| Author | Messages | |
michael1
Posts:438
 | | Chris-Dent
Posts:115
 | | 06/18/2009 10:11 AM |
| Hi Michael,
I did some work on decoding the DNSRecord property too back then (not enough real work to do it seems and it made a few colleagues sigh at me rather a lot).
I'm still shamefully stuck on at least two of the fields (depending on field length), but everything else seems to fit rather nicely. I only bothered mapping the more common record types (I consider those to be A, CNAME, MX, NS, SOA, SRV and TXT).
I think it is perhaps worth noting that the first two bytes are not the record type, they're the full length of the portion of the attribute which holds the record data. For the most part that won't make a blind bit of difference to your script, you'd have to run into a TXT record with 3 characters in it to notice a discrepancy (I'd have to check that too, educated guess).
The record type is represented by the 3rd and 4th bytes, as a little endian. The values match up to the those published here:
http://www.iana.org/assignments/dns-parameters
I tested that theory for all record types which can be created in the GUI and found no discrepancies.
With the maps it is possible to construct records directly rather than using WMI, GUI etc (it's possible to switch between record types as well if that was really desirable). The fields I cannot decipher appear to be trivial and seem to have very predictable values but since they never change I can't figure out what they mean, I can apply a bit of meaning, but it's nothing more than a guess.
I'll publish the maps if you're interested, just need to tidy them little first 
Chris
From: Michael B. Smith Sent: Wednesday, June 17, 2009 10:40 PM To: activedir@mail.activedir.org Subject: [ActiveDir] Dumping Active Directory Integrated domains
A month or two ago, someone asked about dumping ADI domains.
I wrote a script at that point, but didn't post it. So, I just now put it up on my blog in case anyone is still interested. It's in PowerShell (duh). Totaling 453 lines. Although nothing would prevent it from being done in VBScript or anything else that can read AD.
I suspect it would take fewer lines in C/C++/C# and more in VBScript. J
(Note that I wasn't trying to minimize lines, but to emphasize readability and comprehension. I'm sure I could reduce the line-count by at least one-third to one-half in PowerShell too.)
<http://theessentialexchange.com/blogs/michael/archive/2009/06/17/getting-the-contents-of-an-active-directory-integrated-dns-zone.aspx>
Regards,
Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: http://TheEssentialExchange.com/blogs/michael Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf
| | | |
| Chris-Dent
Posts:115
 | | 06/18/2009 11:52 AM |
| Published here:
http://www.highorbit.co.uk/?p=1097
I thought about posting the PowerShell I used to rip it apart / put it back together, but I think Michael's is neater in far too many areas 
Chris
-------------------------------------------------- From: "Chris Dent" <chris@highorbit.co.uk> Sent: Thursday, June 18, 2009 10:09 AM To: <activedir@mail.activedir.org> Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
> Hi Michael, > > I did some work on decoding the DNSRecord property too back then (not > enough real work to do it seems and it made a few colleagues sigh at me > rather a lot). > > I'm still shamefully stuck on at least two of the fields (depending on > field length), but everything else seems to fit rather nicely. I only > bothered mapping the more common record types (I consider those to be A, > CNAME, MX, NS, SOA, SRV and TXT). > > I think it is perhaps worth noting that the first two bytes are not the > record type, they're the full length of the portion of the attribute which > holds the record data. For the most part that won't make a blind bit of > difference to your script, you'd have to run into a TXT record with 3 > characters in it to notice a discrepancy (I'd have to check that too, > educated guess). > > The record type is represented by the 3rd and 4th bytes, as a little > endian. The values match up to the those published here: > > http://www.iana.org/assignments/dns-parameters > > I tested that theory for all record types which can be created in the GUI > and found no discrepancies. > > With the maps it is possible to construct records directly rather than > using WMI, GUI etc (it's possible to switch between record types as well > if that was really desirable). The fields I cannot decipher appear to be > trivial and seem to have very predictable values but since they never > change I can't figure out what they mean, I can apply a bit of meaning, > but it's nothing more than a guess. > > I'll publish the maps if you're interested, just need to tidy them little > first  > > Chris > > > From: Michael B. Smith > Sent: Wednesday, June 17, 2009 10:40 PM > To: activedir@mail.activedir.org > Subject: [ActiveDir] Dumping Active Directory Integrated domains > > > A month or two ago, someone asked about dumping ADI domains. > > I wrote a script at that point, but didn't post it. So, I just now put it > up on my blog in case anyone is still interested. It's in PowerShell > (duh). Totaling 453 lines. Although nothing would prevent it from being > done in VBScript or anything else that can read AD. > > I suspect it would take fewer lines in C/C++/C# and more in VBScript. J > > (Note that I wasn't trying to minimize lines, but to emphasize readability > and comprehension. I'm sure I could reduce the line-count by at least > one-third to one-half in PowerShell too.) > > <http://theessentialexchange.com/blogs/michael/archive/2009/06/17/getting-the-contents-of-an-active-directory-integrated-dns-zone.aspx> > > Regards, > > Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP > My blog: http://TheEssentialExchange.com/blogs/michael > Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf >
| | | |
| michael1
Posts:438
 | | 06/18/2009 2:30 PM |
| Thanks for this!
I'm in MAPI hell this week, but I'll integrate my work with yours and update my post next week.
-----Original Message----- From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Chris Dent Sent: Thursday, June 18, 2009 6:50 AM To: activedir@mail.activedir.org Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
Published here:
http://www.highorbit.co.uk/?p=1097
I thought about posting the PowerShell I used to rip it apart / put it back together, but I think Michael's is neater in far too many areas 
Chris
-------------------------------------------------- From: "Chris Dent" <chris@highorbit.co.uk> Sent: Thursday, June 18, 2009 10:09 AM To: <activedir@mail.activedir.org> Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
> Hi Michael, > > I did some work on decoding the DNSRecord property too back then (not > enough real work to do it seems and it made a few colleagues sigh at me > rather a lot). > > I'm still shamefully stuck on at least two of the fields (depending on > field length), but everything else seems to fit rather nicely. I only > bothered mapping the more common record types (I consider those to be A, > CNAME, MX, NS, SOA, SRV and TXT). > > I think it is perhaps worth noting that the first two bytes are not the > record type, they're the full length of the portion of the attribute which > holds the record data. For the most part that won't make a blind bit of > difference to your script, you'd have to run into a TXT record with 3 > characters in it to notice a discrepancy (I'd have to check that too, > educated guess). > > The record type is represented by the 3rd and 4th bytes, as a little > endian. The values match up to the those published here: > > http://www.iana.org/assignments/dns-parameters > > I tested that theory for all record types which can be created in the GUI > and found no discrepancies. > > With the maps it is possible to construct records directly rather than > using WMI, GUI etc (it's possible to switch between record types as well > if that was really desirable). The fields I cannot decipher appear to be > trivial and seem to have very predictable values but since they never > change I can't figure out what they mean, I can apply a bit of meaning, > but it's nothing more than a guess. > > I'll publish the maps if you're interested, just need to tidy them little > first  > > Chris > > > From: Michael B. Smith > Sent: Wednesday, June 17, 2009 10:40 PM > To: activedir@mail.activedir.org > Subject: [ActiveDir] Dumping Active Directory Integrated domains > > > A month or two ago, someone asked about dumping ADI domains. > > I wrote a script at that point, but didn't post it. So, I just now put it > up on my blog in case anyone is still interested. It's in PowerShell > (duh). Totaling 453 lines. Although nothing would prevent it from being > done in VBScript or anything else that can read AD. > > I suspect it would take fewer lines in C/C++/C# and more in VBScript. J > > (Note that I wasn't trying to minimize lines, but to emphasize readability > and comprehension. I'm sure I could reduce the line-count by at least > one-third to one-half in PowerShell too.) > > <http://theessentialexchange.com/blogs/michael/archive/2009/06/17/getting-the-contents-of-an-active-directory-integrated-dns-zone.aspx> > > Regards, > > Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP > My blog: http://TheEssentialExchange.com/blogs/michael > Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf >
| | | |
| davyp
Posts:38
 | | 06/21/2009 7:44 PM |
| I have a habit of putting up a secondary DNS server somawhere else in the network on a regular member server (sometimes dhcp server) that would pull in the zoneinfo for all the zones using standard DNS replication (primary to secondary master). The zone info gets stored in a local file on the secondary
Get the file with the backup tool of your choosing.
You can actually reverse this process to do a restore, but for the ACLs I think you need a systemstate from a DC anyway...
Regards, DavyP
-----Original Message----- From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Michael B. Smith Sent: donderdag 18 juni 2009 15:29 To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Dumping Active Directory Integrated domains
Thanks for this!
I'm in MAPI hell this week, but I'll integrate my work with yours and update my post next week.
-----Original Message----- From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Chris Dent Sent: Thursday, June 18, 2009 6:50 AM To: activedir@mail.activedir.org Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
Published here:
http://www.highorbit.co.uk/?p=1097
I thought about posting the PowerShell I used to rip it apart / put it back together, but I think Michael's is neater in far too many areas 
Chris
-------------------------------------------------- From: "Chris Dent" <chris@highorbit.co.uk> Sent: Thursday, June 18, 2009 10:09 AM To: <activedir@mail.activedir.org> Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
> Hi Michael, > > I did some work on decoding the DNSRecord property too back then (not > enough real work to do it seems and it made a few colleagues sigh at me > rather a lot). > > I'm still shamefully stuck on at least two of the fields (depending on > field length), but everything else seems to fit rather nicely. I only > bothered mapping the more common record types (I consider those to be A, > CNAME, MX, NS, SOA, SRV and TXT). > > I think it is perhaps worth noting that the first two bytes are not the > record type, they're the full length of the portion of the attribute which
> holds the record data. For the most part that won't make a blind bit of > difference to your script, you'd have to run into a TXT record with 3 > characters in it to notice a discrepancy (I'd have to check that too, > educated guess). > > The record type is represented by the 3rd and 4th bytes, as a little > endian. The values match up to the those published here: > > http://www.iana.org/assignments/dns-parameters > > I tested that theory for all record types which can be created in the GUI > and found no discrepancies. > > With the maps it is possible to construct records directly rather than > using WMI, GUI etc (it's possible to switch between record types as well > if that was really desirable). The fields I cannot decipher appear to be > trivial and seem to have very predictable values but since they never > change I can't figure out what they mean, I can apply a bit of meaning, > but it's nothing more than a guess. > > I'll publish the maps if you're interested, just need to tidy them little > first  > > Chris > > > From: Michael B. Smith > Sent: Wednesday, June 17, 2009 10:40 PM > To: activedir@mail.activedir.org > Subject: [ActiveDir] Dumping Active Directory Integrated domains > > > A month or two ago, someone asked about dumping ADI domains. > > I wrote a script at that point, but didn't post it. So, I just now put it > up on my blog in case anyone is still interested. It's in PowerShell > (duh). Totaling 453 lines. Although nothing would prevent it from being > done in VBScript or anything else that can read AD. > > I suspect it would take fewer lines in C/C++/C# and more in VBScript. J > > (Note that I wasn't trying to minimize lines, but to emphasize readability
> and comprehension. I'm sure I could reduce the line-count by at least > one-third to one-half in PowerShell too.) > > <http://theessentialexchange.com/blogs/michael/archive/2009/06/17/getting-th e-contents-of-an-active-directory-integrated-dns-zone.aspx> > > Regards, > > Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP > My blog: http://TheEssentialExchange.com/blogs/michael > Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf >
| | | |
| michael1
Posts:438
 | | 12/23/2009 2:29 AM |
| I finally needed to go back and update this project... so I did a v2 of my script, incorporating your parsing corrections and adding more record types.
Thanks!
<http://theessentialexchange.com/blogs/michael/archive/2009/12/22/getting-th e-contents-of-an-active-directory-integrated-dns-zone-version-2.aspx>
-----Original Message----- From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Chris Dent Sent: Thursday, June 18, 2009 6:50 AM To: activedir@mail.activedir.org Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
Published here:
http://www.highorbit.co.uk/?p=1097
I thought about posting the PowerShell I used to rip it apart / put it back together, but I think Michael's is neater in far too many areas 
Chris
-------------------------------------------------- From: "Chris Dent" <chris@highorbit.co.uk> Sent: Thursday, June 18, 2009 10:09 AM To: <activedir@mail.activedir.org> Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
> Hi Michael, > > I did some work on decoding the DNSRecord property too back then (not > enough real work to do it seems and it made a few colleagues sigh at > me rather a lot). > > I'm still shamefully stuck on at least two of the fields (depending on > field length), but everything else seems to fit rather nicely. I only > bothered mapping the more common record types (I consider those to be > A, CNAME, MX, NS, SOA, SRV and TXT). > > I think it is perhaps worth noting that the first two bytes are not > the record type, they're the full length of the portion of the > attribute which holds the record data. For the most part that won't > make a blind bit of difference to your script, you'd have to run into > a TXT record with 3 characters in it to notice a discrepancy (I'd have > to check that too, educated guess). > > The record type is represented by the 3rd and 4th bytes, as a little > endian. The values match up to the those published here: > > http://www.iana.org/assignments/dns-parameters > > I tested that theory for all record types which can be created in the > GUI and found no discrepancies. > > With the maps it is possible to construct records directly rather than > using WMI, GUI etc (it's possible to switch between record types as > well if that was really desirable). The fields I cannot decipher > appear to be trivial and seem to have very predictable values but > since they never change I can't figure out what they mean, I can apply > a bit of meaning, but it's nothing more than a guess. > > I'll publish the maps if you're interested, just need to tidy them > little first  > > Chris > > > From: Michael B. Smith > Sent: Wednesday, June 17, 2009 10:40 PM > To: activedir@mail.activedir.org > Subject: [ActiveDir] Dumping Active Directory Integrated domains > > > A month or two ago, someone asked about dumping ADI domains. > > I wrote a script at that point, but didn't post it. So, I just now put > it up on my blog in case anyone is still interested. It's in > PowerShell (duh). Totaling 453 lines. Although nothing would prevent > it from being done in VBScript or anything else that can read AD. > > I suspect it would take fewer lines in C/C++/C# and more in VBScript. > J > > (Note that I wasn't trying to minimize lines, but to emphasize > readability and comprehension. I'm sure I could reduce the line-count > by at least one-third to one-half in PowerShell too.) > > <http://theessentialexchange.com/blogs/michael/archive/2009/06/17/gett > ing-the-contents-of-an-active-directory-integrated-dns-zone.aspx> > > Regards, > > Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: > http://TheEssentialExchange.com/blogs/michael > Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf >
| | | |
| fhartono
Posts:27
 | | 12/24/2009 1:51 AM |
| Isn't this the same as dnscmd %servername% /ZONEEXPORT %adizonename% command?
Thats how we are backing up the adi zones & other zones in our side anyway... any difference?
On Wed, Dec 23, 2009 at 10:27 AM, Michael B. Smith < michael@theessentialexchange.com> wrote:
> I finally needed to go back and update this project... so I did a v2 of my > script, incorporating your parsing corrections and adding more record > types. > > Thanks! > > < > http://theessentialexchange.com/blogs/michael/archive/2009/12/22/getting-th > e-contents-of-an-active-directory-integrated-dns-zone-version-2.aspx> > > -----Original Message----- > From: activedir-owner@mail.activedir.org > [mailto:activedir-owner@mail.activedir.org] On Behalf Of Chris Dent > Sent: Thursday, June 18, 2009 6:50 AM > To: activedir@mail.activedir.org > Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains > > > Published here: > > http://www.highorbit.co.uk/?p=1097 > > I thought about posting the PowerShell I used to rip it apart / put it back > together, but I think Michael's is neater in far too many areas  > > Chris > > -------------------------------------------------- > From: "Chris Dent" <chris@highorbit.co.uk> > Sent: Thursday, June 18, 2009 10:09 AM > To: <activedir@mail.activedir.org> > Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains > > > Hi Michael, > > > > I did some work on decoding the DNSRecord property too back then (not > > enough real work to do it seems and it made a few colleagues sigh at > > me rather a lot). > > > > I'm still shamefully stuck on at least two of the fields (depending on > > field length), but everything else seems to fit rather nicely. I only > > bothered mapping the more common record types (I consider those to be > > A, CNAME, MX, NS, SOA, SRV and TXT). > > > > I think it is perhaps worth noting that the first two bytes are not > > the record type, they're the full length of the portion of the > > attribute which holds the record data. For the most part that won't > > make a blind bit of difference to your script, you'd have to run into > > a TXT record with 3 characters in it to notice a discrepancy (I'd have > > to check that too, educated guess). > > > > The record type is represented by the 3rd and 4th bytes, as a little > > endian. The values match up to the those published here: > > > > http://www.iana.org/assignments/dns-parameters > > > > I tested that theory for all record types which can be created in the > > GUI and found no discrepancies. > > > > With the maps it is possible to construct records directly rather than > > using WMI, GUI etc (it's possible to switch between record types as > > well if that was really desirable). The fields I cannot decipher > > appear to be trivial and seem to have very predictable values but > > since they never change I can't figure out what they mean, I can apply > > a bit of meaning, but it's nothing more than a guess. > > > > I'll publish the maps if you're interested, just need to tidy them > > little first  > > > > Chris > > > > > > From: Michael B. Smith > > Sent: Wednesday, June 17, 2009 10:40 PM > > To: activedir@mail.activedir.org > > Subject: [ActiveDir] Dumping Active Directory Integrated domains > > > > > > A month or two ago, someone asked about dumping ADI domains. > > > > I wrote a script at that point, but didn't post it. So, I just now put > > it up on my blog in case anyone is still interested. It's in > > PowerShell (duh). Totaling 453 lines. Although nothing would prevent > > it from being done in VBScript or anything else that can read AD. > > > > I suspect it would take fewer lines in C/C++/C# and more in VBScript. > > J > > > > (Note that I wasn't trying to minimize lines, but to emphasize > > readability and comprehension. I'm sure I could reduce the line-count > > by at least one-third to one-half in PowerShell too.) > > > > <http://theessentialexchange.com/blogs/michael/archive/2009/06/17/gett > > ing-the-contents-of-an-active-directory-integrated-dns-zone.aspx> > > > > Regards, > > > > Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: > > http://TheEssentialExchange.com/blogs/michael<http://theessentialexchange.com/blogs/michael> > > Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf > > > > >
-- Kind Regards,
Freddy Hartono
| | | |
| michael1
Posts:438
 | | 01/02/2010 3:16 PM |
| This provides you with a CSV option and prettier formatting. The CSV option is the big deal (for me).
From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Freddy Hartono Sent: Wednesday, December 23, 2009 8:49 PM To: activedir@mail.activedir.org Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
Isn't this the same as dnscmd %servername% /ZONEEXPORT %adizonename% command?
Thats how we are backing up the adi zones & other zones in our side anyway... any difference?
On Wed, Dec 23, 2009 at 10:27 AM, Michael B. Smith <michael@theessentialexchange.com> wrote:
I finally needed to go back and update this project... so I did a v2 of my script, incorporating your parsing corrections and adding more record types.
Thanks!
<http://theessentialexchange.com/blogs/michael/archive/2009/12/22/getting-th <http://theessentialexchange.com/blogs/michael/archive/2009/12/22/getting-th e-contents-of-an-active-directory-integrated-dns-zone-version-2.aspx> e-contents-of-an-active-directory-integrated-dns-zone-version-2.aspx>
-----Original Message----- From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Chris Dent
Sent: Thursday, June 18, 2009 6:50 AM To: activedir@mail.activedir.org Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
Published here:
http://www.highorbit.co.uk/?p=1097
I thought about posting the PowerShell I used to rip it apart / put it back together, but I think Michael's is neater in far too many areas 
Chris
-------------------------------------------------- From: "Chris Dent" <chris@highorbit.co.uk> Sent: Thursday, June 18, 2009 10:09 AM To: <activedir@mail.activedir.org> Subject: Re: [ActiveDir] Dumping Active Directory Integrated domains
> Hi Michael, > > I did some work on decoding the DNSRecord property too back then (not > enough real work to do it seems and it made a few colleagues sigh at > me rather a lot). > > I'm still shamefully stuck on at least two of the fields (depending on > field length), but everything else seems to fit rather nicely. I only > bothered mapping the more common record types (I consider those to be > A, CNAME, MX, NS, SOA, SRV and TXT). > > I think it is perhaps worth noting that the first two bytes are not > the record type, they're the full length of the portion of the > attribute which holds the record data. For the most part that won't > make a blind bit of difference to your script, you'd have to run into > a TXT record with 3 characters in it to notice a discrepancy (I'd have > to check that too, educated guess). > > The record type is represented by the 3rd and 4th bytes, as a little > endian. The values match up to the those published here: > > http://www.iana.org/assignments/dns-parameters > > I tested that theory for all record types which can be created in the > GUI and found no discrepancies. > > With the maps it is possible to construct records directly rather than > using WMI, GUI etc (it's possible to switch between record types as > well if that was really desirable). The fields I cannot decipher > appear to be trivial and seem to have very predictable values but > since they never change I can't figure out what they mean, I can apply > a bit of meaning, but it's nothing more than a guess. > > I'll publish the maps if you're interested, just need to tidy them > little first  > > Chris > > > From: Michael B. Smith > Sent: Wednesday, June 17, 2009 10:40 PM > To: activedir@mail.activedir.org > Subject: [ActiveDir] Dumping Active Directory Integrated domains > > > A month or two ago, someone asked about dumping ADI domains. > > I wrote a script at that point, but didn't post it. So, I just now put > it up on my blog in case anyone is still interested. It's in > PowerShell (duh). Totaling 453 lines. Although nothing would prevent > it from being done in VBScript or anything else that can read AD. > > I suspect it would take fewer lines in C/C++/C# and more in VBScript. > J > > (Note that I wasn't trying to minimize lines, but to emphasize > readability and comprehension. I'm sure I could reduce the line-count > by at least one-third to one-half in PowerShell too.) > > <http://theessentialexchange.com/blogs/michael/archive/2009/06/17/gett > ing-the-contents-of-an-active-directory-integrated-dns-zone.aspx> > > Regards, > > Michael B. Smith, MCITP:SA,EMA/MCSE/Exchange MVP My blog: > http://TheEssentialExchange.com/blogs/michael > Monitoring Exchange w/OpsMgr now available http://snurl.com/45ppf >
-- Kind Regards,
Freddy Hartono
| | | |
|
|