American vs Swedish lunch

We are still in the US and we decided way back that it would be a good experience for Little Swede to go to summer camp. This has led to a plethora of questions from Swedes, mostly because I keep calling it the wrong word in Swedish � namely Sommarl�ger and not sommarkollo. Little Swede�s pediatric nurse was perplexed by the amount of forms we had to fill in for just a few hours of camp, but also fascinated and we had a long discussion on vaccinations and school relations. But that is a whole other story.

Summer camp has been good for Little Swede. But it has also led to the dilemma of the American packed lunch. Unlike his Swedish daycare, where lunch is included and all Little Swede�s special dietery needs met while keeping things about 90% organic, day camp (which costs about the equivalent of 4 months of Swedish full time daycare) requires packed lunch.

Little Swede has never eaten his own packed lunch. In Little Swede�s world sandwiches are openfaced and preferably covered with peanut butter. We are having morning cultural clashes with how to fit an open-faced sandwich in a plastic bag � something the Swede seems to believe is possible but of which I am highly skeptical.

Also Little Swede has never really had many prepackaged snacks, or much of any snack food at all.  I tried a few roasted chickpeas on day one (don�t make that face, chick peas are one of Little Swede�s favorite foods!) but we have settled on goldfish crackers.

And so, our little boy, who easily scarfs down three portions of school lunch (something I abhorred for most of my school life � we only had a cafeteria in high school anyway), is onlypicking at his packed lunch.

We have tried a variety of sandwiches. We have tried showing him how to open the baggies. He gets help from his counselors. But, he does not seem to enjoy a packed lunch. We tried purple colored Kefir, but really he only seems to eat the package of fruit I send him with every day (see how well Swedish schools have taught him!) 

Swedish Dads vs. American Dads

I've been a bad blogger. I've missed blogging about the high holiday of Sweden, Midsummer. All I can say is, it was good. Now we are in the US doing summer US style - hot and humid, cicadas singing, summer camp and really loud TV advertisements.

Maybe its a new trend, maybe its an old trend. Maybe it's that I now have Netflix on my computer that I watch while nursing Our newest Swede, I don't know. But I have been seeing a lot more ads lately. And a lot more ads where American Dads get a really bad rap. (That is probably American dads, but that grammar rule always drives me nuts).

Anywho.....

The fact is that in reality I see American Dads being active Dads everywhere here. They are at the playground, they are changing diapers, they are wiping tears. But just like women are left being really excited about cleaning the kitchen on American TV, the latest thing seems to be Dads left being completely helpless when faced with an infant.

Here is a sad example.

Here American Dad has no role to play at all while baby is born. His first job has something to do with a car seat. The Swede says meeting his child for the first time was a life changing moment for him. Not so for this poor guy.....

Thankfully, on further research the other ad I saw that I thought made Dad look totally worthless was actually an Uncle --- which is a little better. But still, why is it always men bumbling around babies? I had no idea what to do with an infant until I had one of my own.

Should I use .local as part of the domain name? No, here are some info about it

Hi,

I've talked to many customers about using .local in the domain name (example: mydomain.local). I've always stated that they should not and some of the reasons are:

----snip----
From: http://en.wikipedia.org/wiki/.local

Multicast DNS standard

Internet Engineering Task Force (IETF) standards-track RFC 6762, which has been approved and was officially published on February 20, 2013, essentially reserves the use of .local as a pseudo-TLD for link-local hostnames that can be resolved via the Multicast DNS name resolution protocol. Page 5 of that publication states:

...this document allows any computer user to elect to give their computers link-local Multicast DNS host names of the form: "single-dns-label.local.". For example, a laptop computer may answer to the name "MyComputer.local."...

This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local." is link-local, and names within this domain are meaningful only on the link where they originate. This is analogous to IPv4 addresses in the 169.254/16 prefix or IPv6 addresses in the FE80::/10 prefix, which are link-local and meaningful only on the link where they originate.

Any DNS query for a name ending with ".local." MUST be sent to the mDNS IPv4 link-local multicast address 224.0.0.251 (or its IPv6 equivalent FF02::FB)  

...Implementers MAY choose to look up such names concurrently via other mechanisms (e.g., Unicast DNS) and coalesce the results in some fashion. Implementers choosing to do this should be aware of the potential for user confusion when a given name can produce different results depending on external network conditions (such as, but not limited to, which name lookup mechanism responds faster).

Name resolution issues may arise if multicast DNS software is used in conjunction with a network that implements the local top-level DNS domain.

MS Recommendations

The connection of Macintosh and Linux computers and/or zeroconf peripherals to Windows networks can be problematic if those networks include name servers that use .local as a search domain for internal devices.

At one time, Microsoft at least suggested the use of .local as a pseudo-TLD for small private networks with internal DNS servers, via documents that (as of this writing) are still accessible. For example, support article 296250 included the following option:

Make the name a private domain name that is used for name resolution on the internal Small Business Server network. This name is usually configured with the first-level domain of .local. At the present time, the .local domain name is not registered on the Internet.

However, more recent articles have cautioned or advised against such use of the .local TLD.

Support article 300684 listed contoso.local as an example of a "best-practice Active Directory domain name", but then added:

We recommend that you register DNS names for the top-most internal and external DNS namespaces with an Internet registrar. which would of course preclude using that or any other domain ending with .local.

Technet article 708159 suggested .local for the exact opposite reason:

Using the .local label for the full DNS name for the internal domain is a more secure configuration because the .local label is not registered for use on the Internet. This separates your internal domain from your public Internet domain name.

but later recommended against it:

If you have Macintosh client computers that are running the Macintosh OS X version 10.2 operating system or later, ... it is recommended that you do not use the .local label for the full DNS name of your internal domain. If you have Macintosh client computers that are running the Macintosh OS X version 10.3 operating system or later, ... it is recommended that you do not use the .local label for the full DNS name of your internal domain. If you must use the .local label, then you must also configure settings on the Macintosh computers so they can discover other computers on the network. For more information about how to configure client computers running Macintosh OS X version 10.3 or later, see "Connecting Macintosh Computers to a Windows Small Business Server 2003 Network" on the Microsoft Web site.

Technet article 726016[5] cautioned against using .local:

...we do not recommend using unregistered suffixes, such as .local.

Global .local DNS queries

.local is an officially reserved Special-Use Domain Name and such host names will never be resolvable by the global Domain Name System

 References

1.Cheshire, Stuart, and Krochmal, Marc. "RFC 6762: Multicast DNS". Internet Engineering Task Force.

2."Domain Name System name recommendations for Small Business Server 2000 and Windows Small Business Server 2003". support.microsoft.com.
3."Information about configuring Active Directory domains by using single-label DNS names". support.microsoft.com.
4."Internal Domain Information (OEM)". technet.microsoft.com.

5."Selecting the Forest Root Domain". technet.microsoft.com.

6."Special-Use Domain Names".

7.George Kirikos. "Most Popular Invalid TLDs Should Be Reserved". Circle ID. Archived from the original on 21 June 2009. Retrieved 2013-04-12.
8."Most Popular TLDs Queried". root-servers.org. Archived from the original on 2009-09-16.
----snip----

More info:

Active Directory Domain Naming Considerations:
http://social.technet.microsoft.com/wiki/contents/articles/17974.active-directory-domain-naming-considerations.aspx

I will post more about this when time permits.

Best regards,
/Jimmy

Should I use Rendom.exe?

Well, it all comes down to your environment and how it can handle down-time. Personally I would migrate if possible due to the complexity of the domain rename process.
What you need to understand is that the domain rename process is complex and in some ways "uncontrolled". Meaning that if you start it, it will try to finish or fail.

Things to understand:
- Headless Management: Rendom will not use AD Repl, each DC will be contacted individually.
- Forest will be "offline" during the process: The time is proportional to the number of DCs.
- DC is either successful or must be removed from the forest.
- Member computers must be rebooted twise after all DCs are updated, note that legacy OS needs to unjoin/join the domain.
- DNS host names are not automatically changed during rendom: Primary DNS suffix of the DC will not mathc the new domain DNS name. Requires additional steps after rendom.
- DNS suffix on member computers will not match for a period of time: Time it takes is proportional to the number of machines in the domain and if it is auto updated or not.
- Runs from a separate computer
- CLI interface
- Each DC is changed independently
- Step-by-step, steps must succeed on every DC or it stops
- Steps are idempotent

3 DC states:
- Initial
- Prepared
- Final (success or fail)

Note that Prepared to Final can only be accomplished if every DC in the forest has reached the required state!

Overview of the steps:
- Manually specify the new forest structure
- Generate instructions encoded as script
- Transfer the script to each DC
- Verify the script on every DC to see if it is ready to execute the instructions
- Execute instructions on each DC (forest offline during this step)
- Fix-up Policy metadata
- Clean-up metadata written to the directory

Remember that this is just a basic overview of how it works, you must test, test again and test again in a lab before trying it in production!

The LastLogonTimeStamp Attribute � What it was designed for and how it works

I came across an excellent explanation of the LastLogonTimeStamp attribute and how it actually works:
http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

If you ever had a question about it, I bet you'll find the answer there.

What is new in Windows 8.1

Here you can read about Windows 8.1: http://technet.microsoft.com/en-us/windows/dn140266. 

NON-LVR groupmembers - how to find them - Step 4.

Step 3 in my blog (http://www.jimmytheswede.blogspot.se/2013/06/non-lvr-groupmembers-how-to-find-them.html) will create a separate file for each group (DN is the filename of the group). Within those files you need to search for the string LEGACY, so what I did in step 4 was to search the files for the string LEGACY and then copy the files into a separate folder.

Note that my folder containing the files is "c:\temp\searchFiles" and I copied the files that contained the string "LEGACY" to the folder "c:\temp\searchResult".

In PowerShell:
get-childitem c:\temp\searchFiles | select-string LEGACY -List |%{copy-item -path $_.path -destination 'c:\temp\searchResult'}

Now I have all files (named as the group's DN) in a separate folder that contains LEGACY members, I then create a list of the filenames as input when I change them (http://www.jimmytheswede.blogspot.se/2013/06/non-lvr-groupmembers-how-to-change-them.html).