itramblings

Ramblings from an IT manager and long time developer.

By

Cisco AnyConnect

Cisco AnyConnect is an SSL VPN client that provides reliable and easy-to-deploy encrypted (SSL) network connectivity for Windows.

Typically, the Cisco AnyConnect client would be downloaded from the VPN site, but the version currently available from that location is not compatible with current versions of Windows 7 and Windows 8 and will not function properly due to Microsoft Windows security updates.

Note: Remember to verify you are running the most recent version of java (java.com)

Download Link

AnyConnect-3.1.02026

By

This is a bunch of command line tools for troubleshooting Microsoft Active Directory. Shared from the pcman.net website.

FSMO Roles

ntdsutilroles Connections “Connect to server %logonserver%” Quit
“selectOperation Target” “List roles for conn server” Quit Quit Quit

[JDH: This is really a series of steps, not a single command

expression]

Domain Controllers

Nltest /dclist:%userdnsdomain%

Domain Controller IP Configuration

for /f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do psexec \%i ipconfig /all

Stale computer accounts

dsquery computer domainroot -stalepwd 180 -limit 0

Stale user accounts

dsquery user domainroot -stalepwd 180 -limit 0

Disabled user accounts

dsquery user domainroot -disabled -limit 0

AD Database disk usage

for /f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do dir \%iadmin$ntds

Global Catalog Servers from DNS

dnscmd %logonserver% /enumrecords %userdnsdomain% _tcp | find /i “3268”

Global Catalog Servers from AD

dsquery * “CN=Configuration,DC=forestRootDomain” -filter “(&(objectCategory=nTDSDSA)(options:1.2.840.113556.1.4.803:=1))”

Users with no logon script

dsquery * domainroot
-filter”(&(objectCategory=Person)(objectClass=User)(!scriptPath=*))”-limit
0 -attr sAMAccountName sn givenName pwdLastSet distinguishedName

User accounts with no pwd required

dsquery * domainroot -filter “(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=32))”

User accounts with no pwd expiry

dsquery * domainroot -filter”(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=65536))”

User accounts that are disabled

dsquery * domainroot -filter “(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=2))”

DNS Information

for /f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do dnscmd %i /info

DNS Zone Detailed information

dnscmd /zoneinfo %userdnsdomain%

Garbage Collection and tombstone

dsquery * “cn=Directory
Service,cn=WindowsNT,cn=Services,cn=Configuration,DC=forestRootDomain”
-attrgarbageCollPeriod tombstoneLifetime

Netsh authorised DHCP Servers

netsh dhcp show server

DSQuery authorised DHCP Servers

Dsquery * “cn=NetServices,cn=Services,cn=Configuration, DC=forestRootDomain” -attr dhcpServers

DHCP server information

netsh dhcp server \DHCP_SERVER show all

DHCP server dump

netsh dhcp server \DHCP_SERVER dump

WINS serer information

Netsh wins server \WINS_SERVER dump

Group Policy Verification Tool

gpotool.exe /checkacl /verbose

AD OU membership

dsquery computer -limit 0

AD OU membership

dsquery user -limit 0

List Service Principal Names

for /f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do setspn -L %i

Compare DC Replica Object Count

dsastat ?s:DC1;DC2;… ?b:Domain ?gcattrs:objectclass ?p:999

Check AD ACLs

acldiag dc=domainTree

NTFRS Replica Sets

for /f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do ntfrsutl sets %i

NTFRS DS View

for /f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do ntfrsutl ds %i

Domain Controllers per site

Dsquery * “CN=Sites,CN=Configuration,DC=forestRootDomain” -filter (objectCategory=Server)

DNS Zones in AD

for /f %i in (‘dsquery server -o rdn’) do Dsquery * -s %i domainroot -filter (objectCategory=dnsZone)

Enumerate DNS Server Zones

for /f %i in (‘dsquery server -o rdn’) do dnscmd %i /enumzones

Subnet information

Dsquery subnet ?limit 0

List Organisational Units

Dsquery OU

ACL on all OUs

For /f “delims=|” %i in (‘dsquery OU’) do acldiag %i

Domain Trusts

nltest /domain_trusts /v

Print DNS Zones

dnscmd DNSServer /zoneprint DNSZone

Active DHCP leases

For /f %i in (DHCPServers.txt) do for /f “delims=- ” %j in
(‘”netshdhcp server \%i show scope | find /i “active””’) do netsh dhcp
server\%i scope %j show clientsv5

DHCP Server Active Scope Info

For /f %i in (DHCPServers.txt) do netsh dhcp server \%i show scope | find /i “active”

Resolve DHCP clients hostnames

for /f “tokens=1,2,3 delims=,” %i in (Output from ‘Find Subnets
fromDHCP clients’) do @for /f “tokens=2 delims=: ” %m in (‘”nslookup %j
|find /i “Name:””’) do echo %m,%j,%k,%i

Find two online PCs per subnet

Echo. > TwoClientsPerSubnet.txt & for /f
“tokens=1,2,3,4delims=, ” %i in (‘”find /i “pc” ‘Output from Resolve
DHCP clientshostnames’”’) do for /f “tokens=3 skip=1 delims=: ” %m in
(‘”Find /i /c”%l” TwoClientsPerSubnet.txt”’) do If %m LEQ 1 for /f %p in
(‘”ping -n1 %i | find /i /c “(0% loss””’) do If %p==1 Echo %i,%j,%k,%l

AD Subnet and Site Information

dsquery * “CN=Subnets,CN=Sites,CN=Configuration,DC=forestRootDomain” -attr cn siteObject description location

AD Site Information

dsquery * “CN=Sites,CN=Configuration,DC=forestRootDomain” -attr cn description location -filter (objectClass=site)

Printer Queue Objects in AD

dsquery * domainroot -filter “(objectCategory=printQueue)” -limit 0

Group Membership with user details

dsget group “groupDN” -members | dsget user -samid -fn -mi -ln -display -empid -desc -office -tel -email -title -dept -mgr

Total DHCP Scopes

find /i “subnet” “Output from DHCP server information” | find /i “subnet”

Site Links and Cost

dsquery * “CN=Sites,CN=Configuration,DC=forestRootDomain” -attr cn
costdescription replInterval siteList -filter (objectClass=siteLink)

Time gpresult

timethis gpresult /v

Check time against Domain

w32tm /monitor /computers:ForestRootPDC

Domain Controller Diagnostics

dcdiag /s:%logonserver% /v /e /c

Domain Replication Bridgeheads

repadmin /bridgeheads

Replication Failures from KCC

repadmin /failcache

Inter-site Topology servers per site

Repadmin /istg * /verbose

Replication latency

repadmin /latency /verbose

Queued replication requests

repadmin /queue *

Show connections for a DC

repadmin /showconn *

Replication summary

Repadmin /replsummary

Show replication partners

repadmin /showrepl * /all

All DCs in the forest

repadmin /viewlist *

ISTG from AD attributes

dsquery * “CN=NTDS Site Settings,CN=siteName,CN=Sites,CN=Configuration,DC=forestRootDomain” -attr interSiteTopologyGenerator

Return the object if KCC Intra/Inter site is disabled for each site

Dsquery site | dsquery * -attr * -filter “(|(Options:1.2.840.113556.1.4.803:=1)(Options:1.2.840.113556.1.4.803:=16))”

Find all connection objects

dsquery * forestRoot -filter (objectCategory=nTDSConnection) ?attr distinguishedName fromServer whenCreated displayName

Find all connection schedules

adfind -b “cn=Configuration,dc=qraps,dc=com,dc=au” -f “objectcategory=ntdsConnection” cn Schedule -csv

Software Information for each server

for /f %i in (Output from ‘Domain Controllers’) do psinfo \%i
&filever \%iadmin$explorer.exe
\%iadmin$system32vbscript.dll\%iadmin$system32kernel32.dll
\%iadmin$system32wbemwinmgmt.exe\%iadmin$system32oleaut32.dll

Check Terminal Services Delete Temp on Exit flag

For /f %i in (Output from ‘Domain Controllers’) do Reg
query”\%iHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminalServer”
/v DeleteTempDirsOnExit

F

or each XP workstation, query the current site and what Group Policy info

@dsquery * domainroot
-filter”(&(objectCategory=Computer)(operatingSystem=Windows
XPProfessional))” -limit 0 -attr cn > Workstations.txt & @For
/f%i in (Workstations.txt) do @ping %i -n 1 >NUL & @if
ErrorLevel0 If NOT ErrorLevel 1 @Echo %i & for /f “tokens=3” %k in
(‘”regquery
“\%ihklmsoftwaremicrosoftwindowscurrentversiongrouppolicyhistory”
/v DCName | Find /i “DCName””’) do @for /f %m in(‘”nltest /server:%i
/dsgetsite | find /i /v “completedsuccessfully””’) do @echo %i,%k,%m

Information on existing GPOs

dsquery * “CN=Policies,CN=System,domainRoot”
-filter”(objectCategory=groupPolicyContainer)” -attr displayName
cnwhenCreated gPCFileSysPath

Copy all Group Policy .pol files

for /f “tokens=1-8 delims=” %i in (‘dir /b
/s\%userdnsdomain%sysvol%userdnsdomain%policies*.pol’) do @echo
copy\%i%j%k%l%m%n%o %m_%n.pol

Domain Controller Netlogon entries

for /f %i in (‘dsquery server /o rdn’) do echo %i & reg query\%ihklmsystemcurrentcontrolsetservicesnetlogonparameters

WINS Statistics

for /f “tokens=1,2 delims=,” %i in (WINSServers.txt) do netsh wins server \%i show statistics

WINS Record counts per server

for /f “tokens=1,2 delims=,” %i in (WINSServers.txt) do netsh wins server \%i show reccount %i

WINS Server Information

for /f “tokens=2 delims=,” %i in (WINSServers.txt) do netsh wins server \%i show info

WINS Server Dump

for /f “tokens=2 delims=,” %i in (WINSServers.txt) do netsh wins server \%i dump

WINS Static Records per Server

netsh wins server \LocalWINSServer show database servers={} rectype=1

Find policy display name given the GUID

dsquery * “CN=Policies,CN=System,DC=domainRoot” -filter (objectCategory=groupPolicyContainer) -attr Name displayName

Find empty groups

dsquery * -filter “&(objectCategory=group)(!member=*)” -limit
0-attr whenCreated whenChanged groupType sAMAccountNamedistinguishedName
memberOf

Find remote NIC bandwidth

wmic /node:%server% path Win32_PerfRawData_Tcpip_NetworkInterface GET Name,CurrentBandwidth

Find remote free physical memory

wmic /node:%Computer% path Win32_OperatingSystem GET FreePhysicalMemory

Find remote system information

SystemInfo /s %Computer%

Disk statistics, including the number of files on the filesystem

chkdsk /i /c

Query IIS web sites

iisweb /s %Server% /query “Default Web Site”

Check port state and connectivity

portqry -n %server% -e %endpoint% -v

Forest/Domain Functional Levels

ldifde -d cn=partitions,cn=configuration,dc=%domain%
-r”(|(systemFlags=3)(systemFlags=-2147483648))”
-lmsds-behavior-version,dnsroot,ntmixeddomain,NetBIOSName -p subtree
-fcon

Forest/Domain Functional Levels

dsquery * cn=partitions,cn=configuration,dc=%domain%
-filter”(|(systemFlags=3)(systemFlags=-2147483648))”
-attrmsDS-Behavior-Version

Name dnsroot ntmixeddomain NetBIOSName

Find the parent of a process

wmic path Win32_Process WHERE Name=’notepad.exe’ GET Name,ParentProcessId

Lookup SRV records from DNS

nslookup -type=srv _ldap._tcp.dc._msdcs.{domainRoot}

Find when the AD was installed

dsquery * cn=configuration,DC=forestRootDomain -attr whencreated -scope base

Enumerate the trusts from the specified domain

dsquery * “CN=System,DC=domainRoot” -filter “(objectClass=trustedDomain)” -attr trustPartner flatName

Find a DC for each trusted domain

for /f “skip=1” %i in (‘”dsquery * CN=System,DC=domainRoot
-filter(objectClass=trustedDomain) -attr trustPartner”’) do nltest
/dsgetdc:%i

Check the notification packages installed on all DCs

for /f %i in (‘dsquery server /o rdn’) do @for /f “tokens=4″ %m
in(‘”reg
query\%iHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa
/v”Notification Packages” | find /i “Notification””’) do @echo %i,%m

List ACLs in SDDL format

setacl -on %filepath% -ot file -actn list -lst f:sddl

Find out if a user account is currently enabled or disabled

dsquery user DC=%userdnsdomain:.=,DC=% -name %username% | dsget user -disabled -dn

Find servers in the domain

dsquery * domainroot -filter “(&(objectCategory=Computer)(objectClass=Computer)(operatingSystem=*Server*))” -limit 0

Open DS query window

rundll32 dsquery,OpenQueryWindow

By

Don’t rejoin to fix the trust relationship between this

Copied from here: http://www.implbits.com/about/blog/tabid/78/post/don-t-rejoin-to-fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/default.aspx

 

f you Google “the trust relationship between this workstation and the primary domain failed”, you get plenty of information from support blogs and Microsoft articles; however, most of them ask you to rejoin your machine to the domain. That’s not always possible.


The underlying problem when you see this error is that the machine you are trying to access can no longer communicate securely with the Active Directory domain to which it is joined.  The machine’s private secret is not set to the same value store in the domain controller.  You can think of this secret as a password but really it’s some bits of cryptographic data called a Kerberos keytab stored in the local security authority.  When you try to access this machine using a domain account, it fails to verify the Kerberos ticket you receive from Active Directory against the private secret that it stores locally.  I think you can also come across this error if for some reason the system time on the machine is out of sync with the system time on the domain controller.  This solution also fixes that problem.

This problem can be caused by various circumstances, but I most commonly run into it when I reset a virtual machine to a system snapshot that I made months or even years before.  When the machine is reset, it is missing all of the automatic password changes that it executed against the domain controller during the intervening months.  The password changes are required to maintain the security integrity of the domain.

 


Support blogs and Microsoft will generally tell you to rejoin the domain to restore the trust relationship.  Another option they will give is to delete the computer object and recreate it without a password and rejoin.

Microsoft support article on the topic: http://support.microsoft.com/kb/162797

I’m not a fan of any of these options.  This seems heavy handed and sometimes they aren’t even possible.

Recently, when I ran into this problem, the virtual machine that reset was an enterprise certificate authority joined to my test domain.  Well, guess what, Microsoft will not allow you to rename or unjoin a computer that is a certificate authority—the button in the computer property page is greyed out.  There may be another way to unjoin but I wasn’t going to waste time on it when it isn’t even necessary.


Just change your computer password using netdom.exe! 

netdom.exe resetpwd /s:<server> /ud:<user> /pd:*

<server> = a domain controller in the joined domain

<user> = DOMAINUser format with rights to change the computer password

Here are the full steps:

  1. You need to be able to get onto the machine. I normally just log in with the local Administrator account by typing, “.Administrator” in the logon window. I hope you remember the password. If you’re creative and resourceful you can hack your way in without the password. Another option is to unplug the machine from the network and log in with domain user. You will be able to do disconnected authentication, but in the case of a reset machine, remember that you may have to use an old password. Your domain user’s cached credential has the same problem as the machine’s private secret.
  2. You need to make sure you have netdom.exe. Where you get netdom.exe depends on what version of Windows you’re running. Windows Server 2008 and Windows Server 2008 R2 ship with netdom.exe you just have to enable the Active Directory Domain Services role. On Windows Vista and Windows 7 you can get it from the Remote Server Administration Tools (RSAT). Google can help you get them. For other platforms see this link: http://technet.microsoft.com/en-us/library/ee649281(WS.10).aspx”
  3. Extra steps if the machine is a domain controller. If the broken machine is a domain controller it is a little bit more complicated, but still possible to fix the problem. I haven’t done this for a while, but I think this works:
    1. Turn off the Kerberos Key Distribution Center service. You can do this in the Services MMC snap-in. Set the startup type to Manual. Reboot.
    2. Remove the Kerberos ticket cache. A reboot will do this for you, or you can remove them using KerbTray.exe. You can get that tool here: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17657
    3. Post change steps. Do these in conjunction with 5 below. Turn the Kerberos Key Distribution Center Service back on before rebooting. You should reboot the domain controller and then force replication in the Active Directory Sites and Services MMC snap-in.
  4. Run netdom.exe to change the password.
    1. Open an administrative command prompt. On Windows platforms with UAC enabled, you will need to right-click on cmd.exe and select “run as Administrator”.
    2. Type the following command: netdom.exe resetpwd /s:<server> /ud:<user> /pd:*
  5. Reboot the machine.

Here is more information on netdom.exe: http://support.microsoft.com/kb/325850

 

I hope this is helpful.  This problem comes up every few months for me, so I wanted to document it for my own use.  It is difficult to find when you just search for the error you get in the login window.

By

Connection via Cisco VPN Client stops local DNS resolution

Reprint from here…
If you use the Cisco VPN Client with Windows XP, you may have noticed that all of your DNS requests go via the VPN, rather than the local network. You can test which DNS server you are using through the use of the NSLOOKUP command. The Cisco VPN Client creates a disabled Local Area Connection, to which it assigns null values until connected. When you connect using the client this connection profile becomes enabled and is set with the appropriate DNS, WINS, gateway and IP address from the other end of the VPN, usually by a DHCP server. By default when you install the client the priority of the Cisco VPN connection is higher than the default local connection assigned to your ethernet NIC or wireless card and it is this that causes two major problems for users:

  1. You cannot connect to local named servers, but you can access them by IP. The only common workaround suggested for this (see Google Groups) is to manually add them to your HOSTS file. This is not a solution that you could widely roll out to a network of users, and is a dirty hack.
  2. Your DNS resolution is SLOW. This is because your request has to go to the DNS server at the other end of the VPN, before being returned to you locally, whereby it sends you out over your local LAN to the internet as normal via your broadband router.

To test which DNS server you are using by default when connected normally, first disconnect from the VPN client and pop open a command window:

  • Start -> Run -> type “cmd”
  • type “nslookup”.

You’ll see something along the lines of:

C:Documents and SettingsAdministrator>nslookup
Default Server: 192.168.0.1
Address: 192.168.0.1

>

Type “exit” and then open up your Cisco VPN Client, connect via VPN, and repeat the NSLOOKUP command. You’ll see the change to your default DNS server:

C:Documents and SettingsAdministrator>nslookup
Default Server: core.office.junto.co.uk
Address: 172.30.2.1

>

Now all DNS requests will go through the VPN, and not your local router. Slow and pointless (security caveats aside). Why does the Cisco VPN Client change this, and can we alter it at the client level? We don’t really want to bother our over worked Cisco technician back in the office, and often he’s an expensive contract resource anyway.

Most importantly why does the Cisco VPN Client connection always seem to have a higher priority than the standard local ethernet connection or wireless connection under Windows XP? My initial thought was that Cisco designed it to be this way, and there was no way to change it, but now I believe that the simple answer is one of installation order. Hence, as the connections are installed, the last one to be installed seems to be given the highest priority. Someone more knowledgeable with XP networking might be able to clarify this.
Whether or not this is true or not, the fix is to change the priority of the connections. A bit of digging around gives you some advanced settings to network connections:

  • Start -> Control Panel -> Network Connections
  • Then under the menu option Advanced -> Advanced Settings
  • Change the priority of your default local connection, to be above that of the Cisco VPN Client. The Cisco VPN Client often installs for most people as “Local Area Connection 2”.

Now try the NSLOOKUP command again. You’ll see something along the lines of:

C:Documents and SettingsAdministrator>nslookup
Default Server: 192.168.0.1
Address: 192.168.0.1

>

You’re back to using your local DNS server, but still connected to the VPN. Problem solved. Nice! You should now be able to see your local servers inside your LAN by name, plus general browsing should be faster.
Some caveats:

  1. There may be security considerations to allowing DNS requests via the local LAN rather than the VPN. DNS works so that it rolls down the list of DNS servers, so the local LAN will ask the world for an internal DNS name first. That could give information away in terms of your local private LAN set up.
  2. I’m using an up-to-date-patched version of Windows XP Professional SP2
  3. I’m using the Cisco Client 4.0.4. Newer versions have given me grief.
  4. In the properties of the VPN profile in question (Cisco VPN Client -> Connection Entry -> Modify) the Transport tab has the option “Allow Locale LAN Access” checked.
  5. This may also be a solution for other VPN clients, but I haven’t tried it.