Step-By-Step: Enabling Active Directory Recycle Bin in Windows Server 2012 R2

Active Directory Recycle Bin was created to adhere to that very problem and this Step-By-Step will showcase how easy it is to enable.  This procedure does not negate the need to have a proper system state backup which is always recommended and one must be aware that enabling this feature is one time and cannot be reversed under any circumstances.

Enabling Active Directory Recycle Bin

1. In the management console, go to Tools > Active Directory Administrative Center
   
2. Select Local Domain and in the Tasks Pane
   
3. Select Enable Recycle Bin.
   
4. Click OK
   NOTE: Be aware this feature cannot be disabled.
   
5. Click OK.  Once enabled, wait for AD replication to complete as this is a change made on the configuration partition. This process may take a while should your organization have a large active directory infrastructure.

A very simple enablement of a process that could save you hours of restore time.  Again this process cannot be reversed once invoked.

Be sure to test Active Directory Recycle Bin in your lab by downloading Windows Server 2012 R2. Also, be sure to take advantage of Microsoft Virtual Academy to learn about additional features made available in Windows Server 2012 R2 to further your IT career.

If you can't update or restore your iPhone, iPad, or iPod touch

You can put your iOS device in recovery mode, then restore it with iTunes.

In these situations, you might need to use recovery mode to restore your device:

• iTunes doesn't recognize your device or says it's in recovery mode.
• If your screen is stuck on the Apple logo for several minutes with no progress bar.
• You see the connect to iTunes screen.

Learn what to do if you see the progress bar on your screen for several minutes.

Put your device in recovery mode and set it up again

1. Make sure that you're using the latest version of iTunes. 
2. If iTunes is already open, close it. Connect your device to your computer and open iTunes. If you don't have a computer, borrow one from a friend or go to an Apple Retail Store or Apple Authorized Service Provider for help.
3. While your device is connected, force restart it with these steps, but don't release the buttons when you see the Apple logo, wait until the connect to iTunes screen appears: 
   • On iPhone 8 and later: Press and quickly release the Volume Up button. Press and quickly release the Volume Down button. Then, press and hold the Side button until you see the connect to iTunes screen.
   • On an iPhone 7 or iPhone 7 Plus: Press and hold the Side and Volume Down buttons at the same time. Keep holding them until you see connect to iTunes screen.
   • On an iPhone 6s and earlier, iPad, or iPod touch: Press and hold both the Home and the Top (or Side) buttons at the same time. Keep holding them until you see the connect to iTunes screen.
     
4. When you see the option to Restore or Update, choose Update. iTunes will try to reinstall iOS without erasing your data. Wait while iTunes downloads the software for your device. If the download takes more than 15 minutes and your device exits the connect to iTunes screen, let the download finish, then repeat step 3.
   
5. After the Update or Restore completes, set up your device.

Note: Use the original cable

How to Use the Netstat Command

The netstat command is a Command Prompt command used to display very detailed information about how your computer is communicating with other computers or network devices.

Specifically, the netstat command can show details about individual network connections, overall and protocol-specific networking statistics, and much more, all of which could help troubleshoot certain kinds of networking issues.

Netstat Command Availability

The netstat command is available from within the Command Prompt in most versions of Windows including Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows Server operating systems, and some older versions of Windows, too.

The availability of certain netstat command switches and other netstat command syntax may differ from operating system to operating system.

Netstat Command Syntax

netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p protocol] [-r] [-s] [-t] [-x] [-y] [time_interval] [/?]

How to Read Command Syntax 

Execute the netstat command alone to show a relatively simple list of all active TCP connections which, for each one, will show the local IP address (your computer), the foreign IP address (the other computer or network device), along with their respective port numbers, as well as the TCP state.

-a = This switch displays active TCP connections, TCP connections with the listening state, as well as UDP ports that are being listened to.

-b = This netstat switch is very similar to the -o switch listed below, but instead of displaying the PID, will display the process's actual file name. Using -b over -o might seem like it's saving you a step or two but using it can sometimes greatly extend the time it takes netstat to fully execute.

-e = Use this switch with the netstat command to show statistics about your network connection. This data includes bytes, unicast packets, non-unicast packets, discards, errors, and unknown protocols received and sent since the connection was established.

-f = The -f switch will force the netstat command to display the Fully Qualified Domain Name (FQDN) for each foreign IP addresses when possible.

-n = Use the -n switch to prevent netstat from attempting to determine host names for foreign IP addresses. Depending on your current network connections, using this switch could considerably reduce the time it takes for netstat to fully execute.

-o = A handy option for many troubleshooting tasks, the -o switch displays the process identifier (PID) associated with each displayed connection. See the example below for more about using netstat -o.

-p = Use the -p switch to show connections or statistics only for a particular protocol. You can not define more than one protocol at once, nor can you execute netstat with -p without defining a protocol.
protocol = When specifying a protocol with the -p option, you can use tcp, udp, tcpv6, or udpv6. If you use -s with -p to view statistics by protocol, you can use icmp, ip, icmpv6, or ipv6 in addition to the first four I mentioned.

-r = Execute netstat with -r to show the IP routing table. This is the same as using the route command to execute route print.

-s = The -s option can be used with the netstat command to show detailed statistics by protocol. You can limit the statistics shown to a particular protocol by using the -s option and specifying that protocol, but be sure to use -s before -p protocol when using the switches together.

-t = Use the -t switch to show the current TCP chimney offload state in place of the typically displayed TCP state.

-x = Use the -x option to show all NetworkDirect listeners, connections, and shared endpoints.

-y = The -y switch can be used to show the TCP connection template for all connection. You cannot use -y with any other netstat option.

time_interval = This is the time, in seconds, that you'd like the netstat command to re-execute automatically, stopping only when you use Ctrl-C to end the loop.

/? = Use the help switch to show details about the netstat command's several options.
Make all that netstat information in the command line easier to work with by outputting what you see on the screen to a text file using a redirection operator. 

Netstat Command Examples

netstat -f

In this first example, I execute netstat to show all active TCP connections. However, I do want to see the computers I'm connected to in FQDN format [-f] instead of a simple IP address.


Here's an example of what you might see:

Active Connections

 Proto Local Address Foreign Address State

 TCP 127.0.0.1:5357 VM-Windows-7:49229 TIME_WAIT

 TCP 127.0.0.1:49225 VM-Windows-7:12080 TIME_WAIT

 TCP 192.168.1.14:49194 75.125.212.75:http CLOSE_WAIT

 TCP 192.168.1.14:49196 a795sm.avast.com:http CLOSE_WAIT

 TCP 192.168.1.14:49197 a795sm.avast.com:http CLOSE_WAIT

 TCP 192.168.1.14:49230 TIM-PC:wsd TIME_WAIT

 TCP 192.168.1.14:49231 TIM-PC:icslap ESTABLISHED

 TCP 192.168.1.14:49232 TIM-PC:netbios-ssn TIME_WAIT

 TCP 192.168.1.14:49233 TIM-PC:netbios-ssn TIME_WAIT

 TCP [::1]:2869 VM-Windows-7:49226 ESTABLISHED

 TCP [::1]:49226 VM-Windows-7:icslap ESTABLISHED

As you can see, there were 11 active TCP connections at the time netstat was executed in this example. The only protocol (in the Proto column) listed is TCP, which was expected because I did not use -a.

You can also see three sets of IP addresses in the Local Address column—my actual IP address of 192.168.1.14 and both IPv4 and IPv6 versions of my loopback addresses, along with the port each connection is using. The Foreign Address column lists the FQDN (75.125.212.75 didn't resolve for some reason) along with that port as well.

Finally, the State column lists the TCP state of that particular connection.

netstat -o

In this example, netstat will be run normally so it only shows active TCP connections, but we also want to see the corresponding process identifier [-o] for each connection so we can determine which program on the computer initiated each one.

Here's what the computer displayed:

Active Connections

 Proto Local Address Foreign Address State PID

 TCP 192.168.1.14:49194 75.125.212.75:http CLOSE_WAIT 2948

 TCP 192.168.1.14:49196 a795sm:http CLOSE_WAIT 2948

 TCP 192.168.1.14:49197 a795sm:http CLOSE_WAIT 2948

You probably noticed the new PID column. In this case, the PIDs are all the same, meaning that the same program on my computer opened these connections.

To determine what program is represented by the PID of 2948 on the computer, all you have to do is open Task Manager, click on the Processes tab, and note the Image Name listed next to the PID I'm looking for in the PID column.¹

Using the netstat command with the -o option can be very helpful when tracking down which program is using too big a share of your bandwidth. It can also help locate the destination where some kind of malware, or even an otherwise legitimate piece of software, might be sending information without your permission.

While this and the previous example were both run on the same computer, and within just a minute of each other, you can see that the list of active TCP connections is considerably different. This is because your computer is constantly connecting to, and disconnecting from, various other devices on your network and over the internet.

netstat -s -p tcp -f

In this third example, we want to see protocol specific statistics [-s] but not all of them, just TCP stats [-p tcp]. We also want the foreign addresses displayed in FQDN format [-f].

This is what the netstat command, as shown above, produced on the example computer:

TCP Statistics for IPv4

 Active Opens = 77

 Passive Opens = 21

 Failed Connection Attempts = 2

 Reset Connections = 25

 Current Connections = 5

 Segments Received = 7313

 Segments Sent = 4824

 Segments Retransmitted = 5

Active Connections

 Proto Local Address Foreign Address State

 TCP 127.0.0.1:2869 VM-Windows-7:49235 TIME_WAIT

 TCP 127.0.0.1:2869 VM-Windows-7:49238 ESTABLISHED

 TCP 127.0.0.1:49238 VM-Windows-7:icslap ESTABLISHED

 TCP 192.168.1.14:49194 75.125.212.75:http CLOSE_WAIT

 TCP 192.168.1.14:49196 a795sm.avast.com:http CLOSE_WAIT

 TCP 192.168.1.14:49197 a795sm.avast.com:http CLOSE_WAIT

As you can see, various statistics for the TCP protocol are displayed, as are all active TCP connections at the time.

netstat -e -t 5

In this final example, netstat command is executed to show some basic network interface statistics [-e] and so that these statistics continually updated in the command window every five seconds [-t 5].
Here's what's produced on screen:

Interface Statistics

 Received Sent

 Bytes 22132338 1846834

 Unicast packets 19113 9869

 Non-unicast packets 0 0

 Discards 0 0

 Errors 0 0

 Unknown protocols 0

Interface Statistics

 Received Sent

 Bytes 22134630 1846834

 Unicast packets 19128 9869

 Non-unicast packets 0 0

 Discards 0 0

 Errors 0 0

 Unknown protocols 0

^C

Various pieces of information, which you can see here and that I listed in the -e syntax above, are displayed.
The netstat command only automatically executed one extra time, as you can see by the two tables in the result. Note the ^C at the bottom, indicating that the Ctrl-C abort command was used to stop the re-running of the command.

Netstat Related Commands

The netstat command is often used with other networking related Command Prompt commands like nslookup, ping, tracert, ipconfig, and others.

_{[1] You may have to manually add the PID column to Task Manager. You can do this by selecting the "PID (Process Identifier)" checkbox from View -> Select Columns in Task Manager. You may also have to click the "Show processes from all users" button on the Processes tab if the PID you're looking for isn't listed.}

Active Directory FSMO Roles

Flexible single-master operations (FSMO) — operations performed by the Active Directory domain controllers, which require a mandatory server uniqueness for each operation. Various FSMO types can be performed on the same or on multiple domain controllers. Server operating FSMO roles known as Operations Master DC.

Most operations in AD can be made on any domain controller. AD Replication service copies the changes to other domain controllers, ensuring the AD database identity on all the controllers of the same domain. Conflict resolution is as follows: if the two DC trying to change attributes of one AD object at the same time, automatic conflict resolution sуstem keep track of which change was made last.


However, there are several actions (such as changing the AD schema), in which conflicts are unacceptable. The task of a servers with FSMO roles is to avoid such conflicts. Thus, each FSMO role can be performed only simultaneously on one server. And if necessary, it can be transferred to another domain controller at any time.

FSMO roles

There are 5 FSMO roles: 2 unique roles for AD forest and 3 for every domain.

• Schema Master — responsible for changes to the Active Directory schema. There can be only one for the entire domain forest.
• Domain Naming Master — responsible for the unique name for a domain and application partitions in the forest. There can be only one for the entire domain forest.
• Infrastructure Master — stores data about users from other domains, that are part of your domain local groups. There can be one for each domain in the forest.
• RID pool manager — responsible for assigning unique relative ID (RID), required when creating domain accounts. There can be one for each domain in the forest.
• PDC (Primary Domain Controller) Emulator — responsible for compatibility with NT4 domain and pre-Windows 2000 clients, for the domain time synchronization in the forest, for changing passwords and tracks locks when users enter the wrong password.

Recommended Best Practice for placement of FSMO roles

When you install a new AD domain, all FSMO roles are placed on a single server. According to Microsoft recommendation, the Best Practice is to spread the FSMO roles between the different domain controllers.


The forest FSMO roles should be placed on one DC, and the domain role to another. In that case, if you have only one domain controller, it is recommended to deploy 1 additional DC. Thus, in an AD domain with a minimum configuration (2 DC), you need to place FSMO role as follows:

Place the following domain roles on a DC1:

• RID Master
• Infrastructure Master
• PDC Emulator

Place the forest roles on a DC2:

• Schema Master
• Domain Master

To determine current FSMO Roles holders, perform the following command:

netdom query fsmo

In this case, the FSMO roles are distributed between the two DC.

However, you should be note, that there is no FSMO role which failure would lead to a significant loss of functionality of AD. Even in case of failure of all FSMO roles, infrastructure can operate normally within a few days, weeks or even months. Therefore, if you are going to bring DC, that contains some or all of the roles to a maintenance for some time, there is no need to transfer available FSMO roles on the other DC, your AD some time will work normally.
Failure of a DCs with FSMO roles does not lead malfunction of a domain. However, it makes it impossible for many operations, actually shifting the domain to the “read-only” mode. In case of failure of a domain controller with the FSMO roles, you can resort to the procedure of seizing FSMO roles from a failed DC.

Tools to admin FSMO roles

To manage and transfer FSMO roles in Active Directory domain use a command line utility NTDSUTIL or GUI MMC snap-ins:

• Active Directory Domains and Trusts — Domain Naming Master role
• Active Directory Users and Computers — Relative ID Master,  Infrastructure Master and Primary Domain Controller Emulator roles
• Active Directory Schema — Schema Master role

That’s all. Hope that we were able to clarify the situation with the FSMO role a bit. In future articles, we will take a closer look at each FSMO role and their features.