Active Directory Office 365 sync problems

Setup is Directory Sync to Office 365 hybrid (ie write back some AD attributes from Office 365) with password sync.

On initial sync there were some problems not found with the Office 365 pre-check tool.

A few users had inadequate permissions to write-back AD attributes. This was caused by them not inheriting security in AD. Switching inheritance back on fixed the problem immediately. Why they had been set to not inherit many years ago remains a mystery.

Another user who had moved to a different role just would not sync due to a duplicate attribute. The sync tool 'helpfully' omitted which attribute was in conflict.  The user in question had been copied from the original user and then changed and the original user left in place for business reasons. After some time including checking every (visible?) AD attribute no duplicates could be found. The (very useful) idfix tool did not spot any problems either with this record. Google/Bing for idfix.
I added the person to my Outlook to take a look what they had in their mailbox and 2 copies of the same mailbox appeared - very strange- never seen that before. I then removed the person from my Outlook only for 1 of the mailboxes to remain. It seemed obvious that the record had some major problem.The person in question no longer required the account and it was deleted in AD. 2 syncs later the problem had gone. It would have been useful to know exactly what was failing the unique constraint. I am sure it would be pretty easy for the programmers to report this information in the sync failure email you get sent.

I strongly recommend you pin the sync tool UI to the taskbar / desktop as you might be looking at it more than you had hoped at the start!

You can find it here (could change with future versions):
C:\Program Files\Windows Azure Active Directory Sync\SYNCBUS\Synchronization Service\UIShell\miisclient.exe

When you look at the on screen log of what it does automatically it is easy to run manual syncs by mimicking the steps it takes. There is a PowerShell command start-onlinecoexistencesync but you will be needing the GUI to track down problems. This GUI is actually a poor man's very crude AD auditing tool as you can see how many and the nature of changes to your AD and roughly when they happened but not who did it. It is certainly better than nothing, and is a good spin-off benefit of having installed the software.

It can save time when troubleshooting to change the default sync time from 3 hours to 5 minutes so the sync tool keeps attempting to sync whilst you are troubleshooting without you having to run anything:

To do this change the file:
C:\Program Files\Windows Azure Active Directory Sync\Microsoft.Online.DirSync.Scheduler.exe.Config

temporarily from this:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <appSettings>
    <!--the interval in hours-->
    <!--refer for valid values:http://msdn2.microsoft.com/en-us/library/system.timespan.parse.aspx-->
    <add key="SyncTimeInterval" value="3:0:0" />
  </appSettings>
</configuration>

to this:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <appSettings>
    <!--the interval in hours-->
    <!--refer for valid values:http://msdn2.microsoft.com/en-us/library/system.timespan.parse.aspx-->
    <add key="SyncTimeInterval" value="0:5:0" />
  </appSettings>
</configuration>

Set it back to your selected sync time afterwards - I would not recommend leaving it at 5 mins!

Happy syncing

Windows Azure Backup Setup via Powershell

This a follow on article from

http://maneffa-it.blogspot.co.uk/2012/05/new-features-in-windows-server-2012-for.html

Windows Azure Backup Vault is a great way to get an incremental and compressed off site backup. In my testing of the preview over several months and 100 gb  it 'just worked', and was superior to all the other 3rd party mechanisms I tried.

Here is the PowerShell needed to set up a Windows Azure Backup policy. It is mostly self explanatory, and assumes you have already saved a certificate into the store on the local machine.

You will need to create and upload a service certificate - here is an example to create a certificate, make sure you use a recent version of makecert as some older versions I had lying about did not like the option for certificate length, but failed silently!

makecert.exe -r -pe -n CN=mybackup -ss my -sr localmachine -eku 1.3.6.1.5.5.7.3.2 -len 2048 -e 04/24/2016 mybackup.cer

Now login to the Azure portal and upload this new certificate to your Backup vault. You are now ready to set up the backup.

Firstly set up the server using the certificate and your chosen encryption password.
$cert = Get-OBCertificateListFromLocalStore
$cert

CertificateThumbprint : <thumprint>
IssuedTo              : backup
IssuedBy              : backup
ExpirationDate        : 24/04/2016 00:00:00
IntendedPurpose       : Client Authentication

$item = Get-OBRecoveryService -Certificate $cert[0]
Start-OBRegistration  -RecoveryService $item[0]

ConvertTo-SecureString -String very_long_password_goes_here -AsPlainText -Force | Set-OBMachineSetting

Now set up the backup. here we are setting a backup of the directory d:\azure_backup, which I am robocopying files into during the day and the backup takes place each night at 2 am. The files are relatively small and static so robocopy ensures we only copy updated versions.

$mon = [System.DayOfWeek]::Monday
$tue = [System.DayOfWeek]::Tuesday
$wed = [System.DayOfWeek]::Wednesday
$thu = [System.DayOfWeek]::Thursday
$fri = [System.DayOfWeek]::Friday
$sat = [System.DayOfWeek]::Saturday
$sun = [System.DayOfWeek]::Sunday

$policy = New-OBPolicy
$filespec = New-OBFileSpec -FileSpec d:\azure_backup
$sched = New-OBSchedule -DaysofWeek Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday -TimesofDay 02:00
$ret = New-OBRetentionPolicy -RetentionDays 30
Add-OBFileSpec -Policy $policy -FileSpec $filespec
Set-OBSchedule -policy $policy -schedule $sched
Set-OBRetentionPolicy -policy $policy -retentionpolicy $ret
Set-OBPolicy $policy

This next line sets the machine to throttle the uplink bandwidth to 10 meg during working hours and 50 meg outside working hours. This server does not use a proxy, although you can specify a proxy if that is how your system is set up. Remember most ADSL type connections have very limited uplink bandwidth compared to this fibre connection so if you are using ADSL make sure you do not swamp the uplink bandwidth as this will dramatically affect downloading as well!

Set-OBMachineSetting -WorkDay $mon, $tue, $wed, $thu, $fri, $sat, $sun -StartWorkHour "7:00:00" -EndWorkHour "22:00:00" -WorkHourBandwidth (10000*1024) -NonWorkHourBandwidth (50000*1024)

The first backup will take a long time, but subsequent backups will be much shorter.

New features in Windows Server 2012 for medium size enterprises

Windows Server 2012 online backup

(Note: this commentary is based on beta software and is subject to change)

I have been looking round for some time for a new backup system on a simple file server/print server type server that meets the following criteria:

• Reliability – something that just works every day without intervention, and lets you know when there is a problem. Many expensive backups systems are overly complex and require intervention.
  
• Offsite storage – preferably pre-compressed and encrypted before departure to reduce bandwidth and provide guaranteed data safety once the data has left premises.
  
• Multiple versions of backup - so you can restore files from specific days.
  
• Integrity check of backed up data to guarantee it can be restored.
  
• Incremental backups –not in the true sense of the terminology but a system that only backs up changes at block level.
  
• Cheap to buy – dedicated backup software is far more expensive than it should be.
  
• Scriptable – for automation .

I have tested various lower cost software solutions that backup to the cloud, frequently using Amazon as a storage medium. None of them did exactly what I was looking for or were robust enough to employ as an enterprise solution in my opinion. I was particularly concerned of the quality of the software that deals with ‘below the waterline’ activities such as the VSS module.

After a while I wished that Microsoft would modify the excellent Windows Server Backup wbadmin Server Backup Utility (that I have used very successfully since Server 2008 on tens of thousands of backups) to use Azure or Skydrive storage, or something similar as the backup target. My prayers were answered when I read this article that Microsoft were going to do just that. Maybe this has been a common request and I wasn’t alone! http://blogs.technet.com/b/windowsserver/archive/2012/03/28/microsoft-online-backup-service.aspx
I put my name down on Microsoft Connect for the free beta trial and subsequently got a key. I created a W8 Beta VM and installed the software/set up the Microsoft storage account in about 10 minutes. I am not going to tell you how to setup the software as the link above tells you everything you need to know to install (check the official documentation after RTM) and it is very simple. You will also find this beta documentation very helpful, especially for scripting information (again, may change after RTM). http://www.microsoft.com/en-us/download/details.aspx?id=29005

The only problem was the 10gb cloud storage limit, which is hardly enough to trial a real fileserver, but this was soon lifted to 100gb, which makes the test adequately realistic.

I loaded some test data and…it just worked. I left it for a few days and recovered some data and …it just worked. I had chosen some highly compressible data to backup and it was being compressed to about ¼ of its original size.

As a version 1 piece of software this is a great effort. Obvious omissions are bare metal recovery and support for Exchange / SQL Server. I can live without direct bare metal recovery on a simple fileserver as if you are following good practice and separate the OS and Data onto different volumes, you can effectively perform a bare metal recovery – it just takes longer to recover.

My suggestion would be to back up the C = OS drive separately using normal backup (wbadmin) and store this OS backup on the D (Data drive) then backup the whole D drive using online backup Backup 1 – using wbadmin– backup OS volume only to say D = Data drive
C:\Users\Administrator>wbadmin start backup -backuptarget:d: -include:c: -allcritical -vssfull

Backup2 – Online backup of D = Data drive (also includes OS backup) to Microsoft cloud

Bare metal recovery should be simple.

1) From the online backup console start recovering the WindowsImageBackup directory of C (= OS) to a file share, VHD, USB – whatever is your preference

2) Put a Windows Server 2012 DVD in a server and take the recovery option using the downloaded WindowsImageBackup folder as the recovery media target

3) Restore the OS

4) From the newly restored machine restore the D=Data drives etc from cloud storage

It is not clear whether this new backup feature will ever support ‘transaction log based applications’ such as SQL Server and Exchange. The restore module of Exchange is for example very specific in what it will restore. This new online backup feature looks excellent, and hopefully the storage pricing will be reasonable.