Unity Migration Blog

Here's some change management info:

I've granted the following rights to P:\Scripts and P:\Logs on scripts00, so that we can move off of the local D: drive:

itd.scripter: full control
itd_microsys_staff: full control
itd_microsys_unity_accounts: full control

I've moved the following scheduled jobs to refer to P: rather than D: (damn whoever decided that environment variables can't be used in scheduled tasks!)

AD Sync Report
Generate Web Pages
Generate_GPO_Settings_Report
GPO Report
GroupSync Remedy
oncallremind
Status-KMS

I have not changed the SCRIPTS_ROOT and LOG_ROOT environment variables, so as not to disrupt Andy unexpectedly. Scripts will continue to use the D: drive until these are directed to P:

The RPC Server Unavailable error on SCRIPTS00 has been fixed. I believe the problem occurred because of how the DNS suffix search order was configured. It was set to only search unity.ad.ncsu.edu. I changed it to search unity.ad.ncsu.edu, ad.ncsu.edu, and unity.ncsu.edu.

The account management script is running every 5 minutes again.

There is something that is preventing SCRIPTS00 from running the fileacl.exe utility (used to set permissions on user home/profile directories).

The utility works fine on other machines and used to work on SCRIPTS00. The box below shows the result of running a command on WEB00:

C:\>\\unity.ad.ncsu.edu\dotitd\Scripts\scripts00\ad_acctmgmt\fileacl.exe \\fs03.unity.ad.ncsu.edu\home\j\jbarthur /G unity.ad.ncsu.edu\jbarthur:RWXD

Access RWXD GRANTED TO TRUSTEE unity.ad.ncsu.edu\jbarthur on \\fs03.unity.ad.ncsu.edu\home\j\jbarthur

This is what happens if I run the same command on SCRIPTS00 while logged in using the same account:

D:\>\\unity.ad.ncsu.edu\dotitd\Scripts\scripts00\ad_acctmgmt\fileacl.exe
\\fs03.unity.ad.ncsu.edu\home\j\jbarthur /G unity.ad.ncsu.edu\jbarthur:RWXD

The RPC server is unavailable.
Error Bad trustee name/SID no lookup
Error in AddAccessRights for \\fs03.unity.ad.ncsu.edu\home\j\jbarthur
Error in AddAccessRights for \\fs03.unity.ad.ncsu.edu\home\j\jbarthur

The RPC service is running. I attempted turning off the firewall on SCRIPTS00. Didn't help. I also rebooted SCRIPTS00. Didn't help.

Does anyone have any ideas?

As decided in our 2/9/2007 meeting, I've renamed the following accounts in unity.ad.ncsu.edu to conform to the desired naming conventions:

• itd-scripter --> itd.scripter
• itd-web-server --> itd.web-server
• wolf-copy --> itd.wolfcopy
• wp-manage --> itd.wp-manage

I've reset the scheduled tasks on scripts00 and restarted apache on web00 to use these new account names, but we need to be on the alert for issues that may creep in from this change.

I've installed the R2 updates to SCRIPTS00, and the new R2 printer management bits. Since SCRIPTS00 was already running W2K+3 SP1, the upgrade did not even require a reboot. I did have to manually upgrade MMC to version 3 before applying R2, as the R2 installer failed whenever it touched MMC.

I was hoping that installing this software would allow the GPO detail reports in our internal area to show printers assigned with GP. Alas! This seems not to be the case. For the immediate term, one will have to have MMC 3.0 with the print plugins installed to see what printers are assigned where, and manage them.

I've created a new GPO for SAV 10.1.5 that should be able to update systems where SAV10.1.4 had been installed. SCRIPTS00 and SCRIPTS01 are the first two systems of the test.

The update approach via policy is set to update the servers, where SAV10.1.4.40x0 had been deployed by policy and now SAV10.1.5.5000 should be deployed to them, without forcing an uninstall/reinstall. This flavor of SAV can take care of the update properly.

The new policy is GPO-Install-SAV10_1_5.

I revised the policy today - 11/20/06. Test on updating SAV 10.1.4.40xx to 10.1.5.5000 on scripts00 went well. Had tested earlier in "clean" (no sav) install to deadbolt.unity.ncsu.edu.