I came into this position last year, knowing that I had a challenge ahead of me. The previous system administrator left our department with little to no documentation as part of their legacy. The documentation that was left had not been updated for over six years. You know how that goes with technology, a lot happens over six years. This was a problem, as our server environment had grown over 300% since the introduction of VMware into our environment. We now had well over 80 servers, most of them new in the past couple years. No system configuration info, hostnames, IP addresses, purpose/role of the server, and no reason why certain servers had the configurations and setups they did. Talk about starting from the ground up! I had to go through each server and document what each one did, where it was in the rack, physical or virtual, who accesses it, is it secured and how so, when does the software maintenance expire, is it backed up and where, I could go for days on what needed to be done and what had not been done!
From my experiences, I have decided to share six items that I recommend to use to help improve documentation in any IT environment:
Today our WSUS server wanted be a pain and inform us that its content folder has reached 120 GB.
After running the Server Cleanup Wizard from the MMC, we found that we needed to have more space cleaned up.
The server is a Virtual Machine, so adding additional space and extending the partition is always easy. However, we want to avoid continually adding space and extending the partition since we can use the valuable SAN space for more important services.
We are able to clean it up by stopping the WSUS service, delete all the folders and their contents from the content directory and from C:\Program Files\Update Services\Tools, we ran “wsusutil.exe reset”.
This allowed the server to then re-download the content and only get what it should need. This can take some time since there is an enormous amount of updates out there to get for our over 1,500 multi-OS systems. The last time we did this was about 8 months ago, so it helped for quite a while before needing to be run again. I will have to do some investigating to see if anyone has a script out there to perform a cleanup every few months.
From here I will monitor the server and if it continues to grow unreasonably, I will probably fire up a 2008 R2 box and start new so we get it off of the 2003 box anyway.
We recently needed to add a service account to have Send-As and Receive-As permissions on one of our Exchange 2007 databases. I was able to do so by issuing the following commands.
First, I verified the user did not have the rights about to be assigned.
Get-Mailboxdatabase -Identity DBIdentity | Get-ADPermission -User SERVICEACCOUNT
I did not receive any results from the above cmdlet.
Next, I added the permissions to the database for the service account.
Get-Mailboxdatabase -Identity DBIdentity | Add-ADPermission -User SERVICEACCOUNT -AccessRights ExtendedRight -ExtendedRights receive-as, send-as
Once I issued that command, I verified they applied successfully by running the get-adpermission command again.
This worked for me but I cannot guarantee it will work for others.
Yesterday, I raised our DFL to 2008 R2. Pretty simple once all the domain controllers in your domain are up to 2008 R2. Pretty much, right click, “Raise functional level…” choose Server 2008 R2, and OK. Once raised, replication across the domain will take care of the other DC’s.
I did make sure to research any issues that might come up after raising the level. The only forum I really found was someone having issues with a third party app performing an LDAP search. I will keep an eye out on our applications that query LDAP, such as VoIP.
Now we wait until all the other domain administrators in our forest update their domains to 2008 R2, so we can update our Forest Functional Level.