Step by step - restore active directory objects from Windows backup

I accidentally deleted some active directory objects when I was deleting some Exchange mailboxes.  Chaos ensued, but I had to restore the active directory users.

Here's what Microsoft helped me do (step by step).

Boot into Directory services restore mode.  (see here for how: https://blogs.technet.microsoft.com/activedirectoryua/2008/11/20/how-to-start-in-directory-service-restore-mode-dsrm-in-windows-server-2008-and-windows-server-2008-r2/)

Log in

Open an elevated command prompt

type "wbadmin get versions"
This will give you all the backups that you can restore from.
Pay attention to the version identifier as this will define what backup you're working with.

type "wbadmin start systemstaterecovery -version:10/01/2016-04:30" where 10/01/2016-04:30 will vary based on the actual version that you are restoring from that you found when you ran "wbadmin get versions"

Choose yes twice.

Now, you'll need to wait 45 to 90 minutes while the system preps itself.  Ugh.

Next, you'll restore organization units (OUs) as a whole to the version the the OUs were at the time of the backup.  So for example, if I have an OU named accounting and I'm doing a restore on October 3, 2016 where the backup I'm restoring from is October 1, 2016 - all changes from 10/1/16 to 10/3/16 will be lost.

This gets less intuitive here.  After the system has loaded the backup, the system will ask you to reboot the server.  Don't do it.

Instead, launch a command prompt, type ntdsutil, and then press Enter.

1 .           Type activate instance ntds and press Enter.

2.            Type authoritative restore and press Enter.

3.            At this point, determine whether you're restoring an OU or an object. The previous table showed the syntax to restore either an OU or an object. Type the restore command and press Enter.

For example, to restore a user object, use the following format:

•             restore object dn

•             restore object "cn=Sally,ou=sales,dc=pearson,dc=pub"

Or, to restore an OU, use the following format:

•             restore subtree dn

•             restore subtree "ou=sales,dc=pearson,dc=pub"

NOTE

This increments the update sequence number (USN) so that all other DCs consider it the most recent change.

4.            Type quit and press Enter twice to exit ntdsutil.

5.            Restart the DC normally.

As an example. if you were restoring an OU called distribution groups which sits under an OU called MyBusiness, you'd type:

restore subtree "OU=distribution groups,OU=MyBusiness,DC=contoso,DC=local"
if you're not familiar with LDAP syntax (which I'm not), some googling and trial and error will help you find what you need.  If you type in the wrong values, the process willl just fail.

This is what a successful restore looks like.  Look at "successfully updated records"

What's weird for me in the two times I've tried this is that I rebooted once, and my 2008 R2 server had no internet connectivity and no restored AD items on first reboot.  I had reboot again to get my items and to get internet connectivity.  So weird.

Configuring VPN to work without regard to dial in policy

Per this page:

https://technet.microsoft.com/en-us/library/cc732252%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

1. Click Start, click Administrative Tools, and then click Network Policy Server. The NPS console opens.
2. Double-click Policies, click Network Policies, and then in the details pane double-click the policy that you want to configure.
3. In the policy Properties dialog box, on the Overview tab, in Access Permission, select the Ignore user account dial-in properties check box, and then click OK.

You can enable NPS (Network Policy Server) to work without regard to the user's dial-in setting.  For years, I've been manually marking people with Allow for Dial-in as in below.

Windows 10 Anniversary Update download location

Since it seems to take me 30 seconds to wade through various pages to find the Windows 10 anniversary update, I'm documenting the best link here:

http://go.microsoft.com/fwlink/?LinkID=823759

SSL certificate errors on Outlook for Mac caused by Outlook bug

Outlook 2016 for Mac has a bug in it that causes Outlook to show a security error when connecting to an Exchange server even when the Exchange server and all parts are properly configured.  This post will talk about what the error looks like and how to make the error disappear.

When opening or configuring Outlook for Mac that connects to an Exchange account, users will get an error like this:

You can hit "continue" to get through the error, but to remove the error forever more . . .

Hit "Show Certificate"
Check the box for "Always trust"
Hit Continue
Enter your password at the prompt that comes up.

Moving Quick Parts from one computer to another

I have one client who loves Quick Parts (preformatted sections of text you can insert into the body of an email in Outlook).  I'm documenting how to move those Quick Parts from one computer/profile to another.

The Quick Parts are stored in Normalemail.dotm

You can simply move that single file from profile to profile or computer to computer from the standard location overwriting the default normalemail.dotm).  The default location is:
 
c:\users\%username%\appdata\roaming\microsoft\templates

Removing email proxy addresses from AD (helpful if you sync your AD to Office365)

Right now, this is a partial post while I get the PowerShell scripting components together. I needed to remove all the proxy addresses for a certain domain in advance of removing that certain domain from our Office365 account. Because we sync our local AD with Office365, I need to remove the proxy addresses from the local AD.  I could do this manually, of course - which is long and inefficient.  The crucial command I used is this one:

Set-ADUser username -Remove @{ProxyAddresses="smtp:username@domain.com"}

I ran this from "Active Directory Powershell for Windows PowerShell"

Because I'm not good enough with PowerShell yet, here's what I did.  I tried to remove the domain from the account in Office365.  Office365 returned all the mailboxes that had the domain as aliases.  I copied and pasted the list of mailboxes to Excel.  I extracted the mailbox user names from the list and made a single column in Excel of those mailbox names (in my case - our domain uses a username of joe.smith as the username for Joe Smith) so the single column included Joe.Smith.  Then I did a mail merge with that list to create a get that PowerShell command listed above to be individualized with each username.  And then I copied and pasted those commands into PowerShell.  Not ideal.  Ideally, you'd have a foreach command that would run though all AD users, but this is a story about what I did at this moment.  I'll update this post.

update rollups for Windows 7 or other OSes (convenience updates)

If (for some reason) Windows update isn't working, which oddly I've seen a couple times in the last week when I needed to update Windows 7 in advance of a Windows 10 update (the checking for updates progress bar just cycles and cycles for hours) . . .

You can install update via a "convenience" update.

As an example, here's a convenience update for convenience update for Windows 7 and Windows 2008:

https://support.microsoft.com/en-us/kb/3125574

Before installing the update, install the April 2015 servicing stack update from here:
https://support.microsoft.com/en-us/kb/3020369

Also - you may need to stop the "Windows Update" service so that the convenience update does not try to check for existing updates since the Windows Update service has already shown instability.