Command Line User Administration Tutorial for Windows User ?

People working on linux machine when shift to windows machine for sometimes or accidently, then they also like to work on command line even on windows machines.This article is all about how to manage user through command line in windows machine This tutorial is helpful not only for computer geeks,working employee but also for students who love to work in command mode even in Windows PC .In this article like unix/linux we will learn how to manage users in CLI mode on windows machine.We learn how to create,delete,list,see users and manage them.
 
See list of users present in your windows machine.If you are working on a windows machine and you want to know how many users are in this machine you can use "net users" command to see the list.Even few more intresting commands are available there to show you the users in brief and in detail.

C:\Users\slashroot>net users User accounts for \\SLASHROOT-PC  ------------------------------------------------------------------------------- Administrator            Guest                    linux root                     slashroot The command completed successfully.

Even you can use wmic command to see brief and full information of list of users available in your windows machine.

C:\Users\slashroot>wmic useraccount list brief C:\Users\slashroot>wmic useraccount list full C:\Windows\system32>wmic useraccount get name

See the list of users groups present in your local machine.

C:\Windows\system32>net localgroup

Know the username of loged in user.
If you want to know what the exactly name of the user you are loged in you can use below command .

C:\Users\slashroot>echo %username%

Know who loging now.
This command is same as it is in unix based machine and helps you to know user from which you logged in, in both wondowa and unix/linux.
C:\Users\slashroot>whoami

Adding a new user.
If you want to add a new user to youe windows machine you can use any of two command given below.

C:\Users\slashroot>net user satish satish123 /add or C:\Users\slashroot>net user  /add slashroot slashroot123

Note:In above command satish and slashroot are the name of the users and satish123 and slashroot123 are their passwords.

See the detail information of a particular user.
If you want to know detail information about any existing users like their expiry date,full name etc  you can use this command.This command will give you complete details about an user.Here in example the command launched is used to see the detail information of user satish.

C:\Users\slashroot>net user satish

Deleting user in windows machine.
If you want to delete any of your existing user in your windows machine you can go with below command.

C:\Users\slashroot>net user  slashroot /del

Enable or Disable a Windows User.
When you purchase your Laptop or PC  with windows7/vista installed in it,Bydefault administrator user is disabled.So if you want to enable your administrator user you can use the below command with option "/active:yes ".In similar fashion if you want to disable your user you can use the same coomand with option "/active:no".

C:\Users\slashroot>net user  administrator /active:yes C:\Users\slashroot>net user  administrator /active:no

Force windows machine to generate random password for Your windows user.
If you want to use a strong password you can use this command and force windows machine to produce a random and strong password for your user.Here we use below command to add a user named satish and then generate a random password for him.

C:\Users\slashroot>net user  satish /random /add

Change password of any user.
Below command is used when you want to change the password of any user.Here we are going to change the password of user satish.

C:\Windows\system32>net user satish * Type a password for the user:Retype the password to confirm: The command completed successfully.

Stop users from changing their own password.
Bydefault users can change their password,but if you want user cannot change their own password you can use below command.

C:\Windows\system32>net user satish satish123  /passwordchg:no

But again if you change your mind and want to allow users to change their password you can simply use below command.

C:\Windows\system32>net user satish satish123  /passwordchg:yes

Set Expiry dates for users.
Bydefault account expires set to never.So if you want to set accout expiry date for user satish to Never you don't need to run any command because already account expires set to Never.

C:\Windows\system32>net user satish satish123  /expires:never

But if you want to set user account expiry date according to your requirement you can follow the below command.

C:\Windows\system32>net user satish satish123  /expires:mm/dd/yy

Now see the example:Here i am going to set account expiry date for user satish to 26th january2014.

C:\Windows\system32>net user satish satish123  /expires:01/26/2014

Disable password for a account.
We can disable or enable password for any windows user using below command.In your windows machine bydefault it is set to Yes which means there must have a password for that user.But if you want to disable user password you just use the option NO at last in below command.

C:\Windows\system32>net user satish satish123  /passwordreq:yes C:\Windows\system32>net user satish satish123  /passwordreq:no

Set time for user logon.
If you want your users to be always logged on you can use below command.This command is even more intresting so you can take help from windows command promt using  "?". It will show you many more options so that you can use it according to your needs.

C\Windows\system32>net user satish satish123  /times:ALL

Know Last Login Time of a User.
So how to know the last logged in time of a user in your windows machnie using command promt.

C:\Windows\system32>net user administrator | findstr /B /C:"Last logon"

Locking and Unlocking a User Account
So now learn how to lock and unlock a user account in windows machine using command promt.You can see below command to know how to lock or unlock windows users through CLI.

C:\Windows\system32>wmic useraccount where name='satish' set disabled=false C:\Windows\system32>wmic useraccount where name='satish' set disabled=true

How to add a user to group.
net localgroup groupname username /add

eg:we want to add user satish to a group named LINUX.
C:\>net localgroup LINUX satish /add

How to see the users of a specific group.
c:\>net localgroup groupname

eg:Below command will show us about the users of LINUX group.
C:\>net localgroup LINUX

How to delete a user from group.
Below syntax is for deleting any user from any group.
net localgroup groupname username /delete

eg:Suppose if you want to delete user satish from group LINUX then use below command.

net localgroup LINUX satish /delete

How to see the setting of current user.
Below command is used to see the all important settings of of current user.

net accounts
 
How to change the minimum password length:
Using this command one can change the minimum password length.It means no one can assign password below set minimum password length.

net accounts /MINPWLEN:5

How to set password expiry period
Now if you want to set expiry date for password you can use this command.In below example we are going to set password age to 120 days.

net accounts /MAXPWAGE:120

How to set the Password such that it never expire.

net accounts /MAXPWAGE:UNLIMITED

Above command will set password expiry date to never.

How to prevent users from reusing any previous passwords used in past.

net accounts /UNIQUEPW:4

Note:You have to run these commands as Administrator or got cmd promt and run as administrator if you are loggedin from any other user.

Using Local Internet Connection While Connected to a VPN

Occasionally work has to be done "out of hours" by IT Professionals to avoid disruption to users. Sometimes this can be done from a remote site with our feet up, a hot cuppa and an episode of friends. During these times, nothing is more valuable than a VPN connection to your workplace. It gives you connectivity to everything on your network as if you were sitting in your office. All you need at home is an internet connection and a computer. Both of which all IT Professional's tend to have.

I am not going to take you through the configuration of the VPN at either end. We are going to assume that your VPN at work is configured and that you have a connection setup on your home PC.

One of the main problems we encounter while using a VPN is with general local web browsing. Connected to a VPN your computer will try and use the same web connection that your PC at work uses. This can prevent your local browser from displaying the latest footie results.

This is easily solved:

When connected to the VPN your browser is trying to use the default gateway on the remote network (your workplace.) All you need to do is tell it not to.

I am using Windows 7 Enterprise 64 Bit.

Start by loading the Network and Sharing Center. Quick way is to Right Click "Network" on the Start Menu and select Properties. Now click "Change Adapter Settings."

With the VPN disconnected, right click your VPN connection and select "Properties."

Now select the "Networking" tab.

Select "Internet Protocol Version 4" from the list and click "Properties."

Click the "Advanced" button near the bottom.

Here is where the option is. Untick the "Use Default Gateway on Remote Network" box and click OK on everything to close all of the boxes.

Reconnect to your VPN. You should now be able to be connected to you remote network and still use your own local internet connection to browse the web at the same time.

NOTE: It is possible to use your workplace's internet connection to browse the web from your remote PC. However if they use a proxy and/or WPAD/Proxy.pac file it will require you to reconfigure your local browser settings. This can cause further issues.

Windows Server 2003 Service Timeout

Frequently on Windows Server 2003 when rebooting, a service may fail to start and the following message appears over the logon screen:

Or when trying to start or restart a service manually you may receive this message.

This is because the timeout delay is set to low for the service to complete its startup process and causes it to fail.

Increasing the timeout delay gives the service more time to load. It can be increase with a simple registry tweak.

• Load regedit (START - RUN - type regedit - Click OK.)
• Navagate to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control]
• Create a new DWORD value called "ServicesPipeTimeout"
• Set the value to 35000 - Decimal. This is the number of milliseconds that you want to give the services to start.

• Now the server will need a reboot. If it is a vital server, it is best to schedule one out of hours.

In Windows Server 2008 and Windows Server 2008 R2 an extra startup option has been added "Automatic (Delayed Start)" to the properties of all services.

This effectively can be used to achieve the same result, but instead of effecting the entire system, can be placed on an individual service. This feature prevents a service from starting until all other services are started. This can be extremely useful if you have a service you need started AFTER others have kicked in.

In my experience this is where I usually experience a timeout, where a service is trying to start, but is waiting for other services first, and eventually gives up. The are of course other scenarios.

*Thanks to the reader below, for pointing out that I had NOT explained this properly before. Hope this helps.

Windows 2003 Active Directory Setup

Windows 2003 Active Directory Setup: dcpromo

 Now that we have setup Windows Server 2003 on our virtual machine, and we have patched it with SP2, Installed an Antivirus and setup DNS, is time now to setup active directory using dcpromo. Read about how to install and configure DNS on Windows Server 2003 from my previous post.

Setting up active directory using the run command dcpromo is a straightforward procedure. To begin, from your windows 2003 server desktop go to Start click on Run and type dcpromo and hit Enter.
The “Welcome to the Active Directory Installation Wizard” should come up:

Click on Next.  On the following window, you will get a warning about comparability issues with other Operating Systems. Improve security settings in Windows Server 2003 affect older versions of windows:

After reading and thinking about consequences, click Next.  On the next screen, you will get two options. The first option asks you if you want the server to become a domain controller for a new domain or if you want the server to be an additional domain controller for for an existing domain:

Select the first option and click Next. On the next window, you will get three options. the first option is to setup the domain in a new forest. Select this option if its the first domain controller on your organization, or if you want it to be totally independent from any forest.
Option two: Child domain in an existing domain tree. select this option if you want the domain to be a child domain from an existing domain. option three: Domain tree in an existing forest. if you don’t want any of the above, select this option.

In our case, choose the first option, and click Next. On the next screen, we need to type the full DNS name for the new domain:

Type the full DNS name like helpdeskgeek.com, and click on Next. On the next screen, we need to choose the NETBIOS name. This is the name earlier version of windows users will be using to identify the new domain.

Choose the name, and click Next.  On the next screen, you need to select the location of where you want to store the database and log files. for best performance store them in separate disks.

Choose the location where you want the active directory database and logs, and click Next.
Next, the Shared system volume window will come up. here, you need to choose the location on where you want to store the SYSVOL files. this folder contains the domain public files and are replicated to all the domain controllers in the domain.

Choose the folder location, and click Next.  On the next window, the DNS registration diagnostic will show up. in here most likely you will get ” Diagnostic failed” and will give you three options. First option: it will allow you to perform the DNS diagnostic again,if you have corrected the problem.
Option two: it gives you the option to allow the active directory wizard to install and configure DNS for you, and use this DNS as the primary DNS for this server. third option, it allows you to bypass this window if you plan to correct the problem later on.

Even though we have already installed DNS on this server, we have not configure any of its services, so we will choose the option to Install and configure DNS server on this computer and set this computer to use this DNS server as its preferred DNS server. then click Next.
On the next window, you need to choose what type or permissions you want for users and group objects. Here you will get two options. the first options: select this option if you run server programs with pre-windows 2000. option two: select this option, if you only run windows servers 2000 and windows servers 2003 on your domain.

Select the second option, and click Next. On the next window, you need to enter the Directory services restore mode administrator password. This password is used when you start the computer in directory services restore mode. This account is different from the domain administrator account.

Type your chosen password, and click Next. Next, you will get the summary of all the options you have chosen during the active directory wizard. remember, the domain administrator account password is the same as the current local administrator password.

Click Next. the active directory installation should begin.

Some serious configuration processes going here. After a few minutes, active directory should be installed.

Click on Finish. and restart the computer.  Active Directory should be now installed.

Microsoft Service Packs

Support for Microsoft Service Packs

Key Resources

Windows

Office

Developer Products

Server Products

Internet Explorer and Online Services

Security Products

Business Solution Products

Service Packs

Windows 7

Windows Vista

Windows XP

Windows 2003

Windows 2000

Older versions

Additional Updates

Windows 7 Updates

Windows Vista Updates

Windows XP Updates

Older versions' Updates

Download Windows Server 2012 Release Candidate (RC)

The next release of Windows Server, Windows Server 2012, will offer businesses and hosting providers a scalable, dynamic, and multitenant-aware, cloud-optimized infrastructure. It securely connects across premises and helps IT Professionals to respond to business needs faster and more efficiently.

Windows Server 2012 Release Candidate (RC):

• Takes you beyond virtualization
• Delivers the power of many servers with the simplicity of one
• Opens the door to every app on any cloud
• Enables the modern work style

Need more information? See the product details page.

Register for Download and Guided Evaluation

Register to access technical product resources—forums, solution accelerators, white papers and webcasts—at the Windows Server 2012 RC Resource Page.

Review Windows Server 2012 RC Datacenter system requirements

Register for evaluation

Download and install full-featured software for a limited-time trial

Receive emails with resources to guide you and notification when the next release is available

Use blogs and forums to share tips

Download the 64-bit ISO GET STARTED NOW

Download the VHD GET STARTED NOW

ISO available in: Chinese (Simplified), Chinese (Traditional), English, French, German, Japanese, Korean, Portuguese (Brazil), Russian, Spanish, Swedish, and Turkish
VHD available in: English

Forcing the Removal of a Domain Controller

Applies To: Windows Server 2008, Windows Server 2008 R2

The procedures in this section describe how you can forcefully remove a domain controller running Windows Server 2008 or Windows Server 2008 R2. In Windows Server 2008 and Windows Server 2008 R2, you can forcefully remove a domain controller when it is started in Directory Services Restore Mode (DSRM).
Typically, you force the removal of a domain controller only if the domain controller has no connectivity with other domain controllers. Because the domain controller cannot contact other domain controllers during the operation, the Active Directory forest metadata is not updated automatically as it is when a domain controller is removed normally. Instead, you must update the forest metadata manually after you remove the domain controller. If you use the version of the Active Directory Users and Computers snap-in that is included with Windows Server 2008 or Windows Server 2008 R2. or the Microsoft Remote Server Administration Tools for Windows Vista (http://go.microsoft.com/fwlink/?LinkID=115118), you can clean up the metadata automatically by deleting the domain controller object.
The procedures in this section describe the following methods that you can use to forcefully remove a domain controller:

• Forcing the removal of a domain controller by using the Windows interface
  
  To use the Windows interface, you must start the Active Directory Domain Services Installation Wizard at the command line by running the dcpromo /forceremoval command.
  
• Forcing the removal of a domain controller by using the command line
  
  
• Forcing the removal of a domain controller by using an answer file
  
  

Forcing the removal of a domain controller by using the Windows interface

---

Administrative credentials
To forcefully remove a domain controller, you must be a member of the Domain Admins group.

To force the removal of a domain controller by using the Windows interface

---

1. At a command prompt, type the following command, and then press ENTER:
   dcpromo /forceremoval
   If the domain controller hosts any operations master (also known as flexible single master operations or FSMO) roles, or if it is a Domain Name System (DNS) server or a global catalog server, warnings appear that explain how the forced removal will affect the rest of the environment. After you read each warning, click Yes. If you want to suppress the warnings in advance of the removal operation, you must force the removal of Active Directory Domain Services (AD DS) by using an answer file. In the answer file, specify the parameter demotefsmo=yes.
   
2. On the Welcome to the Active Directory Domain Services Installation Wizard page, click Next.
   
3. On the Force the Removal of Active Directory Domain Services page, review the information about forcing the removal of AD DS and metadata cleanup requirements, and then click Next.
   
4. On the Administrator Password page, type and confirm a secure password for the local Administrator account, and then click Next.
   
5. On the Summary page, review your selections. Click Back to change any selections, if necessary.
   To save the settings that you selected to an answer file that you can use to automate subsequent AD DS operations, click Export settings. Type a name for your answer file, and then click Save.
   When you are sure that your selections are accurate, click Next to remove AD DS.
   
6. You can either select the Reboot on completion check box to have the server restart automatically or you can restart the server to complete the removal of AD DS when you are prompted to do so.
   
7. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.
   
8. In Roles Summary, click Remove Roles.
   
9. If necessary, review the information on the Before You Begin page, and then click Next.
   
10. On the Remove Server Roles page, clear the Active Directory Domain Services check box, and then click Next.
    
11. On the Confirm Removal Selections page, click Remove.
    
12. On the Removal Results page, click Close, and then click Yes to restart the server.
    

Forcing the removal of a domain controller by using the command line

---

Use the following procedure to forcefully remove a domain controller by using the command line. You must use the command line or an answer file if the domain controller is running the Server Core installation option of the Windows Server 2008 operating system. When you forcefully remove the domain controller by using the command line, you must specify the /demotefsmo:yes parameter even if the domain controller does not host any operations master roles.
If you are removing AD DS permanently, uninstall the AD DS server role binaries from the server. To remove the AD DS server role binaries, use the dcpromo /uninstallbinaries command.
Administrative credentials
To forcefully remove a domain controller, you must be a member of the Domain Admins group.

To force the removal of a domain controller by using the command line

---

• At an elevated command prompt, type the following command, and then press ENTER:
  dcpromo /unattend /uninstallbinaries /forceremoval /demotefsmo:yes /username:<domain admin> /userdomain:<domain> /password:<DA password> /administratorpassword:<local admin password>
  Where:
  
  • <domain admin> is the name of an account that is a member of the Domain Admins group.
    
  • <domain> is the name of the domain for the domain controller.
    
  • <DA password> is the password for the account that is a member of the Domain Admins group.
    
  • <local admin password> is the password that will be used for the local administrator account on the server after AD DS is removed.
    
  The following example forcefully removes a domain controller from a domain named contoso.com, removes the AD DS server role binaries, and sets the local administrator password to p@$$w0rd:
  dcpromo /unattend /uninstallbinaries /forceremoval /demotefsmo:yes /username:DA1 /userdomain: contoso.com /password: DA1_password /administratorpassword: p@$$w0rd
  

Forcing the removal of a domain controller by using an answer file

---

You can automate the forced removal of a domain controller by using an answer file. You must first prepare an answer file that contains the correct configuration values.
Administrative credentials
To perform this procedure, you can use any account that has Read and Write credentials for the text editor application.

To create an answer file for forcing the removal of a domain controller

---

1. Open Notepad or any text editor.
   
2. On the first line, type [DCINSTALL], and then press ENTER.
   
3. Create the following entries, one entry on each line. These options are the minimum options that are required for forced removal of a domain controller. For a complete list of unattended demotion options, including default values, allowed values, and descriptions, see Demotion Operation.
   UserDomain=domain
   UserName=domain admin
   password=DA password
   AdministratorPassword=local admin password
   demotefsmo=yes
   
4. Save the answer file to the location on the domain controller from which it is to be called by Dcpromo, or save the file to a network shared folder or removable media for distribution.
   

Administrative credentials
To forcefully remove a domain controller, you must be a member of the Domain Admins group.

To force the removal of a domain controller by using an answer file

---

• At an elevated command prompt, type the following command, and then press ENTER:
  dcpromo /unattend:"<path to the answer file>"
  

Removing a Domain Controller from a Domain

Applies To: Windows Server 2008, Windows Server 2008 R2

The procedures in this section describe the methods for removing a Windows Server 2008 or Windows Server 2008 R2 domain controller from a domain:

• Removing a domain controller by using the Windows interface
  
  
• Removing a domain controller by using an answer file
  
  
• Removing a domain controller by entering unattended installation parameters at the command line
  
  

After AD DS is removed, the DNS server role remains installed and running if it was previously installed on the domain controller. But any Active Directory–integrated DNS zones that were installed are removed. By default, the AD DS removal process also attempts to remove the Domain Name System (DNS) delegations for the zones that point to the domain controller.
If the DNS server no longer serves any purpose after you remove AD DS, use Remove Roles Wizard to remove DNS server role. If you remove the DNS server role, you must reconfigure any DHCP scopes and DNS clients that resolved against this DNS server to use a suitable alternative (typically, another DNS server running on a domain controller within the same domain).

Removing a domain controller by using the Windows interface

---

You can use the Active Directory Domain Services Installation Wizard to remove a domain controller from an existing domain.
Administrative credentials
To perform this procedure, you must be a member of the Domain Admins group in the domain.

To remove a domain controller by using the Windows interface

---

1. Click Start, click Run, type dcpromo, and then press ENTER.
   
2. On the Welcome to the Active Directory Domain Services Installation Wizard page, click Next.
   
3. If the domain controller is a global catalog server, a message appears to warn you about the effect of removing a global catalog server from the environment. Click OK to continue.
   
4. On the Delete the Domain page, make no selection, and then click Next.
   
5. If the domain controller has application directory partitions, on the Application Directory Partitions page, view the application directory partitions in the list, and then remove or retain application directory partitions, as follows:
   
   • If you do not want to retain any application directory partitions that are stored on the domain controller, click Next.
     
   • If you want to retain an application directory partition that an application has created on the domain controller, use the application that created the partition to remove it, and then click Refresh to update the list.
     
6. If the Confirm Deletion page appears, select the option to delete all application directory partitions on the domain controller, and then click Next.
   
7. On the Remove DNS Delegation page, verify that the Delete the DNS delegations pointing to this server check box is selected, and then click Next.
   
8. If necessary, enter administrative credentials for the server that hosts the DNS zones that contain the DNS delegation for this server, and then click OK.
   
9. On the Administrator Password page, type and confirm a secure password for the local Administrator account, and then click Next.
   
10. On the Summary page, to save the settings that you selected to an answer file that you can use to automate subsequent operations in Active Directory Domain Services (AD DS), click Export settings. Type a name for your answer file, and then click Save. Review your selections, and then click Next to remove AD DS.
    
11. On the Completing the Active Directory Domain Services Installation Wizard page, click Finish.
    
12. You can either select the Reboot on completion check box to have the server restart automatically or you can restart the server to complete the AD DS removal when you are prompted to do so.
    
13. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.
    
14. In Roles Summary, click Remove Roles.
    
15. If necessary, review the information on the Before You Begin page, and then click Next.
    
16. On the Remove Server Roles page, clear the Active Directory Domain Services check box, and then click Next.
    
17. On the Confirm Removal Selections page, click Remove.
    
18. On the Removal Results page, click Close, and then click Yes to restart the server.
    

Removing a domain controller by using an answer file

---

To remove a domain controller in a domain where other domain controllers exist requires only Domain Admin credentials. You can also create the password for the local Administrator account for the member server. If you do not specify the password in the answer file, the administrator password is blank.
If you are removing AD DS permanently, uninstall the AD DS server role binaries from the server after you remove AD DS from the domain controller. To remove the AD DS server role binaries, use the dcpromo /uninstallbinaries command.
Administrative credentials
To perform this procedure, you can use any account that has Read and Write credentials for the text editor application.

To create an answer file for removing a domain controller

---

1. Open Notepad or any text editor.
   
2. On the first line, type [DCINSTALL], and then press ENTER.
   
3. Create the following entries, one entry on each line. For a complete list of parameters for removing AD DS, see Demotion Operation or type dcpromo /?:Demotion at a command line.
   username=<administrative account in the domain>
   userdomain=<domain name of the administrative account>
   password=<password for the account in UserName>
   administratorpassword=<local administrator password for the server>
   removeapplicationpartitions=yes
   removeDNSDelegation=yes
   DNSDelegationUserName=<DNS server administrative account for the DNS zone that contains the DNS delegation>
   DNSDelegationPassword=<Password for the DNS server administrative account>
   
4. Save the answer file to the location on the installation server from which it is to be called by dcpromo, or save the file to a network shared folder or removable media for distribution.
   

Administrative credentials
To remove a domain controller, you must be a member of the Domain Admins group.

To remove a domain controller by using an answer file

---

• At an elevated command prompt, type the following command, and then press ENTER:
  dcpromo /unattend:"<path to the answer file>"
  

Removing a domain controller by entering unattended installation parameters at the command line

---

You can run dcpromo /unattend command on a domain controller to perform an unattended removal of AD DS. If you are removing AD DS permanently, uninstall the AD DS server role binaries from the server after you remove AD DS from the domain controller. To remove the AD DS server role binaries, use the dcpromo /uninstallbinaries command.
For a complete list of parameters for removing AD DS, see Demotion Operationor type dcpromo /?:Demotion at a command line.

To remove a domain controller by using the command line

---

• At an elevated command prompt, type the following command, and then press ENTER:
  dcpromo /unattend /username:<domain admin> /userdomain:<domain> /password:<DA password> /administratorpassword:<local admin password>
  Where:
  
  • domain admin is the name of an account that is a member of the Domain Admins group.
    
  • domain is the name of the domain for the domain controller.
    
  • DA password is the password for the account that is a member of the Domain Admins group.
    
  • local admin password is the password that will be used for the local administrator account on the server after AD DS is removed.
    
  The following example removes a domain controller from a domain named contoso.com, removes the AD DS server role binaries, and sets the local administrator password to p@$$w0rd:
  dcpromo /unattend /username:DA1 /userdomain: contoso.com /password: DA1_password /administratorpassword: p@$$w0rd
  

Computer Performance

12 Tactics for your battle with Microsoft's Group Policies

Here are a dozen tactics to help you configure, create and plan your Group Policies.  What never ceases to amaze me is how long it takes to finalize your Group Policy settings.  Therefore, even if only 2 or 3 ideas are suitable for your particular Active Directory implementation then, still feel it is worth your time in checking my tips list.

GPO Tips

1. Create Group Policies before you deploy any clients
2. Create a test OU
3. Favour one policy with lots of settings
4. Be on the lookout for positive Group Policies
5. Find the Group Policy Backup Menu
6. Use the 'Enforce' and 'Block Inheritance' sparingly
7. Deny Group Policies to Administrators
8. Surround yourself with the best tools
9. Document your Group Policy settings
10. Favour the user settings rather than the computer policy settings
11. Assign Software rather than Publish
12. Assemble your team

  ‡

0) Get the GPMC (Group Policy Management Console)

This GPO tip is so simple that I almost forgot, make sure that you get the GPMC from Microsoft's site.  This interface transforms configuring and troubleshooting Group Policy settings in Windows Server 2003.
1) Create Group Policies before you deploy any clients.
The most important tactic is stunningly simple.  Create your policies before you roll out your (XP) clients.  So many companies introduce wonderful group polices months after the new desktop roll-out.  Instead of amazing their users with the excellence of their policies, all they get is is resentment because people are suddenly denied features they like and have become accustomed to.
'Barking' Eddie convinced one group of users that their company that had bought a special edition of XP, and that's why there were so few settings.  You and I know that it was just Group Policies applied cunningly to a regular edition of XP.
2) Create a test OU. 
Create a trial Organizational Unit for your Group Policy experiments.  Naturally, create test users and a test computer and make sure they are in the OU you where you trial your policies.  The number one trap with Group Policies is creating the GPO in one OU and expecting the settings to be effective for users in a different OU.  Just when you finish laughing about that absurdity, you fall into the same trap, but this time with computer policies.
The other day I had a new twist, a network manager who was applying Group Policies to a group that were based in a different OU from their users.
3) Favour one policy with lots of settings. 
Avoid zillions of policies each with one setting.  In my opinion a user should be the subject of no more than a dozen group policies, otherwise troubleshooting becomes complex.  Other disagree, and say that Group Policies work fine although their users are in about 50 Group Policies.  Technically, it does not make any difference to logon time.  What slows down logon is the number of individual settings, not the number of policies.  I say again, it's tracing unexpected effects that becomes a nightmare, GPMC is great, but if you have to wade through 50 combinations it is difficult to keep them all on screen.
4) Be on the lookout for positive Group Policies. 
For example a simple 'Enable Logoff' to tidy up the computer.  The pre-configured proxy settings will save you a great deal of configuration work.  For a touch of class, experiment with 'Pre-Populate printer locations'.  My tip is keep your eye out for policies which will improve your user's experience and save them time.

Guy Recommends:  A Free Trial of the Network Performance Monitor (NPM)

SolarWinds' Network Performance Monitor will help you discover what's happening on your network.  This utility will also guide you through troubleshooting; the dashboard will indicate whether the root cause is a broken link, faulty equipment or resource overload.
Perhaps the NPM's best feature is the way it suggests solutions to network problems.  Its second best feature is the ability to monitor the health of individual VMware virtual machines.  If you are interested in troubleshooting, and creating network maps, then I recommend that you give this Network Performance Monitor a try.
Download your free trial of SolarWinds Network Performance Monitor.
5) Find the Group Policy Backup Menu
From time-to-time backup your Group Policies.  Not only will backup protect your precious policies, but also it will enable you to import and export to and from your test domain.  When you backup, remember to start at the Group Policy Object container, which is right at the bottom of the GPMC. 
Trap: What you see at the top and in the OUs is Group Policy short cuts; unlike the real policies in the Group Policy Object containers, these do not have have Backup available on the properties menu.
6) Use the 'Enforce' and 'Block Inheritance' sparingly.  Both 'Enforce' and 'Block Inheritance' are excellent tools for troubleshooting, but if you over-use them in a production domain the cause more problems than they solve.  Enforce was called 'No Override' in previous versions of Windows.
7) Deny Group Policies to Administrators. 
You will probably ignore this GPO tip - until you lockout your Administrator account.  Make it your reflex to amend the Security tab so that Administrators are set to: Deny - Apply Policy.  The risk is that you will 'shoot yourself in the foot' with a really vicious policy, for example, deny the right to logon locally.  Just in case of a problem, create a full administrator in special OU where you block inheritance and never apply any policies at that location.
For the cautious, or truly paranoid, always keep a second domain controller running with the administrator logged on.  The benefit is that if you do lock yourself out on the first DC you can reverse the policy on the second domain controller.  If all else fails, research your 'get out of jail card' - DCGPOFIX.

 ' Gpupdate.vbs
' VBScript to run Gpupdate
' Author Guy Thomas
' http://computerperformance.co.uk/
' Version 1.3
' ------------------------------------   
Option Explicit
Dim objShell, intShortSleep, intLongSleep
Dim strService
Set objShell = CreateObject("WScript.Shell")

' Adjust sleep / wait (milli seconds)
strService = " gpupdate /force"
intShortSleep = 1500
intLongSleep = 10000

' Cmd prompt opened
objShell.Run "cmd"
Wscript.Sleep intShortSleep

' gpupdate executed
objShell.SendKeys strService
Wscript.Sleep intShortSleep
objShell.SendKeys "{Enter}"
Wscript.Sleep intShortSleep

' Cmd prompt exited
objShell.SendKeys "Exit"
Wscript.Sleep intLongSleep
objShell.SendKeys "{Enter}"

Wscript.Echo strService & " running "
WScript.Quit

' End of Script

8) Surround yourself with the best tools.Start as you mean to go on.  Familiarise your self with GPMC, the Report Wizard and Modeling Wizard.
Make a batch file or script to run Gpupdate, I guarantee you will be clicking it a great deal in testing.  Incidentally, Gpupdate replaces secedit in Windows 2000.  Probably the most useful switch is the Gpupdate /force.  See opposite for a Gpupdate VBscript which you can copy, paste into notepad and save onto the desktop with .vbs extension.
9) Document your Group Policy settings.
If you are serious about Group Policies then document the settings.  An Excel spreadsheet would be an ideal vehicle to hold all the information.  In fact, a spreadsheet containing all the builtin Group Policies is the killer feature of my ebook.
10) Favour the user settings rather than the computer policy settings. 
Where there is a 50:50 decision to apply a policy setting to a computer or a user, then favour the user configuration.  The other benefit is that you tend to keep all the policies in one area and so make troubleshooting easier.   See Windows 8 Group Policy Settings
11) Assign Software rather than Publish. 
No-one is going to find your lovely programs by going to the Add or Remove Programs.  The other benefit is that assigning software uses elevated rights for the installation.
12) Assemble your team.
Of all the computer configuration tasks, Group Policies provide the most fun.  To have the most fun, and to get the most out of group policies, assemble an official or even unofficial team.  'Playing' with Group Policies works best when you have different personalities, 'Mr Nasty' locking down the desktop, 'Mr Nice' assigning  software.  The character who is most difficult to find is 'Mr Vision', someone who can picture what the final desktop should be like.

Guy's Challenge - Download this free device backup utility

(CatTools)

Kiwi CatTools is a free program for backing up configuration settings on hardware devices.  Here is Guy's challenge.  If you download CatTools, then it will not only take care of backups, but also it will show you something new about the hardware on you network. I could give you a money back guarantee - but CatTools is already free!  Thus, I just make a techie to techie challenge, you will learn more about your network if you:
Download your free Kiwi CatTools configuration backup tools

Summary of GPO Tips

It never ceases to amaze me is how long it takes to lock down the various aspect of a computer.  I hope that you find a tactic to help you configure, or troubleshoot your Group Policies.