AD Recycle Bin
Dear reader,
Do yourself a favor and enable AD Recycle Bin. You might never use, but if you ever do, I’m sure you’ll be thankful.
Enable AD Recycle Bin
Before hand make sure you are running your domain and forest at least as 2008 level.
Then, run the following command in a Active Directory Powershell console:
Enable-ADOptionalFeature ‘Recycle Bin Feature’ -Scope ForestOrConfigurationSet -Target (Get-ADForest).RootDomain -Server (Get-ADForest).DomainNamingMaster
After this, your action in Active directory will be protected by AD Recycle Bin.
Protect from accidental deletion
The next step is to protect your objects form deletion. This will make sure that you can’t just press delete. you have to disable this option for that object and then delete.
You can run the below commands in an Active Directory Powershell console:
Get-ADUser -Filter * | Set-ADObject -ProtectedFromAccidentalDeletion:$true
Get-ADGroup -Filter * | Set-ADObject -ProtectedFromAccidentalDeletion:$true
Get-ADOrganizationalUnit -Filter * | Set-ADObject -ProtectedFromAccidentalDeletion:$true
This step is not required, but it also helps prevent accidents. Depending on your environment you might not want to enable Accidental Deletion Protection for all objects, but in my experience, Groups and Organizational Units are a must.
Recover user
Let’s say you’ve deleted a user, and for some reason you need it back.
Well, now that you’ve enable AD Recycle Bin, you don’t need to go get that weekly backup anymore and use AD Restore Mode.
Just run the below commands in powershell:
1. List deleted : Get-ADObject -filter ‘isdeleted -eq $true -and name -ne “Deleted Objects”‘ -includeDeletedObjects -property *
2. Restore-ADObject -identity “GUID”
And there you go. You have your user back. With any luck, no one will notice.
Duplicate folder tree in Linux
Quick tip.
This can be very handy when you need to frequently create a folder structure without files (Ex. Project folders or multiple versions of a development area)
Just run:
find <directory> -type d -maxdepth n -exec mkdir /where/you/want/{} ;
This is a quick way of doing it and can even be automated.
Linux Performance – Swap partition vs Swap files (The Swap Files How To)
And I’m back, paging myself in, so we wrap up this topic.
So with the process pages all in in their frames, let’s add some more swap. File format this time.
1- Creating a Swap file
So Linux being Linux, you can be anything, as long as you’re a file!
So let’s get started and create a file using dd. After that, the process is very similar to what we’ve already seen. Have a look below:
The only difference is the use of the -f parameter to state that swap will be in a file and not in a partition.
In this example I created a 128MB file, but we can have multiple of these or even different sizes like the example below.
2- Making swap file available on boot
After the swap files created, they can be added to fstab to be available on boot, just like a partition, and all the same rules apply.
And there you have it. Swap files instead of swap partitions. These can be a quick(er) way of adding some swap space and have the same functionality.
Se let’s swap out and make space for a new process!
Note: As seen in my screenshots, the swap files should be made available only to the root user. I didn’t, since this was done in a lab environment, but don’t forget to do chmod 0600 on each file.
Linux Performance – Swap partition vs Swap files (The Swap Partition How To)
As promised, during the previous post, let’s get nerdy and show how to make changes to your swap settings.
Let’s start from the beginning.
1- How much swap do I have and how much am I using?
First one is really simple and I bet most of you know this already.
Use the free command to identify your memory usage and in there you will have the swap.
Ex. free -m will show you the used and free memory in Megabytes.
If you don’t have the free command, you can use /proc/meminfo to gather that information.
Ex. cat /proc/meminfo | grep Swap*
2- Am I using a Swap disk or Swap files?
Couldn’t be easier.
Ex. cat /proc/swaps
Does it need an explanation?
3- I need a bigger swap space!
Great, let’s increase it.
Is it a virtual machine? Even better.
Let’s start by turnoff the swap disk.
In the case above would be just running swapoff /dev/sdc1.
Next, increase the space in your virtual disk, delete the old partition and make a new one.
After just format the new partition as swap. Ex. mkswap /dev/sdc1 and swapon /dev/sdc1
Don’t forget to update fstab.
4- How about having multiple swap disks?
Well, almost the same as before, but instead of resize, just add a new disk and create new swap partition.
After that the fun starts.
Create the swap file system like mkswap /dev/sdf1 and swapon /dev/sdf1.
Now you have 2 swap areas. When the first one is full, the second will be used.
Don’t forget to add to fstab for mounting on boot.
5- How to make multiple swap partitions be used simultaneously?
Swap partitions can be used simultaneously, acting like a “RAID” group. This will improve performance significantly, especially when using separate disks.
For that, the disks should be mounted using the same priority, as seen below:
In this case I defined the priority as 3, but it could be any value. If you have more, keep in mind that the higher the number, the higher the priority up to 32767.
So, after beating up swap files in this post. I’ll let it sink in, before I do another post on Swap files.
For now i’ll page out myself!
Linux Performance – Swap partition vs Swap files
Yup. This is a tough one.
When you start getting questions about server virtual memory, you know it’s not good.
But let’s start by the basics. Swapping vs. Paging.
Swapping
Swapping is a technique where the whole memory allocated to a process gets moved from main memory (RAM) to a secondary memory type (usually hard disk).
Paging
Paging is a different memory management technique where physical memory is divided into frames and logical memory of each process is divided into pages. Pages and Frames are usually 4KB, but can be otherwise defined, although always the same size. Pages then are moved in and out of main memory depending on current needs and frame availability, rather than moving the whole address space of a process.
With the fundamental concepts out of the way, let’s get to the more juicy stuff.
Swap partition
Linux is a modern operating system and used paging for it’s memory management. This confuses people since Linux still uses the Swap partition and you’ve probably been told that you need to get it just right. No second changes. Bullsh… Well get to that soon.
I just said Linux is a MODERN operating system and there are many ways around it.
Regardless, as a rule of thumb, you should always assign double the physical memory to a swap partition. This will allow processes to use the extra “memory” if needed. You should also evaluate how your application will use memory to understand if it is worth while having a bigger or smaller swap size.
In a virtualization world, like today’s, I actually prefer to create a separate disk altogether. This will allow me to place that disk in a fast SSD LUN if I need the extra performance for the server virtual memory. That said, this is, and should be, a corner case.
Especially in virtual environments you can change the size of this partition and even add multiple partitions. This is also true for physical environments, although more laborious. (Who wants to replace physical disks these days!)
Swap files
Now, how about those swap files?
Swap files are, just like swap partitions, with the advantage of not having to create a separate partition. In fact, you can not have a swap partition altogether. Their functionality is the same as a swap partition, but they will be files in your file system. Like a swap partition, you can keep them in a separate disk for the same purpose.
And by the way, could you possibly use swap files and a swap partition simultaneously?
Of course you can, it’s Linux, you can do whatever you want … or close enough!
You could possibly use swap files to replace your swap partition entirely while you re-dimension it.
Did I mention you can have multiple swap partitions?
Tips
When creating a new Linux machine, although not necessary, it’s always preferable to reserve some space for Swap/Virtual memory, Regardless of being in the form of a partition or swap file.
Reserve at least the same amount as physical memory.
If you are running software that allocates large chunks of memory, swap is a must
If your applications are using swap and you can’t add physical memory, try adding more partitions and setting them with the same priority, this will make swap act “like a RAID 0”, as long as they are running on similar performance disks.
This is a long post, but one I think necessary.
I will be adding another blog post with the howto’s to use all techniques mentioned here.
Let’s get swapping!
Active Directory accounts – Security Auditing (The very basics – part 1)
Dear reader,
How many times have you been confronted with bad passwords, and accounts set to never expire?
How many times you were asked to audit and Active Directory of a client ora new organization you just joined?
How about users that “forgot” they changed their own password?
Well fear no more, this post is for you!
Open your PowerShell and let’s get started.
Scenario 1 – “I can’t login! My password isn’t working!”
For this scenario be prepared to quick draw your PowerShell Fu and type the following command:
Get-ADUser -identity username -properties PasswordLastSet, PasswordExpired
This will quickly tell you if the password is expired or if it was recently changed and forgotten!
Scenario 2 – (Angry Boss/Security guy) Why is this user account password not expiring? How many of these exist?
This is usually B A D!
But worry not. hopefully you are proactively workign on this (if your not, get on it) and you have at hand the latest list, obtained with:
Get-ADUser -Filter * -Properties PasswordLastSet, PasswordExpired, PasswordNeverExpires | Sort-Object Name | Select-Object Name, PasswordLastSet, PasswordExpired, PasswordNeverExpires | Export-Csv -Path <LocalPath><filename>.csv
And you are done. With this list, you can identify all users with passwords not expiring and with the added bonus of understanding if the current passwords are expired or not.
(Pro Tip: Why the PasswordExpired and PasswordLastSet? Well, as soon as you start updating the PasswordNeverExpires to False, users will start being asked to change their passwords, and that can cause a lot of havoc. Those two fields will help with the correction plan for all those accounts.)
And there you have it. You can start owning your Active Directory.
Find Zombie computers in Active Directory
I’ve been trying out some things with Powershell and wanted to share this.
Active Directory is a great thing, but more often than we like to admit, it tends to become … messy.
So as a small cleanup exercise, here’s how you’d find “zombie” computers in Active Directory using PowerShell:
Get-ADComputer -filter * -properties * | Where-Object {$_.whenChanged -lt $((Get-Date).AddDays(-180))} | Select-Object CN, whenChanged
There you go. After this you’ll have a very nice list of computers that have not contacted Active Directory domain in 180 days or more.
Happy cleaning!
Shortcut to Mail is broken in Control Panel
Get ID from user and group in Linux
Hi everyone,
Sometimes it handy to deal with id’s instead of actual names. It makes your commands shorter.
So if you ever need to get the id’s of one user or a group in Linux, here’s the commands to run:
– id -u USERNAME – will give you the USERNAME ID;
– id -a USERNAME – will give, not only the ID of the user, but also all the groups the user is part of;
– id -g USERNAME – will give the ID of the user’s primary group;
– id -G USERNAME – will give you the ID of all groups the user is a member of;
If you just want to know the id of a group, the just run:
cat /etc/group | grep GROUPNAME
The third item of the colon(:) separated string is the group ID.
And there you have it.
Now you can find out every user and group ID’s.
Enjoy.