Simple GUI way to transfer FSMO Roles

For documentation purposes only: There are other ways to achieve this using powershell or ntdsutil command, let just say we use the GUI method and simple command prompt for now.

1. Check the current FSMO roles owner. From a command prompt, "netdom query fsmo"
2. For Domain Name Operation Master, bring up the Active Directory Domains and Trust, right click and connect to the DC which you want it to hold the role.  right click again and select Operations Master, click on "Change" and follow the prompt.
3. For RID, PDC and Infrastructure Master, bring up the Active Directory Users and Computers,  right click and connect to the DC which you want it to hold the role.  right click on the domain and select "Operation Masters".  It should bring up a menu with 3 tabs.  Go through the tabs and change the Operation Master by following the prompt.
4. For Schema Master, you first need to register the schema mmc snap-in.  In a command prompt, issue " regsvr32 schmmgmt.dll"  (if you have not already done so)
5. Bring up mmc.exe and add the Active Directory Schema snap-in.  Right click on Active Directory Schema and Change Active Directory Domain Controller to the DC you want it to own the Schema Master role.
6. Right click again and select Operation Master, follow the prompt to change the owner of the Schema role.  (Note:  You need to be a member of the Schema Admins group to do this)

OK. I might as well list the ntdsutil way:

1. Bring up a command prompt and ntdsutil.exe
2. In ntdsutil:  type "popups off" to disable popups confirmation box.  Assuming that you know exactly what you are doing.
3. Type "roles"
4. In fsmo maintenance:  type "connection"
5. In server connections: type "connect to server DC2"  (whatever your other DC is)
6. type "quit" or "q"
7. In fsmo maintenance:  type "transfer infrastructure", "transfer naming master", "transfer PDC", "transfer RID master" or "transfer schema master"
8. Follow the prompt to transfer the roles.

Honestly, I actually prefer the ntdsutil way, straight forward and you don't have to navigate here and there. 

Activating Windows by phone.. Talking to a machine.

I know this is not something new or challenging, I just want to document this here so that I can refer to this every time I build a server for a client where internet access is not an option, I don't have to "How do I activate Windows without internet access again?" and then start googling on my phone..

To activate Windows through phone:

1. Bring up an elevated command prompt.
2. type in "slmgr -ipk <XXXXX-XXXXX-XXXXX-XXXXX-XXXXX>  <= replace X  with the 25 characters product key associated with your license agreement.
3. Once you get a confirmation that your product key is accepted, type in the following
4. SLUI 4
5. Select the country where you currently located and call the 1-866 numbers...
6. You will be speaking to an automated answering male driod (lol) which will guide you through the activation process.

Done!

Performing and Active Directory Health Check

There are a few Microsoft diagnostic tool you can run to do basic Active Directory health check.

dcdiag.exe is an utility that will run diagnostic tests against domain controllers. Here is a very good article Ned which I am not going to repeat here. This Technet article documented how this tool can be used with all the switches and results.

dcdiag.exe /v
dcdiag.exe /test:topology
dcdiag.exe /test:replications

The Microsoft I.T Environment Health Scanner is really good.  It has some A.D component in there as well and does all the jobs for you.
http://www.microsoft.com/download/en/details.aspx?id=10116

PD TechGuru Reference:
https://pdtechguru.wordpress.com/2012/10/04/active-directory-health-check/


DNS
DNS is a very important role in Active Directory and should be check first, if DNS is not working properly, you will most likely would have A.D. issues.
http://technet.microsoft.com/en-us/library/cc755349(WS.10).aspx

Some tools that is useful when troubleshooting DNS server issues:
1. DNSLint - http://support.microsoft.com/kb/321045
DNSlint /ad domain_controller_ip /s dns_server_ip

2. DNSCMD.EXE
/info will give you basic information about the DNS.
/zoneinfo <zone_name> display information about the zone.

A.D Replication
The following tools are useful for finding out replication status with A.D.

1. Repadmin.exe admin tool. http://technet.microsoft.com/en-us/library/cc755360(WS.10).aspx
/showrepl
/replsummary


2. dsastat -s:domaincontroller1;domaincontroller2This utility is useful in verifying replication between DCs to ensure that objects been completely replicated throughout the domain.

3. Replmon.exe GUI interface

Good to know:
To determine the FSMO Role.
- Netdom -query fsmo (list the current DC which holes the FSMO roles)
- dsquery server -hasfsmo schema/name/infr/rid/pdc
- dcdiag /test:knowsofrolesholders /v (including test as well..)

To Transfer or Seize FSMO Role.
Use ntdsutil to transfer the role
- Type roles
- connections
- connect to server <domain_controller> where the dc is where you want to transfer to
- quit
- transfer schema master
- quit

User ntdsutil to seize the role if you have lost the original DC for the role.
- follow the steps above but instead of transfer, you specify seize schema master for example.
- One the role is seize, do not attempt to bring the previous role owner up, it will cause the database to be corrupted.

Enable Netlogon logging.
- http://support.microsoft.com/kb/109626
- nltest /dbflag:0x2080ffff

Troubleshooting Replication issues:
http://technet.microsoft.com/en-us/library/cc755349(WS.10).aspx#BKMK_2