actdir06 - rebooted machine and network connection was restored
Disabled NetBIOS on ERA PPP network connection, see The Remote Access Controller (RAC) Service Slows Local Network Browsing in the Microsoft® Windows® 2000 Operating System in the Dell Knowledge Base for more information.

Schema change to support Server 2003 with adprep /forestprep
UC domain updated with adprep /domainprep
UCB Root Certificate Authority 01 certificate published in Enterprise Root Certificate Store

actdir01 - updated Okena agent and updated OS patches and hotfixes.
actdir03 - updated Okena agent

UC and CAMPUS domains - Domain Controller and Domain GPO Change- Implemented Q239869

Domain controllers refuse LM and NTLM responses (accept only NTLM 2). Clients use NTLM 2 authentication, use NTLM 2 session security if the server supports it; domain controllers refuse NTLM and LM authentication (they accept only NTLM 2).

If a client/server program uses the NTLM SSP (or uses secure Remote Procedure Call [RPC], which uses the NTLM SSP) to provide session security for a connection, the type of session security to use is determined as follows:

• The client requests all the following items: message integrity, message confidentiality, NTLM 2 session security, and 128-bit encryption.
• The connection does not succeed if message integrity is not negotiated.
• The connection does not succeed if message confidentiality is not negotiated.
• The connection does not succeed if NTLM 2 session security is not negotiated.
• The connection does not succeed if message confidentiality is in use but 128-bit encryption is not negotiated.
  

HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DnsTtl 0xE10 1 Hour
http://www.microsoft.com/windows2000/techinfo/reskit/en/regentry/55950.htm

Will want to add to Domain Controller Policy.

All 4 servers have a backup to file on e:\backup.bkf which has the system state. This backup was done when the servers were done in a virgin state when they first joined the domains.

Terminal services should be switched to 128 bit secure mode.

Right now the custom policies are applied to the OU "Custom Policy Test." Once I will move them out Friday but wanted to make sure not to affect too many machines until I was sure it was safe.

Right now the NIC card on the servers are running the Microsoft driver. This should get changed to the updated Intel one, since I believe since I believe the card is really a Pro/100 S Server adapter (according to dell web page), which does IPSEC on the card (this update has to be run from the console since the Terminal session will die if you update NIC drivers).

Right now both domains have the same administrator account name and password. This should get changed shortly.

Enterprise level - Go to Active Directory Domains & Trusts, Right click and choose properties. Add the UPN name BERKELEY.EDU.

Images for RTK, Support tools & policy are located on actdir01 in the e:\images directory.

I talked to Alex (the backup guy) and supposedly they have not run a test as of yet. The Legato Networker clients are installed on all 4 servers so they should do this shortly.

IPSEC on all 4 servers is kicking off errors every two hours. I do not believe this is a config error on our end. IPSEC is working properly, so it may be a timeout, although I specified key renewal every hour from our end. I sent an email to Mike S. about this to see if he could come to any conclusions.

Norton AV Corporate is installed on all the servers. Right now its set to update once weekly - you should change that to daily late in the evening.

A Custom MMC for Administrators

Providing custom MMC consoles to administrators could be a means to limit the range of Administrative utilities available to groups of administrators. A custom MMC console is created as follows:

Start /Run/MMC

" Add desired snap-ins and extensions from the Add/Remove Snap-ins dialog
" Open the Option dialog and click the Console tab
" Select User (or Author) mode
" Configure the allowable view
" Save the MMC console

Author and User modes determine how easily the target administrator can change the console. Author mode freely allows any changes to the console. In User mode the console is not changeable by default. Regardless of whether the custom MMC console was saved in Author or User mode, a user can always modify the console by right clicking the console, clicking Author, and then changing the console. The only way to prevent this is to not assign NTFS Write permission to the .msc file. Also, the only way to prevent a user from creating their own MMC console and including restricted utilities is to remove the utilities or deny file permissions on the target computer. There are several ways to distribute a custom MMC console, including the following:

" ?File (through email or on a removable media)
" ?Group Policy
" ?Shared Folder

Only the shared folder distribution method allows NTFS file permissions to prevent the recipient from changing the file after receiving it.

Running dcpromo for the 3rd, offsite root server:

1) Your DNS servers should be ns1.Berkeley.edu and ns2.Berkeley.edu.
2) Apply SP2 and apply post sp2 patches (use the hotfix auditing tool from MS).
3) Establish ipsec rule with reznor.Berkeley.edu under local security policies snap-in in the MMC or Administrative tools. Run ipsecmon and send a couple pings to reznor to make sure ipsec is working properly. Make sure Mike Sinatra sends you a key for your server.
4) Run dcpromo - choose additional domain controller when asked what the server should be used for - (i.e. root, forest or child) and place it in the UC domain.
5) Choose where logs, database & sysvol will be located according to the chart on the previous page (if the server is identical)
6) Upon completion of the dcpromo process, reboot the server. You are now finished.

All 4 Domain controllers were backed up to a file call "E:\1018backup.bkf" including the system state. Restore process is as follows:

During the start up press F8.
On the Windows advanced options menu select directory services restore mode press enter. This makes sure the domain controller is offline and not connected to the network.
Select operating system to start prompt select Windows 2000.
Log on as administrator.
On the desktop message that says windows is running in safe mode click OK.
Point start, point programs point system tools point backup.
On the welcome to Windows backup select restore wizard.
In restore wizard expand the media type that contains the data you want to restore or click import file (type or file media).
Expand the appropriate media set until the data that you want to restore is visible. You can restore a backup set or specific files and folders
Click finish to start the restore process. The restore wizard requests verification for the source of the restore media and than performs the restore. During the restore the wizard displays status information about the restore.

IPSEC to reznor.Berkeley.edu is installed and functioning.

IPSEC must be set as a local security policy on the intended domain controller before you attempt a promotion. The IPSEC policy points to reznor.Berkeley.edu. Once promotion is successful, this policy can be disabled since I have made a domain controller IPSEC policy that makes it unnecessary in both domains.

The OS2 & POSIX subsystems are removed from all servers.

The Forest Time server actdir01 is synched with ntp2-1 & ntp2-2.

Domain Controller Security Policy was tightened up. I left Domain security policy (I did add the Kerberos Policy for the registry - nt style) as is which will have to be determined by further discussions.

UC Domain

actdir01 169.229.131.10
actdir02 169.229.131.11

CAMPUS Domain

actdir03 169.229.131.12
actdir04 169.229.131.13

Drive Configurations

1 RAID 5 Drive
1 RAID 1 Drive

C:\ System RAID 1
E:\ DB RAID 5
F:\ LOGS RAID 1
E:\ SYSVOL RAID 5