Archive for category: CionSystems

Users with Windows servers may occasionally encounter an issue when an imported certificate disappears from the list of server certificates. Most often, this happens right after completing certificate request in Internet Information Services (IIS) Manager .

The lists of server certificates in IIS contains only certificates that are assigned to the corresponding private key and generated along with the certificate signing request (CSR) user for activating a particular certificate. When the link between certificate and private key is broken for some reason, the certificate disappears.

In order to make the certificate reappear, you will need to force the link between the certificate and the private key using the following steps.

1. Open the Microsoft Management Console (MMC) on your server machine. Make sure that you are logged as administrator before proceeding. To open MMC, press Win+R combination, type in mmc and click OK.

2. In File menu, select Add/Remove Snap-in.

3. In the Add or Remove Snap-ins dialogue window, select Certificates and click Add.

4.  Choose Computer Account in the Certificates snap-in window, click Next

5. Tick Local computer in the Select computer box, then click on Finish.

6. The required snap-in is selected now. Click the Ok button to proceed. The snap-in is added to console.

7.   Locate the certificate that was imported when completing certificate request. The certificate should be in Personal store. Note that icon of the certificate next to the domain name does not have a key on it. Means that no private key is assigned to the certificate.

8. Double –click the certificate and go to Details tab.

9. In certificate details locate the serial number field, click on it and copy its value.

10.  Open Command Prompt by pressing Win+R and typing the cmd, then click OK. Type the command as below and press enter.

11. In the command prompt type : certutil –repairstore my Serial_number xxxxxxxxxxxxxxx.( Note: Make sure the serial number of your certificate does not contain any spaces. It should be single string of symbols.)

If you receive “Certutil: -repairstore command FAILED:0X800900100” error, this means that the certificate request was generated on another server, and the private key is absent on this one. You need to either transfer the key to your server via PFX file or create a new CSR code and reissue the certificate.

To restrict Group Policy for any user/group we need to follow the below steps.

1. Login to Cionsystems GPO Manager.

2. Select the group policy which has to be restricted and click on permissions tab.

3. From the GPO permissions  click on Add button and search for the user / group.

4.  Select the user / group and hit on ok.

5. In set permissions tab select read and apply group policy options as deny and hit on apply.

6.  It will take some time to process.

7. Once permissions set successfully it will pop up the message as “successfully added” and hit on ok.

8. Now added user /group is skipped by applying this group policy settings.

9. Once the permission is added then type the command  gpupdate/force in the command prompt.

How to check which GPO has the settings.

1. Login to Cionsystems GPO.

2. Select any GPO and check the status of GPO.

3. In above GPO Computer Settings User Configuration Settings were disabled.

4. To verify the GPO settings click on view option by right clicking on GPO.

5. As  below report is displaying only Computer Settings hence it conclude that GPO is having Computer settings Enable and User Settings  Disable.

6. In the same way we can check other GPO’s status also.

1. For restoration of  domain firstly we need to take the On Demand backup / Schedule Server backup.

2. If the backup location  is on the same machine no need to  configure any settings.

3. If the backup is on the remote shared  location then trust relationship must be there between parent domain and shared folder location domain.

4. Trust relationship should be configured. Please refer our article to configure trust relationship at the below given link.Create Trust from Remote  shared location domain.Configured the trust where the shared folder had been created.

http://blog.cionsystems.com/?p=1086

5. Once Trust is configured on remote shared folder domain then start the system state backup process from domain using CionSystems  AD Recovery Manager on Demand backup / Schedule backup.

6. Once backup is completed  go to AD Recovery Manager –>Server backup and Recovery –> AD Server backup’s history  and note down the version ID of the respective domain.

7.  After noting down the  Version ID.Go to AD Recovery Procedure tab and download Power Shell scripts .If  the DC  is 2012 and above download the power shell  script first.

8. If DC is 2008 and above then download  the second script as shown below.

9. If the domain is dead /crashed then follow the below steps  for restoration.

10. Let’s start with the restoration of DC.

11. Login to your machine in Directory Services Restore Mode.

12. If Directory Services Restore Mode is not enabled in safe mode then go to run command in normal mode and type                        msconfig and hit enter and reboot the machine.

13. Go to boot tab select  Safe boot  –>Select Active Directory Repair radio button and hit on Apply –>Click OK.

14. Click on restart button.The machine reboots in Directory Services Restore Mode.

15. Login to the machine with Local Admin account into Active Directory Services Repair mode.

16. After  login into Repair Mode  open the Script which was downloaded from the AD recovery manager.

17. Open the Power Shell script as shown below.

18. After opening the  Power shell script type “Y” and hit Enter.

19. Enter Version ID which was copied and hit on Enter key.

20. Enter the credentials User Name and Password where backup exist as below.

20. Hit Enter key.

21. Enter”Y” and hit Enter key. After hitting Enter key restoration process will start as shown below. It will display number of            files recovered.

22. It will display the recovery  % status  once restoration starts.

23. Once Recovery is completed system gets reboot after login with local admin account it goes to command prompt shown                 below.

24. Press Enter button and restart the machine in normal mode by unchecking  Active directory Repair option in system                     configuration tab.

25. Hit on apply and click on OK  it will pop up a window to restart the machine.

26. Click on Restart button.Machine will reboot in normal mode.

27. After reboot login with domain admin account.This is how the DC is restored.