Windows 2012 R2 已經內建vLan tagging達成20/80基本需求
新增Teaming介面
選左邊小組名稱再按右邊新增介面
vLan ID
共開了2個vLan tag及1個default vLan
1.
The DNS server was unable to create a resource record for fdb0ca48-99c5-4047-aaff-b3396816f239._msdcs.xx.xx. in zone xx.xx. The Active Directory definition of this resource record is corrupt or contains an invalid DNS name. The event data contains the error.
解決方法:
請先備份所有AD, 在Windows 2012 R2使用ADSI Edit->Connect to->DC=ForestDNSZones,DC=xx,DC=xx
刪除fdb0ca48-99c5-4047-aaff-b3396816f239._msdcs.xx.xx
2.
Starting test: NetLogons
[xxx] User credentials does not have permission to perform this operation.
The account used for this test must have network logon privileges for this machine’s domain.
……………………. xxx failed test NetLogons
3.
Starting test: KccEvent
A warning event occurred. EventID: 0x80000603
Time Generated: 03/29/2015 23:22:08
Event String:
Active Directory Domain Services could not disable the software-based disk write cache on the following hard disk.
Starting test: SystemLog
A warning event occurred. EventID: 0x80040020
Time Generated: 03/29/2015 23:22:08
Event String:
The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.
我的AD是在Hyper-v上運行, 提醒如果Enabled write cache(Device Management裏的硬碟) , 如果斷電有可能會有Data lost, 好像沒有解決方法, 情怳應該和Raid的Write cache相似, 但Hardware Raid有電保護, 這個沒有, 亦不能Disable
4.
Starting test: FrsEvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.
不用理會
AD Forest由2000升級2003後兩台Controller發生以下錯誤
dcdiag /test:FSMOcheck
Warning: DsGetDcName(TIME_SERVER) call failed, error 1355
A Time Server could not be located.
The server holding the PDC role is down.
Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355.
A Good Time Server could not be located.
然後發現兩台Controller的Windows Time service都突然不能啟動, “系統找不到指定的檔案”
解決方法:
w32tm /unregister
w32tm /register
有時見過有些Workstation在Service不見了Windows Time, 都可以使用w32tm /register
Windows Management Framework 3.0
http://www.microsoft.com/en-us/download/details.aspx?id=34595
Windows6.1-KB2506143-x64.msu
Microsoft Online Services Sign-In Assistant for IT Professionals RTW
http://www.microsoft.com/en-us/download/details.aspx?id=41950
msoidcli_64.msi
Active Directory Module for Windows PowerShell (64-bit version)
http://go.microsoft.com/fwlink/p/?linkid=236297
AdministrationConfig-en.msi
vLan 110, vLan 109禁止連接192.168.3.0/24, 除了10.20.9.2
access-list 10 deny 192.168.3.0 0.0.0.255
access-list 10 permit any
int vlan 110
ip access-group 10 out
access-list 100 permit ip 192.168.3.0 0.0.0.255 10.20.9.2 0.0.0.0
access-list 100 deny ip 192.168.3.0 0.0.0.255 any
access-list 100 permit ip any any
int vlan 109
ip access-group 100 out