LDAP service only responds to a correctly formatted LDAP query. Portqry will report that the port is listening or filtered. Portqry will then send a correctly formatted LDAP query to UDP port 389. If it receives a response to the query, it returns the whole response to the user and reports that the port is listening. If portqry does not receive a response to the query, it reports that the port is filtered. 

Sample Output
C:\>portqry -n mydc.reskit.com -e 389 -p udp 
 
Querying target system called: 
 
mydc.reskit.com 
 
Attempting to resolve name to IP address... 
 
Name resolved to 169.254.0.14 
 
UDP port 389 (unknown service): LISTENING or FILTERED 
 
Sending LDAP query to UDP port 389... 
 
LDAP query response: 
 
currentdate: 10/11/2001 23:10:21 (unadjusted GMT) 
subschemaSubentry: 
CN=Aggregate,CN=Schema,CN=Configuration,DC=reskit,DC=com 
dsServiceName: CN=NTDS  
Settings,CN=mydc,CN=Servers,CN=eu,CN=Sites,CN
=Configuration,DC=reskit,DC=com 
namingContexts: DC=reskit,DC=com 
defaultNamingContext: DC=reskit,DC=com 
schemaNamingContext: 
CN=Schema,CN=Configuration,DC=reskit,DC=com 
configurationNamingContext: 
CN=Configuration,DC=reskit,DC=com 
rootDomainNamingContext: DC=reskit,DC=com 
supportedControl: 1.2.840.113556.1.4.319 
supportedLDAPVersion: 3 
supportedLDAPPolicies: MaxPoolThreads 
highestCommittedUSN: 815431405 
supportedSASLMechanisms: GSSAPI 
dnsHostName: MYDC.reskit.com 
ldapServiceName: reskit.com:mydc$@RESKIT.COM 
serverName:  
CN=MYDC,CN=Servers,CN=EU,CN=Sites,CN=Configuration,DC=reskit,DC=com 
supportedCapabilities: 1.2.840.113556.1.4.800 
isSynchronized: TRUE 
isGlobalCatalogReady: TRUE 
 
======== End of LDAP query response ======== 
UDP port 389 is LISTENING
In this sample, port 389 is listening and from the output it can be determined which LDAP service is listening on the port and some details about its configuration. This information may also be useful in troubleshooting various problems.

Be aware that the LDAP test over UDP may not work against domain controllers that are running Windows Server 2008. One reason for this can be that you have disabled IPv6 on the Domain Controller. To re-enable IPv6, set the value discussed in the article below to the default of "0":

929852 How to disable certain Internet Protocol version 6 (IPv6) components in Windows Vista, Windows 7 and Windows Server 2008
http://support.microsoft.com/default.aspx?scid=kb;EN-US;929852

If Portqry is not available to you for this UDP port 389 test, you can perform the same test using LDP.EXE when you connect to the Domain Controller on port 389 with "Connectionless" check box activated.

Another alternative to portqry is NLTEST, but it does not work for arbitrary servers. The server needs to be a Domain Controller in the same domain as the machine you run the tool on. If this is the case, you can use Nltest /sc_reset < domain name >\< computer name > to force a security channel onto a particular domain controller. For more information, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/library/cc961803.aspx
Portqry knows how to send a query to the RPC end point mapper (using UDP and TCP) and interpret the response. This query will dump all the end points currently registered with the RPC end point mapper. The response from the end point mapper is parsed, formatted, and returned to the user.

Example 2

When you run the following command
portqry -n mydc.reskit.com -p udp -e 135
Sample Output
Querying target system called: 
 
mydc.reskit.com 
 
Attempting to resolve name to IP address... 
 
Name resolved to 169.254.0.18 
 
UDP port 135 (epmap service): LISTENING or FILTERED 
Querying Endpoint Mapper Database... 
Server's response: 
 
UUID: ecec0d70-a603-11d0-96b1-00a0c91ece30 NTDS Backup Interface
ncacn_np:\\\\MYDC[\\PIPE\\lsass] 
 
UUID: 16e0cf3a-a604-11d0-96b1-00a0c91ece30 NTDS Restore Interface
ncacn_np:\\\\MYDC[\\PIPE\\lsass] 
 
UUID: e3514235-4b06-11d1-ab04-00c04fc2dcd2 MS NT Directory DRS Interface
ncacn_ip_tcp:169.254.0.18[1027] 
 
UUID: f5cc59b4-4264-101a-8c59-08002b2f8426 NtFrs Service
ncacn_ip_tcp:169.254.0.18[1130] 
 
UUID: d049b186-814f-11d1-9a3c-00c04fc9b232 NtFrs API
ncacn_ip_tcp:169.254.0.18[1130] 
 
UUID: d049b186-814f-11d1-9a3c-00c04fc9b232 NtFrs API
ncacn_np:\\\\MYDC[\\pipe\\00000580.000] 
 
Total endpoints found: 6 
 
==== End of RPC Endpoint Mapper query response ==== 
 
UDP port 135 is LISTENING
In this example, port 135 is listening. From the output, it can be determined which services or applications have been registered with the target server's RPC end point mapper database. The output includes each application's Universally Unique Identifier (UUID), annotated name (if one exists), the protocol the application uses, the network address that the application is bound to, and the application's end point (port number, named pipe in square brackets). This information may also be useful in troubleshooting various problems. 

Portqry can send a correctly formatted DNS query (using UDP or TCP). The utility will send a DNS query for "portqry.microsoft.com." Portqry then waits for a response from the target DNS server. Whether the DNS response to the query is negative or positive is irrelevant, because any response indicates that the port is listening.

Download Portqry.exe

Portqry.exe is available for download from the Microsoft Download Center. To download Portqry.exe, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?familyid=89811747-C74B-4638-A2D5-AC828BDC6983&displaylang=en
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

Important The PortQueryUI tool provides a graphical user interface and is available for download. PortQueryUI has several features that can make using PortQry easier. To obtain the PortQueryUI tool, visit the following Microsoft Web site:
http://download.microsoft.com/download/3/f/4/3f4c6a54-65f0-4164-bdec-a3411ba24d3a/PortQryUI.exe
Posted by at No comments:

Friday, August 4, 2017

DEPLOY TS USING USER DRIVEN INSTALLATION

UDI – User driven installation is a brilliant component and feature that comes as part of the Microsoft Deployment Toolkit (MDT), I have many system center guys around the world that are not familiar with MDI, thereby I decided to write this article and brief you about MDT possibilities, and later on you’re going to see how to deploy it.
  • It’s going to be long article consider to bring a water and delicious snack and have an enjoyable reading.
UDI wizard allows us to produce wizard pre deploying a task sequence completely, you have the ability to allow to your guys who deploy the task sequences to select what OU the computer will be assigned, which software and application does he want to install, what time zone, BitLocker, languages, printers, and even you can create a custom page, it ups to you, whatever you plan and decide will show up on UDI wizard,try to think about that, these steps saving time, Office installation, Office languages, R&D tools, and anything you are installing post image deployment.
You can download it from the following URLs:
Microsoft Deployment Toolkit 2012 Update 1:
https://technet.microsoft.com/en-us/library/ee376932.aspx?f=255&MSPPError=-2147217396
Microsoft Deployment Toolkit (MDT) 2013 Update 2:
https://www.microsoft.com/en-us/download/details.aspx?id=50407
As soon as you installed it, search for “Configure ConfigMgr Integration” and Integrate MDT with your ConfigMgr:
Great, now we have to create the “MDT Task sequence”:
Client Task Sequence:
Choose WIndows Settings either Workgroup or Join
This task sequence will never be used to capture an image:
Specify “Boot Image” and path for MDT Package, we need to access to this package:
Continue with OS image, Image details, install Source and so on:
  • Important, select the “User-Driven Installation”:
  • As you can read and understand, the first option won’t let you select application during TS deployments contrary to the second one which allows you to select installations options
New path for “Custom settings” package, we need this as well, we have to change some default parameters later:
If you get an error about permission denied you most likely should grant to everyone access [Share Permission] to the folder that contains the MDT content.
Distribute MDT Package and Custom Settings to your DP.
First, we should find the “MDT Package” and then edit it, open the UDI from your windows and open the “UDIWizrd_Config.XML” file:
  • I would suggest copying this files for a missing or corruption case
  • As you can see, by default it comes with 3 stage group > New Computer, Refresh and Replace, Remove refresh page and Replace page.
Now wait:
Before we proceed, create a new collection and don’t add any SYSTEM or USER, intentionally, it supposes to be an empty collection and then we deploy to the collection any software and application we would like will be available in a selection list on UDI:
– Ensure you are enabling the “Allow this program to be installed from the Install Software task sequence without being advertised” (Package >Programs ) and “Allow this application to be installed from the install application task sequence action without being deployed” on (On Application properties – General Information), look below the figures:
Package – Under Programs:
Deploy the packages and applications to UDI Collection (As Available, No wake-up, No schedule, and No maintenance windows):
Assign the UDI to the empty collection you have been created,
Application Collection: “UDI Deployment“:
Add application and packages to the “Software list“:
Package:
Select the search button and you will get all available packages you’ve deployed to the particular collection:
Application:
Prepare a list, with Office versions, browsers, tools, domestic tools, anything you want, eventually it will look like this:
  • If your applications are marked as grayed-out it means that you haven’t allowed them to be deployed into TS- scroll up and allow it.
Under Computer details you can add your AD domain and let to a user who deploys the computer to select OU, you just have to add all OU’s:
udi-ou_selection
Set Local Administrator, User Account and password text box:
Volume settings:
BTW, you can also allow Bit-locker option during image deployments.
  • “Unlocked” bottom means that if you set it as lock use can’t change this value during deployment.
Once you finish with that, please save the file and go to SCCM and update your DP’s about some changes you have done:
Before distributing “Custom Settings” as well, open the file and skip some settings that you would like to:
Update this package to your DP as well.
That’s all guys, yeah it was long, but worth it, you can take it to different ideas, customize own pages, for example,
At my last company we have been several branches over the world, each site with local language, time zone, keyboard, applications, so it was perfect for them, they could customize settings for them and as user requirements.


Reference Link : http://pelegit.co.il/deploy-ts-using-user-driven-installation/
Posted by at 1 comment:

Wednesday, August 2, 2017

Use PowerShell to find unmanaged computers


The Issue

So like many companies out there, there can be many computers in your SCCM database and Active Directory that are one or more of the following:
  • Stale AD Object
  • Non standard computer name (likely meaning it wasn’t built with your awesome automation)
  • Sitting on the Computers container in AD (also likely meaning it wasn’t built with your awesome automation)
  • Inactive or non-existent SCCM client
When looking through your SCCM database or reviewing AD Users and Computers it’s not readily apparent which computers are still legitimate and should be being managed by SCCM.  I have written PowerShell scripts in the past that review AD on a schedule and take action like moving an object into a “Stale” OU for future deletion, or simply emailing the list of stale machines to an Admin to take action.  Today’s script is a seek and report script only but could easily be modified to take any actions you wish once you find the machines that are not being managed.

A Solution

I created a PowerShell script that will look at both AD and SCCM to find machines we are deeming “unmanaged”, gather additional data about the computer, including trying to find out who the last logged on user is and if they are actively logged on, formatting the data and dumping it into 2 difference CSV files.  All objects are crossed referenced from AD and SCCM to gather as much data as we can.  Lastly it generates an HTML report with 2 tables containing said data, then emails this report along with the CSV attachments to the person or DL you wish to notify.

Note: This script was written to run on the SCCM Primary Site server however it could be run remotely using a PSSession, or on a machine that has the SCCM Admin console installed (not tested but should work).

The first thing you will need to do is create a new collection if you don’t already have one that contains all SCCM Computer objects that do not have a client.  Hopefully you already have one as you continue to strive for 100% client saturation, but if not, here’s a Collection query you can use:
The last line of that query is useful when you have non-Windows OS devices like Intune MDM objects. 🙂

Once you have your Collection you will need the Collection ID as a script parameter so make note of it.  You can simply go to the properties of the collection and its right there on the General tab.

Next, save the content at the bottom of this post as a PowerShell script then execute it with the required parameters using an account that has at least Read permissions to SCCM Computer objects, and local Admin permissions to the remote computers/servers.  * The admin permissions are used when trying to connect to the remote machine to find the last logged on user information.

Here’s what an example of the report looks like.  As mentioned above we have split the report in two.  One table/CSV for Stale unmanaged objects, and one for Recent unmanaged objects.  Basically just the two sides of the number of days you choose to look for.

Source from : http://model-technology.com/use-powershell-to-find-unmanaged-computers/


The Stale table:


And underneath that the Recent table:


We have found this to be incredibly helpful in tracking down machines that should be managed and are not, and machines that need to be cleaned up in AD and/or SCCM.

As always you should run this script first in a lab environment before executing in production.  And as always, no warranty is granted for the outcome of this script.  Use at your own will. 🙂

Without further ado, here’s the PowerShell.  If you grab this script and make it better (there’s always a better way) then please drop me a line at william.bracken@model-technology.com. Would love to see any evolutions!

Posted by at No comments:
Subscribe to: Posts (Atom)