Copy and paste the following into a powershell script.  Be sure to run this on a 2008R2 DC or equiv, or else the RDS profile is not available

Import-Module ActiveDirectory
Get-ChildItem -Filter “(&(objectclass=user)(objectcategory=user))” -Path ad:\”CN=Users,DC=horodc,DC=local” -Recurse |
foreach {
$user = [adsi]”LDAP://$($_.DistinguishedName)”
$user | select @{N=”Name”; E={$_.name}},
@{N=”ProfilePath”; E={$_.profilepath}},
@{N=”RDSProfilePath”; E={$_.psbase.invokeget(“TerminalServicesProfilePath”)}}
} | export-csv c:\test.csv

When trying to boot with WDS and gets a TFTP TIMEOUT error, this article is for you.

In case this happens to anyone else (just happened to me after installing an update on the server and a couple of clients i rebuilt wouldnt boot as they just hung waiting for a tftp offer)

has happened to me after a windows update on server 2008 r2 (aparantly happens on straight 2008 as well) basically its due to having dns server on the same machine as wds dns pinches the ports the tftp service needs. This can leed to pcs not booting at all just sitting there failing to tftp if their boot order has lan set higher than hdd.

2008r2 fix

run regedit

go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\WDSServer\Parameters

Right-click UdpPortPolicy, and then click Modify.
In the Value data box, type 0, and then click OK.
On the File menu, click Exit to exit Registry Editor.
Restart the Windows Deployment Services service.

2008 r1

Click Start Collapse this imageExpand this image, click Administrative Tools, and then click Windows Deployment Services. If there is no server that is listed under the Servers node, right-click the Servers node, and then click Add Server to add the local computer.
In the navigation pane of the Windows Deployment Services MMC snap-in, expand the list of servers.
Right-click the server for Windows Deployment Services, and then click Properties.
Under Network, increase the UDP Port range. For example, if the current port range is 3,000 ports, increase the port range to 4,000 ports

This post documents how to get Samba to work with both AD and local authentication, while mapping AD users to local Unix users.  In the scenario I had, we wanted local AD users to be mapped to the already existing linux accounts.  We will check with the local SMB database, and then use AD as a secondary account store.  The following was performed with the following machines

1. Centos 6, Samba 3.5
2. Windows 2008 R2, AD

STEPS

1. Backup your configurations before starting.
2. Ensure that the latest version of Samba and kerberos is installed (ensure Samba is version >= 3.5.10)

   yum install samba samba-winbind krb5-workstation

3. Because we need to use kerberos, edit /etc/krb5.conf

   default_realm = EXAMPLE.COM
   dns_lookup_realm = true
   dns_lookup_kdc = true
   ticket_lifetime = 24h
   renew_lifetime = 7d
   forwardable = yes
   dns_lookup_realm = true
   
   [realms]
     EXAMPLE.COM = { 
        default_domain = example.com 
     } 
   
   [domain_realm] 
   .example.com = EXAMPLE.COM 
   example.com = EXAMPLE.COM

   NOTE:  Change example.com to be you domain name.  Note that capitalization.  It IS important.

4. Check to make sure we can connect to the domain controller

   root# kinit administrator@EXAMPLE.COM

   and enter the password when prompted.  If all goes well, it will return back to the # prompt.

5. Confirm that kerberos succeeded

   [root@vc6 ~]# klist
   Ticket cache: FILE:/tmp/krb5cc_0
   Default principal: administrator@EXAMPLE.COM
   Valid starting     Expires            Service principal
   12/19/12 21:02:28  12/20/12 07:02:32  krbtgt/EXAMPLE.COM@EXAMPLE.COM
                   renew until 12/26/12 21:02:28

6. Edit /etc/samba/smb.conf and modify the following parameters

           security = ADS
           auth methods = sam winbind
           realm = EXAMPLE.COM
           machine password timeout = 0
           idap domains = ALL
           idmap backend = nss
           winbind use default domain = true
           winbind trusted domains only = yes
           winbind offline logon = false
           winbind nested groups = yes
           winbind separator = +
           encrypt passwords = yes
           template homedir = /home/%U
           username map = /etc/samba/smbusers
   

7. Ensure that Samba will start with the system

   chkconfig smb on

8. Start SMB (restart in this case)

   service smb restart

9. Join the machine to the domain

   net ads join –U username

   If it complains about unable to update DNS, this is OK.  Ensure that it says Joined ‘VC6’ to realm ‘EXAMPLE.COM’

10. Configure WinBind to start

    chkconfig winbind on

11. Start winbind

    service winbind restart

12. Now the moment of truth.  See if we can look up some groups of users

    wbinfo -g

    What should be returned are all the domain groups from the AD

13. Need to edit /etc/samba/smbusers to map AD users to local users

    user1 = EXAMPLE+user1

14. Restart smb service to reload smbusers file

    service smb restart

15. Test with both user and AD accounts to confirm working

Played around with a SMC SMCGS26C-Smart switch testing the DSCP tagging functionality prior to implementing.  From what I have found you need to enable DSCP Egress rewriting for this to occur once it has been tagged into the queue.

So, the basics (overview) from what I have learned

Advanced > QOS > Port Classification defines the default for the port in terms of how it classifies packets coming into the switch.

As can be seen by this picture, it is configurable via each port.  Basically, you are determining what default queue, drop priority is used for a packet that is untagged.  If DSCP based is ticked, then packets are checked for DSCP values and mapped to desired class and checked to see if they are trusted (configure via Advanced>QoS > DSCP-Based QoS)

QoS class of 0 has the lowest priority

Advanced > QoS > Port Policing is used to limit the amount of traffic entering the port.  Packets that exceed the rate defined are dropped.

Advanced > QoS > Port Scheduler shows show the port traffic is monitored and queued.

Strict priority requires that all traffic in a higher priority queue is processed before a lower priority queue.    Deficit Weighted Round-Robin specifies a scheduling weight for each queue.  Note that the schedule priority only shows 6 queues?  This is because queue 6 and 7 or strict mode.

Port scheduling and Port Shaping are two views into the same information.  Port Schedulars show how the scheduling is done for each port in terms of servicing the queues of the port.

Port Shaping shows bandwidth limitations that may be being imposed to the queues.

Advanced > QoS > DSCP-Based QoS allows the administrator to determine which DSCP values arriving at the switch are to be trusted, and to which queue the traffic should be put into inside the switch.

Advanced > QoS > DSCP Control List is where classification of packets into queues is performed.  Create rules to classify packets into correct queues and set DSCP values as required.

Now for the crutch of the matter:

To set DSCP values on a packet, configure DSCP Control List to classify packets into the queues that you want to use.  Additionally, set the DSCP value for the outgoing packet.

On the Port DSCP page, set the Egress Rewrite to an enable setting for the DSCP value of the packet to be written in outgoing packets.  Failure to do so WILL result in packets not being tagged with DSCP values from the queues.

Point to note:  When is a port mirror not a port mirror?
A. When it is an SMC!!  If you enable port mirroring on the switch (locally), ensure that you have Egress DSCP rewriting enabled otherwise it will not have the DSCP value in the packet.

This post documents how to get Samba to work with both AD and local authentication.  Initially we will check with the local SMB database, and then use AD as a secondary account store.  The following was performed with the following machines

1. Centos 6, Samba 3.5
2. Windows 2008 R2, AD

The basic configurations required to get SAMBA to do what we want from a vanilla install is as follow

[global] 
   workgroup = DOMAIN 
   security = ADS 
   auth methods = sam winbind 
   realm = DOMAIN.EXAMPLE.COM 
   machine password timeout = 0 
   server string = SERVER 
   idmap domains = ALL 
   idmap config ALL:backend = lwicompat_v4 
   idmap config ALL:default = yes 
   idmap config ALL:readonly = yes 
   idmap uid = 10000-33554431 
   idmap gid = 10000-33554431

However this does not detail joining the machine to A/D, so lets go through it step by step from a vanilla installation.

1. Ensure that the latest version of Samba is installed (ensure Samba is version >= 3.5.10) along with kerberos

   yum install samba samba-winbind krb5-worksation

2. Because we need to use kerberos, edit /etc/krb5.conf

   default_realm = EXAMPLE.COM
   dns_lookup_realm = true
   dns_lookup_kdc = true
   ticket_lifetime = 24h
   renew_lifetime = 7d
   forwardable = yes
   dns_lookup_realm = true
   
   [realms]
     EXAMPLE.COM = { 
        default_domain = example.com 
     } 
   
   [domain_realm] 
   .example.com = EXAMPLE.COM 
   example.com = EXAMPLE.COM

   NOTE:  Change example.com to be you domain name.  Note that capitalization.  It IS important.

3. Check to make sure we can connect to the domain controller

   root# kinit administrator@EXAMPLE.COM

   and enter the password when prompted.  If all goes well, it will return back to the # prompt.

4. Confirm that kerberos succeeded

   [root@vc6 ~]# klist
   Ticket cache: FILE:/tmp/krb5cc_0
   Default principal: administrator@EXAMPLE.COM
   Valid starting     Expires            Service principal
   12/19/12 21:02:28  12/20/12 07:02:32  krbtgt/EXAMPLE.COM@EXAMPLE.COM
                   renew until 12/26/12 21:02:28

5. Edit /etc/samba/smb.conf and modify the following parameters

   workgroup = example 
   realm = EXAMPLE.COM 
   security = ads 
   auth methods = sam winbindidmap uid = 10000-500000 
   idmap gid = 10000-500000 
   idmap domains = ALL 
   idmap config ALL:backend = lwicompat_v4 
   idmap config ALL:default = yes 
   idmap config ALL:readonly = yes
   template shell = /bin/bash winbind use default domain = true 
   machine password timeout = 0
   server string = SERVER
   winbind offline logon = false winbind nested groups = yes
   encrypt passwords = yes
   

6. Ensure that Samba will start with the system

   chkconfig smb on

7. Start SMB (restart in this case)

   service smb restart

8. Join the machine to the domain

   net ads join –U username

   If it complains about unable to update DNS, this is OK.  Ensure that it says Joined ‘VC6’ to realm ‘sc.local’

9. Configure WinBind to start

   chkconfig winbind on

10. Start winbind

    service winbind restart

11. Now the moment of truth.  See if we can look up some groups of users

    wbinfo -g

    What should be returned are all the domain groups from the AD

12. Config file SMB differences
13.         security = ADS
    auth methods = sam winbind
    realm = SC.LOCAL
    machine password timeout = 0
    server string = Centos 6 Server
    idap domains = ALL
    idmap config ALL:backend = lwicompat_v4
    idmap config ALL:default = yes
    idmap config ALL:readonly = yes
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    template shell = /bin/bash
    winbind use default domain = true
    winbind offline logon = false
    winbind nested groups = yes
    winbind separator = +
    encrypt passwords = yes
    template homedir = /home/%U
14. Edit /etc/nsswitch.conf file and add winbind as per following 3 lines from the config file

    passwd:     files winbind
    shadow:     files winbind
    group:      files winbind

15. Create a mkhomedir.sh file
    [root@centos6 home]# cat /usr/local/sbin/mkhomedir.sh
    #!/bin/bash

    if [ ! -e /home/$1 ]; then
    mkdir /home/$1
    chown $1:”Domain Users” /home/$1
    chmod 0700 /home/$1
    touch /home/$1/newfile
    fi
    exit 0

    chmod u=rwsx,g=rwx,o-rwx /usr/local/sbin/mkhomedir.sh

16. Restart SMB,NMB,Winbind services and a home directory should be automatically created.

ns_lookup_realm = true

Setting up Config Manager is straight forward.  However, when setting up with a remote SQL server, some additional work is required – Mainly…..

http://blogs.technet.com/b/configurationmgr/archive/2012/05/03/fix-unable-to-connect-cas-or-primary-to-the-sql-database-during-the-system-center-2012-configuration-manager-setup.aspx