Windows 活动目录与网络之“古代十大名剑”
Windows 的活动目录与网络问题就像江湖中的恶魔,烧杀抢掠,无恶不作,抢我工作夺我钱财,赤手空拳实难对付,现在送给各位“古代十大名剑”替天行道,斩妖除魔。再加上组策略最佳实践之“降龙十八掌”[url]http://technet.blog.51cto.com/21712/33368[/url],相信大家应该可以持剑闯江湖,替天行道。
PS:这篇文章谨祝贺走在左边的女朋友--XYMM,于今天晚上11点顺利通过了美国某一公司财务总监及CEO的第四次面试,明天就可以正式办理上班手续,以此文章表示祝贺。
(希望大家转载,让更多的人跟我一起祝贺,不过希望大家保持文章的完整性,所有的文字都不要进行删剪,谢谢!)
转载请注明出自:[url]http://technet.blog.51cto.com/[/url]不注明出处,必究
 
第十把剑:承影之“DCDiag
承影是一把精致优雅之剑
剑气激射指数:7
《列子。汤问》之中被列子激赏的铸于商朝后来被春秋时卫国人孔周所藏的名剑:承影,承影是一把精致优雅之剑。
剑气激射指数:7
1Domain Controller Diagnostic
2、必备的活动目录壮态检测工具
3、通过安装Windows Support Tools获得(产品光盘的support\tools目录中)
用法
C:>dcdiag /v >c:dcdiag.txt(一般用到“/v”这个参数)
打开dcdiag.txt,他会检查很多域控制器的设定。
Domain Controller Diagnosis
 
Performing initial setup:
   * Verifying that the local machine DC1, is a DC.
   * Connecting to directory service on server DC1.
   * Collecting site info.
   * Identifying all servers.
   * Identifying all NC cross-refs.
   * Found 2 DC(s). Testing 1 of them.
(说明这个环境中有多少台域控制器,这个环境是两台,就可以知道这个环境有多大,另一种做用就是原来有5台域控制器,卸载了一台,但没有卸载干净,这里也会显示有5台,不会显示4台。)
   Done gathering initial info.
(进行初始化的检测,如果这台计算机不是域控制器的话这步检测完,下面的将不会再被执行)
 
Doing initial required tests
  
   Testing server: Default-First-Site-Name\DC1
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         * Active Directory RPC Services Check
         ......................... DC1 passed test Connectivity
(测试是否能够连接)
Doing primary tests
  
   Testing server: Default-First-Site-Name\DC1
      Starting test: Replications
         * Replications Check
         [Replications Check,DC1] A recent replication attempt failed:
            From DC2 to DC1
            Naming Context: CN=Schema,CN=Configuration,DC=zxy,DC=xy
            The replication generated an error (8524):
            由于 DNS 查找故障,DSA 操作无法进行。
            The failure occurred at 2007-07-15 16:15:10.
            The last success occurred at 2007-07-05 16:59:05.
            21 failures have occurred since the last success.
            The guid-based DNS name cd9c55ad-ecad-41c3-bd58-994128d2f6e8._msdcs.zxy.xy
            is not registered on one or more DNS servers.
         * Replication Latency Check
         REPLICATION-RECEIVED LATENCY WARNING
         DC1:  Current time is 2007-07-15 16:20:33.
            CN=Schema,CN=Configuration,DC=zxy,DC=xy
               Last replication recieved from DC2 at 2007-07-05 16:59:05.
         * Replication Site Latency Check
         REPLICATION-RECEIVED LATENCY WARNING
          Source site:
         CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
          Current time: 2007-07-15 16:20:33
          Last update time: 2007-07-11 22:58:23
          Check if source site has an elected ISTG running.
          Check replication from source site to this server.
         ......................... DC1 passed test Replications
      Test omitted by user request: Topology
      Test omitted by user request: CutoffServers
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC DC1.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=zxy,DC=xy
            (NDNC,Version 2)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=zxy,DC=xy
            (NDNC,Version 2)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=zxy,DC=xy
            (Schema,Version 2)
         * Security Permissions Check for
           CN=Configuration,DC=zxy,DC=xy
            (Configuration,Version 2)
         * Security Permissions Check for
           DC=zxy,DC=xy
            (Domain,Version 2)
         ......................... DC1 passed test NCSecDesc
(检测活动目录里主要一些分区的权限是否设定正确,如域分区是否正确,Schema是否正确等等)
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\DC1\netlogon
         Verified share \\DC1\sysvol
         ......................... DC1 passed test NetLogons
      Starting test: Advertising
         The DC DC1 is advertising itself as a DC and having a DS.
         The DC DC1 is advertising as an LDAP server
         The DC DC1 is advertising as having a writeable directory
         The DC DC1 is advertising as a Key Distribution Center
(如果不是Key那么他将不会给客户端身份验证)
         The DC DC1 is advertising as a time server
(是否是time server
         The DS DC1 is advertising as a GC.
(是否是GC,如果把一台普通的DC改成GC,一般需要20分钟到半个小时,因为他需要让其他的DC知道,然后改注册表一个键值如果还不成功,那就需要重启一下。)
         ......................... DC1 passed test Advertising
AD上有很多重要的服务和重要的功能,如果关掉的话,这个地方会报错,)
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         Role Domain Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         Role PDC Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         Role Rid Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         ......................... DC1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         * Available RID Pool for the Domain is 2103 to 1073741823
         * DC1.zxy.xy is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 1103 to 1602
         * rIDPreviousAllocationPool is 1103 to 1602
         * rIDNextRID: 1130
         ......................... DC1 passed test RidManager
DC中每新建一个用户都会给他一个唯一标识符,Rid就是这个唯一标识符的尾数,在整个域里统一分配,保证所有用户的尾数都不一样,这是一个大的地址池,如果号用完了就不能创建新的用户了,这是一个比较常见的问题)
      Starting test: MachineAccount
         Checking machine account for DC DC1 on DC DC1.
         * SPN found :LDAP/DC1.zxy.xy/zxy.xy
         * SPN found :LDAP/DC1.zxy.xy
         * SPN found :LDAP/DC1
         * SPN found :LDAP/DC1.zxy.xy/ZXY
         * SPN found :LDAP/bdd96d1e-2b03-49d4-8998-b04018442b2e._msdcs.zxy.xy
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/bdd96d1e-2b03-49d4-8998-b04018442b2e/zxy.xy
         * SPN found :HOST/DC1.zxy.xy/zxy.xy
         * SPN found :HOST/DC1.zxy.xy
         * SPN found :HOST/DC1
         * SPN found :HOST/DC1.zxy.xy/ZXY
         * SPN found :GC/DC1.zxy.xy/zxy.xy
         ......................... DC1 passed test MachineAccount
(计算机帐号的检测)
      Starting test: Services
         * Checking Service: Dnscache
         * Checking Service: NtFrs
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: RpcSs
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... DC1 passed test Services
      Test omitted by user request: OutboundSecureChannels
      Starting test: ObjectsReplicated
         DC1 is in domain DC=zxy,DC=xy
         Checking for CN=DC1,OU=Domain Controllers,DC=zxy,DC=xy in domain DC=zxy,DC=xy on 1 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy in domain CN=Configuration,DC=zxy,DC=xy on 1 servers
            Object is up-to-date on all servers.
         ......................... DC1 passed test ObjectsReplicated
      Starting test: frssysvol
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... DC1 passed test frssysvol
      Starting test: frsevent
         * The File Replication Service Event log test
         ......................... DC1 passed test frsevent
      Starting test: kccevent
         * The KCC Event log test
         An Error Event occured.  EventID: 0xC0250827
            Time Generated: 07/15/2007   16:14:04
            (Event String could not be retrieved)
         An Warning Event occured.  EventID: 0x8000051C
            Time Generated: 07/15/2007   16:17:27
            (Event String could not be retrieved)
         ......................... DC1 failed test kccevent
      Starting test: systemlog
         * The System Event log test
         An Error Event occured.  EventID: 0x00000423
            Time Generated: 07/15/2007   16:14:01
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000416
            Time Generated: 07/15/2007   16:14:01
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000423
            Time Generated: 07/15/2007   16:14:30
            (Event String could not be retrieved)
         ......................... DC1 failed test systemlog
      Test omitted by user request: VerifyReplicas
      Starting test: VerifyReferences
         The system object reference (serverReference)
         CN=DC1,OU=Domain Controllers,DC=zxy,DC=xy and backlink on
         CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         are correct.
         The system object reference (frsComputerReferenceBL)
         CN=DC1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=zxy,DC=xy
         and backlink on CN=DC1,OU=Domain Controllers,DC=zxy,DC=xy are correct.
         The system object reference (serverReferenceBL)
         CN=DC1,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=zxy,DC=xy
         and backlink on
         CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zxy,DC=xy
         are correct.
         ......................... DC1 passed test VerifyReferences
      Test omitted by user request: VerifyEnterpriseReferences
      Test omitted by user request: CheckSecurityError
  
   Running partition tests on : ForestDnsZones
      Starting test: Cro***efValidation
         ......................... ForestDnsZones passed test Cro***efValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
  
   Running partition tests on : DomainDnsZones
      Starting test: Cro***efValidation
         ......................... DomainDnsZones passed test Cro***efValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
  
   Running partition tests on : Schema
      Starting test: Cro***efValidation
         ......................... Schema passed test Cro***efValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
  
   Running partition tests on : Configuration
      Starting test: Cro***efValidation
         ......................... Configuration passed test Cro***efValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
  
   Running partition tests on : zxy
      Starting test: Cro***efValidation
         ......................... zxy passed test Cro***efValidation
      Starting test: CheckSDRefDom
         ......................... zxy passed test CheckSDRefDom
  
   Running enterprise tests on : zxy.xy
      Starting test: Intersite
         Skipping site Default-First-Site-Name, this site is outside the scope
         provided by the command line arguments provided.
         ......................... zxy.xy passed test Intersite
      Starting test: FsmoCheck
         GC Name: \\DC1.zxy.xy
         Locator Flags: 0xe00003fd
         PDC Name: \\DC1.zxy.xy
         Locator Flags: 0xe00003fd
         Time Server Name: \\DC1.zxy.xy
         Locator Flags: 0xe00003fd
         Preferred Time Server Name: \\DC1.zxy.xy
         Locator Flags: 0xe00003fd
         KDC Name: \\DC1.zxy.xy
         Locator Flags: 0xe00003fd
         ......................... zxy.xy passed test FsmoCheck
      Test omitted by user request: DNS
      Test omitted by user request: DNS
 
例:如有出错的信息
在第一行会给出一个错误信息的号,如:1753
可以在命令提示符下用net helpmsg 1753,就会出给帮助提示:终结点映射器中没有更多的终结点可用(一般是路由端口被封掉了)
有的出错信息会帮例出来,有的不会例出来,没有例出来的可以去查微软的文档库。
 
第九把剑:纯钧之“Err
纯均是一把尊贵无双之剑
剑气激射指数:7.5
1、错误代码(Error)查看工具
2、必备的排错工具
3、下载:
[url]http://www.microsoft.com/downloads/details.aspx?familyid=be596899-7bb8-4208-b7fc-09e[/url]02a13696c&displaylang=en
E rr.exe解压到c:>tool\err目录下,例:c:>tool\err>err 1753就会显示出详细的出错信息。
 
第八把剑:鱼肠 之“KB
鱼肠剑是一把勇绝之剑
剑气激射指数:8
1Knowledge Base(知识库)
2、微软最重要的知识共享系统,解决实际技术问题的电子字典
[url]http://support.microsoft.com/search/?adv=1[/url]
 
第七把剑:干将之“ Rcontrolad
干将、莫邪是一把挚情之剑
剑气激射指数:8.5
1Directory Remote Control Add-On
2、使AD管理员更方便的进行远程管理
3windows 2003 Resource Kit工具
下载:
[url]http://www.microsoft.com/downloads/details.aspx?FamilyID=[/url]0A91D2E7-7594-4ABB-8239-7A7ECA6A6CB1&displaylang=en
用法:把Rcontrolad下载后,解压到一个文件夹,然后点用rcontrol_setup.exe进行安装,最后,把解压文件中的rcontrol.exe复制到 windows目录中去。如果你想远程管理那台计算机,可以打开AD用户和计算机,在里面找到想要管理的计算机点右键,里面就会多出一个Remote Control菜单,点上就可以进行远程控制了,相同于远程桌面。实际意义,如果就三、四需要远程管理那可以用远程桌面,如果上千台的话,不可能全部记住IP地址或计算机名,用Rcontrolad就可以方便的进行管理。所有域里只需要安装一次。
 
第六把剑:莫邪之“G etSID
干将、莫邪是一把挚情之剑
剑气激射指数:8.5
1Get User Security ldemtifier
2、将用户解析成SID
3、通过安装Windows Support Tools获得
用法:getsid \\server1 account \\server2 account比较两个不同域用户的SID
PSGetSID
知道SID解析成帐号
Windows 操作系统中的常见安全标识符
Well-known security identifiers in windows operating systems(243330)
一些常见的内建用户他们的SID都是有规律的,记住会有很大的帮助的。
 
 
第五把剑:×××龙渊之“Whoami
×××龙渊是一把诚信高洁之剑
剑气激射指数:8.8
1、获取当前登录用户的完全信息
2、权限问题排错的重要工具
用法:whoami /all >c:whoami.txt
可以查看当前登录的用户,所属的组、权限等等。有些时候不要太相信图形界面所显示的东西,用whoami可以看得更清楚。
 
 
第四把剑:泰阿之“SecEdit
泰阿剑是一把威道之剑
剑气激射指数:9.3
1Security Editor
2、安全策略编辑分析的命令行工具,常用于分析最终有效权限
3windows 2000/xp/2003操作系统自带
用法:
Secedit /export /mergedpolicy /cfg c:\secedit.txt /verbose(最常用的选项)
可以在域上设很多的安全策略,那么到最终的用户权力是什么呢?设的时候可以用图形界面去做,当你去做排错,去做维护的时候最好用命令行工具
 
 
第三把剑:赤霄之“AccessEnum
赤霄剑是一把帝道之剑
剑气激射指数:9.7.
1Access Enumerate
2、非常强大的权限分析工具
1)文件目录、注册表
2)可进行比较
3)对于权限修改管理有帮助
下载:
[url]http://www.microsoft.com/china/technet/sysinternals/utilities/AccessEnum.mspx[/url]
主要是看能做什么,whoami看的是我是谁。几乎是个全能型的工具,是个图形界面的。还可以把分析结果保存以便在以后分析做一个对比。还可以看注册表。
 
第二把剑:湛泸之“AutoRuns
湛泸剑是一把仁道之剑
剑气激射指数:10
1、检查自动加载项
2、通常中来解决登录慢或恶意程序删除
下载:
[url]http://www.microsoft.com/technet/sysinternals/utilities/Autoruns.mspx[/url]
有两个版本autoruns(图形方式)和autorunsc(是命令行方式的)如果用msconfig的话,例出的不全。
 
第一把剑:轩辕夏禹剑之“UPHClean
轩辕夏禹剑是一把圣道之剑
剑气激射指数:无穷大。
1User Profile Hive Clean
2、强大的用户Profile“Handle Leak”解决工具
3、技术背景
1)何谓Hive?何谓Handle Leak?
Hive:跟用户相关的注册表,注销的话这个用户的注册表项会被卸载,登录会被加载。登录时将会加载到注册表HKEY_USERS下面
2)常见的Handle Leak问题与影响
一种情况,例一些硬盘扫描的工具,最常见见的一种就是杀毒软件,杀毒软件正在写注册表的时候,你要注销,如果这个杀毒软件设计的不好,你注销的时候要把他的Handle给关掉,你会关不掉,由于设计的原因或集成了一个很高的权限,当前的用户没有那么高的权限关不掉,这时你注销的时候就会有个很长很长的时间,就会看到“windows正在保存你的个人信息”保存很久就是关不掉,这时就在关Handle和一些其它的事情,最后会强制的把Handle给断掉,这就会把用户的信息给丢了,下次登录时就会发现有些设置没了。99%是因为代码没有按规范去写。2003就会很快。2003会强制关掉。2000就会很慢。
3)以前使用DbgView等复杂的工具进行高度,非常耗时
下载:
[url]http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E[/url]2F3582&displaylang=en
用处:在注销和关机的时候你发现非常非常慢的时候,另外一种就是你公司有终端服务器,这个工具会帮助你。
Hive:跟用户相关的注册表,注销的话这个用户的注册表项会被卸载,登录会被加载。
 
UPHClean安装完后,会启动一个服务User Profile Hive Cleanup,安装后,就会自动的去干掉那个不能释放的Handle注册表语柄,然后去看事件日志,里面有几个关于UPHClean的日志,其中有一个就会告诉你是那个程序不能释放的Handle注册表语柄。在企业里装的应用多不知道那个影响了Handle Leak,这个就会告诉你。
 
优点:
1、是以服务来安装的,机器启动他就启动了
2、安装和卸载都不用重启,我们一个很大的麻烦在一个大的环境里面机器是不让重启的。
3、能够直接检测
4、简单