Learn Networking

Deploy Unattended XP Using WDS Server

Hello Guys!

We Will See how to deploy unattained XP using WDS server

Requirements:
Windows Server 2003 or 2008 (Domain Controller, DNS, DHCP, WDS Server)
Windows 7 PE DVD (Windows Automated Installation Kit).
Windows 7 DVD (for Boot.wim file).
Windows XP CD (for Sysprep.exe)
Drivers (I’m demonstrate in VMWare workstation 9.0.1 so I’m gonna need VMware NIC Drivers) .

I’m using Windows 7 PE (Preinstallation Environment) instead of Vista PE or you can use Vista PE, I just want you guys to demonstrate another method of injecting drivers in Image.wim file.

Task to DO
1.    Install and Configure DHCP and WDS server
2.    Install windows 7 PE (Window AIK)
3.    Copy Boot.wim file from Windows 7 DVD located in SOURCES folder.
4.    Inject drivers into Boot.wim file
5.    Add boot.wim on WDS server for Deploying and Capture
6.    Preparing XP installed machine for Unattended Installation.
7.    Configure Client to boot from network card
8.    Capture prepared XP machine image From client and upload to WDS server
9.    Deploy captured XP image from WDS server to client machine

Step 4 - Injecting Drivers into Boot.wim file.
First you need to know how many indexes are contain in boot.wim file.
To get index Information from boot.wim file
Dism.exe /Get-WimInfo /WimFile:C:\Boot.wim

To mount Boot.wim File.
Dism /Mount-Wim /WimFile:C:\Boot.wim /Index:2 /MountDir:C:\Mount

To inject driver
Dism /image:E:\Mount /Add-Driver /Driver:E:\Drivers\vmxnet\win2008\32bit\vmware-nic.inf
Dism /image:E:\Mount /Add-Driver /Driver:E:\Drivers\vmxnet\win2008\32bit\vmxnet.inf
To save changes and unmounts image

Dism /Unmount-Wim /MountDir:E:\Mount /Commit

For More Help Type: Dism /Image:E:\Mount /?
Note: in order to see help first you must mount image.

Step 6 - Preparing XP installed machine for Unattended Installation.

On client machine create a folder in C:\ drive sysprep

Note: Make sure the folder name in drive C:\sysprep

Note: It is highly recommended that you to copy i386 folder from XP CD into C:\sysprep, this action may avoid some issues with the missing files. You can delete i386 folder after unattended installation, or simply add DOS command in answer file, that is “rd /s /q C:\sysprep”.

Step 8 - Capture prepared XP machine image from client and upload to WDS server

There are some problem occurs while you connecting to WDS server, the problem is the Network Card Driver missing in the boot.wim file. We can add the driver in the boot.wim file. Which is I already did or if you don’t want to inject the drivers into boot.wim file. You can load the driver at capturing time simply using “drvload” command. So download the NIC driver for your network card, and put it on floppy, CD/DVD or USB flash drive and start command prompt with pressing Shift+F10, and Load the driver.

E.g. drvload E:\lan_drivers\driver-nic.inf

After driver loading with positive massage, you have to initialize the network service with the command.
That is “wpeutil.exe InitializeNetwork”

Secure DNS dynamic updates from DHCP client

How to Register Secure DNS Dynamic Updates from DHCP client using DNSUpdateProxy-Group on Server 2003 Sp2

Server Side
1. Install DHCP server and Configure
2. Add DHCP Server System and Admin Account into DNSUpdateProxy Security Group

Client Side
1. Obtain an Ip address automatically (don’t forget to turn off XP firewall)
2. ipconfig /release
3. ipconfig /renew
4. ipconfig /registerdns

Server Side
3. Set DNS dynamic updates registration credentials using Netsh.exe command
    a. Netsh
    b. Dhcp server dhcp_server_iIp
    c. Set dnscredentials UserName DomainName Password
    d. Quit
4. ping xp1
5. ipconfig /flushdns
6. ping xp1

How to Rename a Domain Controller

How to rename my Windows 2003 Domain Controllers?

There are 2 methods for performing the rename procedure. One is easier and done through the GUI; the other is more complex and requires the installation of the Windows Server 2003 Support Tools.

Method #1 - Through the GUI

Although easier to implement, if you rename a domain controller through the System Properties dialog box, DNS and Active Directory replication latency may delay the ability of clients to locate or authenticate to the renamed domain controller. The length of this latency depends on your network design and the replication topology of your organization.

Method #2 - By using Netdom.exe

Netdom.exe (Windows Domain Manager) this command-line tool enables renames a domain controller in a Windows Server 2003 domain, and also administrators to manage Windows Server 2003 and Windows 2000 domains and trust relationships from the command line.

Netdom.exe It only requires one reboot of the DC that had its name renamed.

Note: Domain Controllers running Microsoft's Certificate Authority services (CA) can never be renamed.

Important: To rename a domain controller using the Netdom.exe tool, the domain functional level must be set to Windows Server 2003.

You must install the Windows Server 2003 Support Tools. Click here to Download: 2003 Support Tools.

To rename a DC with the name from Server1 in the SAHaseeb.edu domain to Server001 follow the next steps:

Syntax

Open Command Prompt and type:

Netdom Computername Server1.SAHaseeb.edu /Add:Server001.SAHaseeb.edu

You can verify the new name was indeed added to the computer object by viewing it through Adsiedit.msc

msDS-AdditionalDnsHostName:

Ensure the computer account updates and DNS registrations are completed, then type:

2. Netdom Computername Server1.SAHaseeb.edu /Makeprimary:Server001.SAHaseeb.edu

After restart your computer, you can see lists of primary and/or any alternate names.

Open Command Prompt and type:

Netdom Computername Server1.SAHaseeb.edu /Enumerate

Last syntax

3. Netdom Computername Server001.SAHaseeb.edu /Remove:Server1.SAHaseeb.edu

How to implement LimitLogin

Limitlogin V1.0

LimitLogin is an application that adds the ability to limit concurrent user logins in an Active Directory domain.

It can also keep track of all logins information in Active Directory domains.

LimitLogin capabilities include:

* Limiting the number of logins per user from any machine in the domain, including Terminal Server sessions.

* Displaying the logins information of any user in the domain according to a specific criterion (e.g. all the logged-on sessions to a specific client machine or Domain Controller, or all the machines a certain user is currently logged on to).

* Easy management and configuration by integrating to the Active Directory MMC snap-ins.

* Ability to delete and log off user session remotely straight from the Active Directory Users and Computers MMC snap-in.

* Generating Login information reports in CSV (Excel) and XML formats.

Download the LimitLogin: link1 link2

Configuration:

Setting up LimitLogin

Prerequisites

1) Before setting up LimitLogin on the web server, you will need to make sure that ASP.NET is installed on the Windows 2003 server.

2) Make sure the following Web Extension is set to Allowed in IIS Services: ASP.NET v1.1.4322.

Limitlogin setup components

LimitLogin set-up is combined of three different components: IIS (Web Service), Active Directory and Client.

The set-up should be done in this order since there are dependencies between the components.

LimitLogin is set-up through 3 different MSI installers:

LimitLoginIISSetup.msi, which installs the LimitLogin Web Service (WSLimitLogin)
LimitLoginADSetup.msi, that sets up the Active Directory changes needed for LimitLogin to work.
LimitLoginClientSetup.msi, which installs the client-side requirements for LimitLogin.

LimitLoginIISSetup 1:

The 1^st step is to setup up the LimitLogin Web Service and make sure its up and running before we can further continue.

The system requirements for this setup are:

Windows Server 2003 with IIS installed

1) Add WSLimitLogin.asmx to the top of list in the Documents tab of the website.

2) Verify “Integrated Windows Authentication” is set on the “Directory Security” tab of the website under “Authentication and Access Control”.

Note: Web site must integrated authentication not anonymous.

3) Attempt to connect to http://hostname/WSLimitLogin.

LimitLoginADSetup 2:

Once the LimitLogin Web Service is set-up and running, you can continue with running the Active Directory Setup.

The Active Directory Setup portion is divided into 2 main parts:

The Forest Setup (or "forestprep")
The Domain Setup (or "domainprep")

The system requirements for this setup are:

Windows XP with .NET Framework version 1.1 or Windows Server 2003 (Recommended: Windows 2003 Domain Controller)
At least one Windows Server 2003 Domain Controller in the domain

In the 'Installation Options' screen you have 3 options:

'Prepare your Active Directory Forest for LimitLogin' option should run first.
'Prepare your Active Directory Domain for LimitLogin'.
'Install LimitLogin AD MMC add-in tools on this machine' option should run last, after the Forest and Domain preparations have successfully completed

On the first installation, all three check-boxes should be checked.

Prepare your Active Directory Forest for LimitLogin.

This option performs the following operations:

Modifies the Configuration Partition to add the LimitLogin AD MMC integration menus.
Extends the Forest schema to include the LimitLogin Class and Attributes.

Once this step is successfully completed, you may move to prepare you domain to LimitLogin.

Prepare your Active Directory Domain for LimitLogin.

This option performs the following operations:

Creates and configures the llogin.vbs, llogoff.vbs and limitlogin.wsdl files.
Creates an Application Directory Partition for LimitLogin.

In the 'Domain Setup' screen, you need to provide the following three parameters:

UNC path of the file share where the login scripts will go (e.g. \\Servername\Share).

Note: This can be a hidden share).

Host name of the Web server
The LimitLogin Web Service (Default is WSLimitLogin)
Optional Use SSL - check this box if you configured the LimitLogin Web Service to use SSL for greater security.

Install LimitLogin AD MMC add-in tools on this machine

This option should run last, after the Forest and Domain preparations have successfully completed.

You will get a pop-up telling you to copy the llogin.vbs, llogoff.vbs and limitlogin.wsdl files to your share. Copy the files at this time.

LimitLoginClientSetup 2:

In order for the domain clients to work with the LimitLogin server-side components, there are client side requirements that need to be installed on every domain member machine. These requirements are installed using the LimitLoginClientSetup.msi installer.

The client setup installs the following:

SOAP Runtime (needed to connect the Web Service)
WTSApiAx.dll (Needed to collect the Session ID before it is sent to the Web Service)

The system requirements for installing the client for LimitLogin

Client machines must have .NET Framework version 1.1.4322 or higher to install the client.

Click here to download: .NET Framework V1.1.4322

How to implement LimitLogin part2

How to implement SelfSSL for IIS 6.0

What is SSL?

The Secure Socket Layer protocol was created by Netscape to ensure secure transactions between your web server and your visitors' web browser allowing for private information to be transmitted without the problems of eavesdropping, data tampering, or message forgery.

The protocol uses a third party, a Certificate Authority (CA), to identify one end or both end of the transactions.

What is Certificate Authority?

A certificate authority or certification authority (CA) is an entity that issues digital certificates. The digital certificate certifies the ownership of a public key by the named subject of the certificate.

Certificate Authorities (CAs) are organizations that are used as Trusted Third Parties, that is, an independent party, which both sides of a transaction (client and server) trust.

To enable SSL on a website, you will need to get an SSL Certificate that identifies you and install it on the server. The use of an SSL certificate on a website is usually indicated by a padlock icon in web browsers but it can also be indicated by a green address bar. Once you have done the SSL install, you can access a site securely by changing the URL from http:// to https://. When an SSL certificate is installed on a website, you can be sure that the information you enter (contact or credit card information), is secured and only seen by the organization that owns the website.

Several concepts have to be understood here.

To implement SSL CA on your web server.

You have the following two choices:

1. To purchase a certificate

2. To use a self-signed certificate

SelfSSL version 1.0 is a command-line executable tool that you can use to generate and install a self-signed Secure Sockets Layer (SSL) certificate for Internet Information Services (IIS) 6.0. This allows programmers to test the HTTPS protocol for development purposes without having to go through the effort of getting a certificate signed by a trusted authority.

SelfSSL generates a self-signed certificate that does not originate from a commonly trusted source,

Use this tool only to create a secure private channel between your server and a limited user group, such as exists in a software test environment.

System Requirements

SelfSSL is compatible with IIS 6.0 running on the Microsoft® Windows® Server 2003 operating system.

Installing SelfSSL

To install SelfSSL download the IIS 6.0 Resource Kit Tools.

SelfSSL Parameters

Adds the self-signed certificate to the "Trusted Certificates" list. The local browser trusts the self-signed certificate only if this parameter has been specified.

/N:cn

Specifies the common name of the certificate. The computer name is used if you do not specify a common name.

/K:keylength

Specifies the certificate key length. The default is 1024.

/V:duration-of-validity

Specifies the duration for which the certificate is valid. The default is 7 days.

/S:site-id

Specifies the site ID of the SSL-protected site. The default is 1 for the default Web site.

/P:port

Specifies the SSL port. The default is 443.

Specifies Quiet mode. In Quiet mode, any existent settings for the site are overwritten silently.