www.dambeck.ch

For a Project I hade change the DNS Server settings on several client computers. All Clients hade fixed IP and DNS Settings on the clients and the customer want not to change to a DHCP. I can understand this approach because fixing the IP of computers can improve network security and awareness. My first approach was to look inside the GPO of Windows XP. And after 2 minutes searching look what I fond under: “Computer Configuration – Administrative Templates – Network – DNS Client – DNS Servers”

“ Defines the DNS servers to which a computer sends queries when it attempts to resolve names.

Warning: The list of the DNS servers defined in this setting supersedes DNS servers configured locally and those configured using DHCP. The list of DNS servers is applied to all network connections of multihomed computers to which this setting is applied.

To use this setting, click Enable, and then enter a space-delimited list of IP addresses (in dotted decimal format) in the available field. If you enable this setting, you must enter at least one IP address.

If this setting is not configured, it is not applied to any computers, and computers use their local or DHCP-configured parameters.”

After reading the description I Thanked this is it. So let me show you first the test environment. We got to server and a Client. The server running Windows 2003 and the client runs XP. The two servers (dc01.planetgeek.ch/ 172.16.111.120 and sql.platnetgeek.ch / 172.16.111.124) have installed DNS servers. The Client has only one DNS configured the dc001.

Setting up the new GPO and link it to the client pc.

Now we use the client to review the impact of this GPO setting. First we use the gpresut to look if the GPO was adapted.

After we are sure that the GPO was applied I do an “ipconfig /all” to check the DNS settings.

Okay it looks like the DNS setting is not applied. I checked the result several times, rebooted the PC, used netsh to look on the DNS settings and searched for event log entries. Then I tried nslookup on the console. Look on witch DNS server the request goes.

It looks like the network tools (ipconfig, netsh and the tcp/ip Settings gui) from windows XP did not recognize the GPO Setting. I guess if you use this in large company this will end up in a debugging nightmare. Normally I hate this Microsoft bashing, because the Company make good and stable products. But this time the guys from Redmond did a very lousy job.

In the most cases there are benefits when all data (log and db) files are on the network storage. Think off the benefit in terms of performance and backup. The Install wizard of Microsoft SQL Server 2008 shows only the option to change the path of the temporary database. In this guide I show you how to move the databases. Please keep in mind to create a backup of your db’s before starting. I know backup is only for hot shower takers, gym bag losers and armpit hair blow-dryers;-). On my test server the path looks like:

master.mdf, masterlog.ldf

C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA

Model.mdf, modellog.ldf

C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA

MSDBdata.mdf, MSDBlog.mdf

C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA

Tempdbv.mdf, templog.ldf

C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA

planetgeek.mdf, planetgeek_log.ldf

C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA

First thing you notice the filenames are all tuned in the same schema, pls. Microsoft it cannot be so hard. Our mission is to move all log files in the path D:\mssqlserver08 and all data files to E:\mssqlserver08. The first thing we should do is give the sqlserver service account user read and write rights to this two directories. This step is not quiet necessary but the remote db creation and auto grow features will not work. Let’s start with the master db. Start the SQL Server Configuration Manager. Click “start” -> “run” and type “SQLServerManager10.msc” and right click on the properties from the SQL server Service.

In the advanced tab you have to edit the Startup Parameters

The default value is (keep in mind there are no spaces!!!):

-dC:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA\master.mdf;

-eC:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\Log\ERRORLOG;

-lC:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER08\MSSQL\DATA\mastlog.ldf

-d is the path to the master.mdf

-e path of the “ERRORLOG” File.


-l is path to the ldf File

After change the path to (keep in mind there are no spaces!!!):

-dD:\mssqlserver08\master.mdf;

-eD:\errorlog\ERRORLOG;

-lE:\mssqlserver08\mastlog.ldf

stop the sql server (for cluster use you can use an UNC path and share name. This is useful on relaxed security cluster environments). Copy the master db files to the new path. And start the SQL server Service. One step done four steps are left, so let’s move on with the temporary db. Open the SQL Server Management Studio and open a new query and enter the following lines

After the alter database statement you need to stop the Sql Server move the files in explorer to their new location and start the SQL Server Service. Many of you are maybe wondering why “ … name = tempdev, …” and the “name = templog” in the SQL query. This is the internal database name. A very easy name to get this name is stored procedure sp_help

with this procedure you are able to easily modify the path of all other databases. Normally we would have finished at this point. But after then years of experience as IT guy I know that “developers” often don’t care about path in the file system (developers who write for planetgeek are not this kind of developers . So we should change the default database creation path to ensure it will work even when we are not in the office (Yes the IT Professionals have Holydays;-).

Enjoy the comfort of non direct attached storage, RIDE ON

Konrad

Part One. Today an in my next posts we want take a closer look at the security settings of an windows server. One good way to start is the "Security Configuration Wizard" later called as SCW. The wizard was patched in the operating system with SP1. In the release 2 of windows server 2003 you don’t need to patch it’s from start up SP2. To enable the feature just open the windows components dialog ("Add or Remove Programs" -> "Add/Remove Windows Components") and mark the check box. Now you need to insert the windows disk. In the "Administrative Tools" you will find an new program "Security Configuration Wizard". Or just run "scw.exe" from the run. On the start up screen of the SCW there is the first important notice. The message indicates that the wizard will detect inbound ports that are being used by this server. This requires that all applications that use inbound ports be running before you run the wizard and create the security policy. In my lab the server will work as file and print server. To do it al little harder the lab Server runs also TeamSpeak witch is not an Microsoft Application . The teamspeak server will listen on UDP Port  8767. After Clicking next, the wizard ask to crate an new policy. The next part is Interesting you are able to chose the Local or an remote server. My preferred option is to insta ll the SCW on each server and make local scans. Now we are able to check the version of the "Security DB". If you need an special service on many server’s witch is not listed edit the XML files in "%SystemRoot%\Security\msscw\policies%". More info about the XML file are located on google. After Skipping the window we are able to chose the server roles . In the next Dialog we are able to chose the client features like DHCP client, wins client …. and may more. Now microsoft want us to chose witch are the installed options of the server. The SCW now detects non windows services. in my lab he find the VM Tool’s . Now we must approve the disabling of unused services. Please check the list very cheerfully. Now the big magic continues with the approval of TCP/ IP ports. Please check the list very cheerfully. Now one of the biggest "lion’s den". In the registry the SCW will change settings for "SMB Security Signatures", "LDAP Signing", "Outbound Authentication Protocols" and "Inbound Authentication Protocols". with this settings enabled the server are harden to the most man-in-the-middle attacks an password cracking will be not so easy. The audit policy is a mixed blessing. Its very imported to find security issues in the logs. But study the logs will take much much time. So just enable the normal logging. Enter an Description an Save the Policy File. Now You Are able to apply  the policy now or later. Applying the policy will force an restart of the server !!

After applying the policy the TeamSpeak server stop’s working like except. But after editing the policy and again, insert the port 8767 all services works fine.

My conclusion of the Microsoft Security Configuration Wizard is: The tool is very easy to use and brings many good changes in short time. The use of SCW sold be carefully tested. But i’m strongly advise the use on all windows servers.

Wer wollte das nichts schon lange seinen eigenen Windows Cluster in VMware. Alls erstes brachen wir mal einen OpenFiler als iScsi Target. wie man das macht findet ihr natürlich in meinem Blog etwas weiter unten. Um die Sache etwas Ressourcen sparender zu gestalten werde ich den 2 Node Cluster nehmen wobei der eine Node auch noch als Domain Controller Dient.

als erstest geben wir beiden Cluster Node’s den Gleichen IQDN Namen

Wir geben dem IQDN noch eine LUN auf dem OpenFiler. Jetzt Starten wir den Cluster Administrator.

und Los gehts mit dem Neuen Cluster.

So jetzt gehts weiter mit dem Wizzard

Und wir Formatiren unsere LUN mit NTFS. Sie dient Später als Quorum.

Wir geben den ersten Node an

Die Lun ist etwas Klein aber das reicht schon

Die IP des Clusters Angeben

Okay, ich gebe es zu der Domain Administrator ist nicht sauber aber es ist nur ein test.

Und der Cluster Steht mal mit einem Node

Weiter geht’s mit dem Node (knoten) 2

Den 2 Node Angeben

Wie Immer im leben, Die Warnungen einfach Ignorieren

Den Cluster Account Angeben

Weiter,weiter und dann haben wir auch schon unseren Cluster

Für den Produktiven Einsatz eines Clusters empfehle ich noch pro Node eine NIC für den Heart Beat. Windows Cluster sind meiner Meinung nach etwas aus der Mode Geraten. Dies weil Sie etwas Kompliziert in der Verwaltung sind und relativ viel Kosten. Eine gute Alternative Könnte ein VMware ESX Cluster sein. Mal sehen ev gibts dazu demnächst auch noch ein Post.