Re: [ActiveDir] Is it 2000 or 2003?

Paul Williams Fri, 17 Nov 2006 02:37:04 -0800

Interesting, you're more than likely doing it in a more efficient mannerthan I then.

Here's the code I use in all of my scripts (for anyone who's interested inthis) these days (I liked the way ADFIND and ADMOD output this info. sothought I'd steal Joe's idea and wrap this info. into all my scripts that dosomething with the DS):



' ***********************************************
' Sub printDirectoryInfo(RootDSE)
'
' Sub prints the DC that is being used and the
' level of the directory service.
'
' Note.  Sub calls func getDSFunctionality
'
' ***********************************************
Private Sub printDirectoryInfo(oRootDse)
Dim sServer, sDSFunctionality

sServer = oRootDse.get("dNSHostName")
sDSFunctionality = _
 getDSFunctionality(oRootDse.get("domainControllerFunctionality"), _
  oRootDse.get("supportedCapabilities"))

echo"Using server: " & sServer
echo"Directory: " & sDSFunctionality & vbCrLf
End Sub



' ***********************************************
' Func getDSFunctionality(int)
'
' get the domain functional level for info.
' purposes function returns a string defining the
' current value of the DC queried (via serverless
' bind)
'
' ***********************************************
Private Function getDSFunctionality(iDSFunctionality, _
 cSupportedCapabilities)

Dim oBase, dsf, nTMixedDomain, supportedCapability, bFlag
bFlag = False

Select Case iDSFunctionality
 Case 0
  Set oBase = oRootDse.get("defaultNamingContext")
  nTMixedDomain = oBase.get("nTMixedDomain")

  If(nTMixedDomain=1)Then
   dsf = "Windows 2000 Native"
  Else
   dsf = "Windows 2000 Mixed"
  End If
 Case 1
  dsf = "Windows Server 2003 Interim"
 Case 2
  For Each supportedCapability In cSupportedCapabilities
   If(supportedCapability = _
     LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID)Then
    bFlag = True
   End If
  Next

  If(bFlag)Then
   dsf = "Active Directory Application Mode (ADAM)"
  Else
   dsf = "Windows Server 2003"
  End If
End Select

getDSFunctionality = dsf
End Function



' ***********************************************
' Sub echo(String)
'
' Sub prints the passed string to the console
' (if run from CSCRIPT) or to the shell via
' message box (if run from WSCRIPT).
'
' ***********************************************
Private Sub echo(sOuputString)
WScript.Echo(sOuputString)
End Sub


--Paul

----- Original Message -----From: "joe" <[EMAIL PROTECTED]>

To: <ActiveDir@mail.activedir.org>
Sent: Thursday, November 16, 2006 6:32 PM
Subject: RE: [ActiveDir] Is it 2000 or 2003?

AdFind only determines the Directory level, it doesn't look for functional
modes or mixed mode. The way I get directory level is through the
supportedCapabilities attribute of the rootdse of the DC. Of course it is

possible to hit one DC looking for info and I pull the ROOTDSE from thatDCand then in the background a referral is processed which ends up gettingthe

info from another DC in another domain (or same domain if looking at app
parts).

You can get functionality modes from the rootdse attributes
domainFunctionality and forestFunctionality.

For all of those, just do an

AdFind -rootdse

And you will see what I am decoding and logically how I ascertaindirectory

level.



Mixed mode versus native you simply use the domain NCs nTMixedDomain
attribute.

  joe


--
O'Reilly Active Directory Third Edition -
http://www.joeware.net/win/ad3e.htm


-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Paul Williams
Sent: Thursday, November 16, 2006 11:50 AM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] Is it 2000 or 2003?

I don't understand where you are seeing this info. Are you referring tothe


applet that is used to raise the FL?  Or something else?

As for the "flag" that is used to identify the directory, it is usually a
combination of:

msDS-Behavior-Version
nTMixedDomain
supportedCapabilities


Or at least, that is the way I put info. such as server and directory in
each of my scripts.  Just like Joe does in ADFIND and ADMOD.  I believe he
does it the same way too.

Basically, check msDS-Behavior-Version. If it's 0, check nTMixedDomain.If


it's 2, check supportedCapabilities to see whether or not it is ADAM (it's
ADAM if one of the supportedCapabilities is 1.2.840.113556.1.4.1851
[LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID]).

In my test lab(s), my directory is considered a 2003 directory.

In my labs, I used either DOMAIN.MSC or ADMOD to increase the FLs.


--Paul

----- Original Message -----From: <[EMAIL PROTECTED]>

To: <ActiveDir@mail.activedir.org>
Sent: Thursday, November 16, 2006 3:45 PM
Subject: RE: [ActiveDir] Is it 2000 or 2003?

I've entered this thread late so apologies if the below has already been
stated:

I recently created a new dev forest, with multiple domains. I too raised
DFL and FFL as soon as all domains were built.

I do not see the issues you describe and would suggest you download the
scripts available here http://www.jadonex.com/

One of the scripts (written by Dean) checks the DFL and FFL for the
forest and across all domains.

For a manual check, I also look here:

FFL
===
CN=Partitions,CN=Configuration,DC=xxx
Attribute msDS-Behavior-Version
0=w2k FFL, 1=interim FFL, 2=w2k3 FFL

DFL
===
CN=<domainName>,CN=Partitions,CN=Configuration,DC=xxx
Attribute msDS-Behavior-Version
0=w2k DFL, 1=interim DFL, 2=w2k3 DFL

Hope that helps,
neil

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Tim Onsomu
Sent: 16 November 2006 14:35
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Is it 2000 or 2003?

I got curios about this and decide to dcpromo my vm image of windows
2003 R2.

After the AD installation (which sits at Windows 2000 for domain type) I
raised the functionality for the domain and forest.

The result for domain type was windows 2000.

I am not sure it is supposed to be different.

Anybody out there who can say their install says something else?



-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Susan Bradley,
CPA aka Ebitz - SBS Rocks [MVP]
Sent: Wednesday, November 15, 2006 3:15 PM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] Is it 2000 or 2003?

Were these clean installs or inplace?

Bart Van den Wyngaert wrote:

Well I also have a strange thing... It concerns 2 SBS 2003 systems.
Some months ago I raised both domain and forrest functional level on
those boxes. By reading this thread I decided to have a look...

Both tools report the correct OS actually on both boxes.

The only I wonder is a bit that they both report with the gpresult
tool that the domain type is Windows 2000....

If I look using GUI, they both report functional level of domain &
forest being at 2003.

Don't really get actually. Is this related? Normal or missed something

when I did raise the functional levels?

Thanks,
Bart

On 11/10/06, Noah Eiger <[EMAIL PROTECTED]> wrote:

Good question. DFL = 2003 and FFL = 2003. So it must just be some
lingering text string. Does anyone think there is more it?

Thanks.

-- nme

-----Original Message-----
From: Clingaman, Bruce [mailto:[EMAIL PROTECTED]
Sent: Friday, November 10, 2006 9:39 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Is it 2000 or 2003?



What does it say under:  AD Users & Computers | [right click domain
name] | Raise Domain Functional Level...

?


-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Noah Eiger
Sent: Friday, November 10, 2006 11:12 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Is it 2000 or 2003?

Hi -



Several months ago, I upgraded a small, multi-site domain from W2k to

W2k3. Or so I thought. The various markings in the schema indicate
that the upgrade was successful. But when I run, for example,
gpresult, it reports a Windows 2000 domain. Is this just some flag or

string that did not get set properly or is there really a problem

with the upgrade?




Thanks.



-- nme



P.S. I also just noticed that when I run netdiag on a new W2k3EN DC,
it says "System info: Windows 2000 Server (Build 3790)".




--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.409 / Virus Database: 268.13.32/523 - Release Date:
11/7/2006


List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir@mail.activedir.org/

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.409 / Virus Database: 268.13.32/523 - Release Date:
11/7/2006


--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.409 / Virus Database: 268.13.32/523 - Release Date:
11/7/2006


List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir@mail.activedir.org/

List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir@mail.activedir.org/


--
Letting your vendors set your risk analysis these days?
http://www.threatcode.com

If you are a SBSer and you don't subscribe to the SBS Blog... man ... I
will hunt you down...
http://blogs.technet.com/sbs

List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/


List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/



PLEASE READ: The information contained in this email is confidential and
intended for the named recipient(s) only. If you are not an intended
recipient of this email please notify the sender immediately and delete
your
copy from your system. You must not copy, distribute or take any further
action in reliance on it. Email is not a secure method of communication
and
Nomura International plc ('NIplc') will not, to the extent permitted by
law,
accept responsibility or liability for (a) the accuracy or completeness
of,
or (b) the presence of any virus, worm or similar malicious or disabling
code in, this message or any attachment(s) to it. If verification of this
email is sought then please request a hard copy. Unless otherwise stated
this email: (1) is not, and should not be treated or relied upon as,
investment research; (2) contains views or opinions that are solely those
of
the author and do not necessarily represent those of NIplc; (3) is
intended
for informational purposes only and is not a recommendation, solicitation
or
offer to buy or sell securities or related financial instruments.  NIplc

does not provide investment services to private customers. Authorisedand

regulated by the Financial Services Authority.  Registered in England
no. 1550505 VAT No. 447 2492 35.  Registered Office: 1 St
Martin's-le-Grand,
London, EC1A 4NP.  A member of the Nomura group of companies.

List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/


List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/

List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx

List archive: http://www.mail-archive.com/activedir@mail.activedir.org/


List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/

Re: [ActiveDir] Is it 2000 or 2003?

Reply via email to