Another non-ILM post today – but this is just something I’ve done recently, and I found I had to trawl around a fair bit for the information I needed, and I may as well jot it down. This post shows the steps I took to get the configuration working, after encountering various errors along the way. There may well be other ways.<\/p>\n
The project was to install two replica instances of ADAM SP1 using NLB for failover, and to add some custom fields to the user Class.<\/p>\n
<\/p>\n
Created a domain service account and:<\/p>\n
I also made the forceguest registry setting<\/a> on the servers.<\/p>\n The installation of ADAM SP1 was straight-forward, as was creating the unique instance on the first server. Creating the replica on the second server was also straight-forward. All of this is well covered in the ADAM step-by-step guide<\/a>.<\/p>\n I hadn’t actually used NLB before and initially got distracted by this document<\/a> and thought I had to set all the network settings myself. Dumb – all you need to do is run Network Load Balancing Manager<\/strong> from the Administrative Tools menu and it will do all the network settings for you.<\/p>\n It is a lot easier if you have two NICs though, like in a normal cluster – one for Public and one for Private.<\/p>\n The surprise was really how basic NLB is. NLB does no port monitoring and will forward traffic to the server as long as it is up. Taking the ADAM service down has no effect on it. So in the case of 2 servers with 50% loading, if you stop the ADAM instance on one server, half the requests will fail.<\/p>\n Obviously this is something others have had problems with so, on MSDN, there’s this nice script<\/a> that will check particular services on the cluster servers, and stop NLB on a server if the service is stopped.<\/p>\n Another couple of gotchas:<\/p>\n OK, call me dim, but I didn’t realise I was going to have to provide a unique X.500 OID for the purely local atributes I wanted to add to the user class. I ended up using this OID generator script<\/a> which produces a hideously long number that you can append your own attribute IDs to.<\/p>\n I also caused myself problems by connecting to “localhost” from the ADAM Schema plugin. You get all sorts of weird errors like “Could not connect to the current schema master server” and “The FSMO role ownership could not be verified” – though not straight away of course, only after you’ve gone through the whole process of entering the details of the new attribute. Things worked much better once I figured out I had to use the full dns name<\/em> of the primary ADAM server.<\/p>\n Once I successfully added an attribute the to user class I managed to get myself into further trouble by jumping onto the replica server and trying to use the attribute straight away. My reward was the dissappearance of the replica from ADSI Edit! It came back after a service restart, but it was a little disconcerting. After that I found the “Update Schema Now” action in ADSI Edit so I routinely updated all servers after any modification, and I didn’t see the problem again.<\/p>\n Again pretty simple, but it wasn’t immediately obvious to me, so: when you create an user object you have to set a password and then set msDS-UserAccountDisabled to FALSE before you can use it.<\/p>\n Use repadmin.<\/p>\n You’re supposed to use dsdiag for troubleshooting, however it gives misleading errors. According to this MS doc<\/a> it should run error free but, in trying to track down the errors I found this post from Lee Flight<\/a> (who seems to be the man with all the ADAM answers on the news groups) saying that not all tests work with ADAM. So why include them then!<\/p>\n The errors I see, even in a completely clean VM environment, are: I can’t say for sure this is what should happen – all I can is that, apart from these dsdiag errors, everything is working as expected.<\/p>\n","protected":false},"excerpt":{"rendered":" Another non-ILM post today – but this is just something I’ve done recently, and I found I had to trawl around a fair bit for the information I needed, and I may as well jot it down. This post shows the steps I took to get the configuration working, after encountering various errors along the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":[]},"categories":[40,36],"tags":[],"class_list":["post-112","post","type-post","status-publish","format-standard","hentry","category-adam","category-windows2003"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pkp1o-1O","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/comments?post=112"}],"version-history":[{"count":3,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/112\/revisions"}],"predecessor-version":[{"id":610,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/112\/revisions\/610"}],"wp:attachment":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/media?parent=112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/categories?post=112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/tags?post=112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Installation<\/h4>\n
NLB<\/h4>\n
\n
Schema Modification<\/h4>\n
Enabling Users<\/h4>\n
Checking Replication between Instances<\/h4>\n
DSDIAG<\/h4>\n
\n
\n[servername<\/em>] Directory Binding Error 1753:
\nWin32 Error 1753
\nThis may limit some of the tests that can be performed.
\n<\/code>
\n[servername<\/em>$instancename<\/em>] DsBindWithSpnEx() failed with error 5,
\nWin32 Error 5.
\n<\/code>
\nSkipping all tests, because server servername<\/em>$instancename<\/em> is
\nnot responding to directory service requests
\n<\/code>
\nIt then, despite what it says about skipping all tests, proceeds to run three CrossRefValidation tests, all of which pass.<\/p>\n