Remotely Manage Windows Servers: Leverage Adminpak for Efficient Administration

Table of Contents

Managing Windows Servers efficiently often requires the ability to administer them remotely. This capability is crucial for IT professionals, allowing them to perform tasks, troubleshoot issues, and configure systems without needing direct physical access to the server. The Administration Tools Pack (Adminpak) has historically been a cornerstone for this remote management, particularly for Windows Server 2003, Windows XP, and Windows 2000 environments. This article delves into the various options available for remote administration, highlights the utility of Adminpak, and addresses common compatibility issues that administrators might encounter.

Understanding Remote Administration Options¶

To achieve seamless administrative operations, the most ideal scenario is often when the administrative workstation runs the same operating system version as the server being managed. However, this is not always practical. Fortunately, Windows Server 2003 and Windows 2000 installation media include a suite of command-line and graphical administrative tools that facilitate both local and remote management across different operating system versions with a high degree of interoperability.

For administrators looking to remotely manage Windows Server 2003 or Windows 2000 systems from clients running Windows Server 2003, Windows XP, or Windows 2000, several effective methods can be employed. Each method offers distinct advantages depending on the specific administrative task and environmental constraints. Understanding these options is key to optimizing server management workflows and ensuring operational efficiency.

Graphical Administrative Tools (Adminpak)¶

The Administration Tools Pack (Adminpak) bundles essential graphical administrative tools, providing a user-friendly interface for managing remote servers. These tools are designed to streamline common administrative tasks, making them accessible to a wider range of IT personnel. While Adminpak aims for broad compatibility, certain interoperability challenges may arise when managing systems across different Windows versions. In such cases, it may be necessary to perform tasks directly on the console of the target computer or from a machine running an identical operating system.

Terminal Services (Remote Desktop)¶

Terminal Services, now commonly known as Remote Desktop, offers a robust solution for remote administration by providing a full graphical user interface (GUI) of the target server. This method is particularly useful when command-line tools or graphical tools installed locally on the server are required. To overcome the typical two-session limit of Terminal Services for administration, administrators can configure the server in Application Server mode, effectively transforming it into a dedicated management gateway. If compatibility issues arise between operating systems, executing administrative tasks from a server with Terminal Services enabled and running the same operating system as the remote target is often the most reliable approach.

Command-Line Tools and Scripts¶

For advanced administrators and automated tasks, command-line tools and scripting offer unparalleled flexibility and power. Tools like Active Directory Service Interfaces (ADSI), Windows Net.exe commands, and utilities packaged with Suptools.msi allow for precise control and scripting of administrative operations. These tools can be executed both locally and remotely, making them invaluable for batch processing and complex configurations. When interoperability concerns become prominent, it is advisable to execute these tasks directly on the target server’s console or from a designated administrative machine running an identical operating system to ensure full functionality.

For example, while Windows Server 2003 Service Pack 2 (SP2) Support Tools can be installed on Windows XP Professional, their correct functionality is not always guaranteed, with tools like Dfsutil.exe, Netdiag.exe, Netcap.exe, and Ntfrsutil.exe known to experience issues. Therefore, to manage a Windows Server 2003 SP2-based computer effectively, it is highly recommended to run these tools from a computer also running Windows Server 2003 SP2. Leveraging the Remote Desktop feature for connecting to the Windows Server 2003 SP2-based machine and running the Support Tools there is a reliable workaround.

Here’s a visual representation of these remote administration options:

mermaid graph TD A[Administrator Workstation] -->|Method 1: Graphical Tools (Adminpak)| B(Remote Windows Server 2003/2000) A -->|Method 2: Terminal Services / Remote Desktop| C(Remote Windows Server 2003/2000) A -->|Method 3: Command-Line Tools / Scripts| D(Remote Windows Server 2003/2000) B -- Requires Adminpak --> E[Seamless Experience (Same OS)] C -- Ideal for GUI access --> F[Bypasses Session Limits (Application Server Mode)] D -- Ideal for Automation --> G[Precise Control & Scripting]

The Evolution and Compatibility of Adminpak¶

Adminpak.msi, commonly referred to as Adminpak, is a self-extracting file that bundles frequently used graphical administrative tools for Windows Servers. For Windows 2000 Server family, the Administration Tools Pack was found in the I386 folder on the installation CD and was designed to install on Windows 2000 systems. A significant portion of these tools could also remotely administer 32-bit and 64-bit versions of Windows XP Professional and Windows Server 2003.

The Windows Server 2003 Administration Tools Pack, while also located in the I386 folder of the Windows Server 2003 CD, was additionally made available as a free download from Microsoft’s website. This marked a shift towards broader accessibility for administrators. The table below provides a comprehensive overview of the operating systems on which various Adminpak versions can be installed and the server operating systems they are capable of remotely managing.

Version of Adminpak / RSAT	Installs and runs on these operating systems	Remotely manages these operating systems
Windows 2000 Server Adminpak	Windows 2000 Professional, Windows 2000 Server family	Windows Server 2003 (32/64-bit), Windows 2000 Server family
Windows Server 2003 original (RTM) Adminpak	Windows Server 2003 (32-bit), Windows XP Professional with SP1 or later/SP2	Windows Server 2003 (32/64-bit), Windows 2000 Server family
Windows Server 2003 SP1 Adminpak	Windows Server 2003 (32/64-bit), Windows XP Professional with SP1 or later/SP2 (32/64-bit)	Windows Server 2003 (32/64-bit), Windows 2000 Server family
Windows Server 2003 SP2 Adminpak	Windows Server 2003 All Editions (32/64-bit), Windows XP Professional 64-bit Edition, Windows XP Professional with SP2+ (32-bit)	Windows Server 2003 (32/64-bit), Windows 2000 Server family
Remote Server Administration Tool (RSAT)	Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2	Windows Server 2003 (32/64-bit), Windows 2000 Server family, Windows Server 2008/R2+

When aiming to remotely administer Windows Server 2003 or Windows 2000 member servers and domain controllers from Windows Server 2003-based or Windows XP Professional-based clients, several crucial installation considerations must be taken into account. Firstly, any earlier beta versions of the Windows Server 2003 Administration Tools Pack must be completely removed before attempting to install the final release version. This is critical to prevent installation conflicts and ensure proper functionality.

It is important to note that in certain specialized scenarios, servers might only be effectively administered from clients running the exact same operating system version. For instance, some remote administration operations against Windows 2000-based servers are exclusively executable from Windows 2000-based clients, ensuring full feature compatibility. Similarly, specific operations targeting Windows Server 2003-based computers may only be performed from Windows Server 2003-based or Windows XP-based clients. This article aims to clearly document these limitations and restrictions for each tool included within the Administration Tools Pack, guiding administrators to the most appropriate management approach for their environment.

Installation Challenges and Solutions¶

Administrators upgrading a Windows 2000-based computer with Adminpak installed to Windows Server 2003 or Windows XP might encounter compatibility warnings. The System Compatibility Report during the upgrade process typically indicates that the Windows 2000 administration tools are incompatible. Despite this warning, the upgrade can proceed, but it’s essential to then install the Windows Server 2003 Administration Tools Pack post-upgrade. This ensures that the system is equipped with the correct and compatible set of administration tools for the new operating environment.

Attempting to remove Windows 2000 administration tools via “Add or Remove Programs” might trigger an “apphelp dialog cancelled” error. This error can generally be ignored, as installing the Windows Server 2003 Administration Tools Pack will effectively supersede and update the existing icons and functionalities. It is crucial to remember that the Windows 2000 Adminpak.msi file is incompatible with and unsupported on Windows Server 2003-based or Windows XP-based clients. For these newer operating systems, always utilize the Windows Server 2003 version of the Administration Tools Pack to ensure proper operation.

The Windows Server 2003 Administration Tools Pack cannot be installed or executed on Windows 2000-based computers; attempting to do so will result in an error message indicating incompatibility or a service pack level mismatch. Similarly, command-line utilities from the Windows Server 2003 Adminpak are designed exclusively for Windows XP or Windows Server 2003, and will fail on Windows 2000 systems due to DLL mismatches or entry-point errors. Conversely, trying to install the Windows 2000 Adminpak on a Windows Server 2003-based machine will also result in an incompatibility error, reinforcing the need to use the correct version for the respective operating system.

It is worth noting that Windows XP Professional does not natively include the Windows Server 2003 Adminpak.msi, as these tools are bundled with the Windows Server 2003 product release. Furthermore, Windows XP Professional with Service Pack 2, when used with the Windows Server 2003 Administration Tools Pack, loses the ability to administer Cluster servers, a functionality present with SP1. While most Windows Server 2003 administration tools largely mirror their Windows 2000 counterparts, they often introduce enhanced functionality. However, these enhancements, such as the drag-and-drop feature in the Users and Computers snap-in, may not be fully supported or enabled when managing Windows 2000-based computers. Features dependent on Windows Server 2003-specific functionalities, like “Saved query for last logon time,” will not work on Windows 2000 servers due to a lack of required server-side support. In rare instances, cross-version incompatibility can render tools unusable.

Steps to Install the Windows Server 2003 Administration Tools Pack¶

Installing the Windows Server 2003 Administration Tools Pack is a straightforward process, but requires careful attention to detail to ensure a successful deployment. This involves downloading the correct version, preparing the system, and executing the installation. Following these steps meticulously will help establish a robust remote administration environment.

1. Download the Administration Tools Pack: Begin by obtaining the Windows Server 2003 Service Pack 2 Administration Tools Pack. This can be found on the Microsoft Download Center. Perform a keyword search for “adminpak” and filter for “Windows XP” or “Windows Server” operating systems to locate the relevant download.
2. Log on with Administrator Credentials: Ensure you are logged on to the local computer using an account with administrator privileges. This is crucial for the installation process to have the necessary permissions to modify system files and settings.
3. Remove Earlier Versions (If Applicable): It is imperative to remove any previous versions of the Administration Tools Pack before installing a newer one, including the final release. If you encounter difficulties using “Add or Remove Programs” in Control Panel to uninstall older versions, the MSIZap tool from the Support\Tools\Suptools.msi package can be used to forcefully remove cached packages.
   • For Windows Server 2003 Beta 3 users: If you have the Windows Server 2003 Beta 3 version installed, save the following text as a file named Rrasreg.cmd and run it from the command prompt to clean up old registry keys:
     

     rem
     rem RAS user snap-in extension - registry key cleanup, Beta 3 to RC1
     rem upgrades only.
     rem
     rem use Reg.exe to delete the old key that was created by the Beta 3
     rem RAS user extension snapin.
     rem
     reg delete HKEY_CLASSES_ROOT\RasDialin.UserAdminExt /f
     reg delete HKEY_CLASSES_ROOT\RasDialin.UserAdminExt.1 /f
     reg delete HKLM\SOFTWARE\Microsoft\MMC\NodeTypes\{19195a5b-6da0-11d0-afd3-00c04fd930c9}\Extensions\NameSpace /f
     

4. Install the Administration Tools Pack: The downloaded Adminpak.exe is a self-extracting file. Once extracted, it will create an Adminpak-readme.txt file and the Adminpak.msi file in your specified folder. To install, simply right-click the .msi file and select Install, or double-click the file. Alternatively, for large deployments, the file can be remotely installed or published to Windows XP-based or Windows Server 2003-based computers using Group Policy in Active Directory when a user logs on.

A key point to remember: when upgrading a Windows 2000-based server to Windows Server 2003, the system compatibility check during the Winnt32.exe or Winnt32 /checkupgradeonly process might incorrectly detect the presence of the Administration Tools Pack on your Windows 2000 domain controller. This occurs because the Active Directory Installation Wizard (Dcpromo.exe) on Windows 2000 utilizes a feature within the Windows 2000 Adminpak file to generate shortcut menu items for domain administration tools. You can safely disregard this message and proceed with the upgrade from Windows 2000 to Windows Server 2003 without interruption.

Troubleshooting Remote Administration Problems¶

When encountering issues with remote administration, a structured approach to troubleshooting can significantly expedite problem resolution. Before contacting Microsoft Customer Support Services (CSS), a few initial steps can help diagnose and often resolve common problems. Understanding the version of your installed tools and being aware of known compatibility issues are crucial first steps in this process.

1. Verify Latest Supported Version: Always confirm that you are using the latest supported version of the Adminpak.msi snap-ins and DLL files available from the Microsoft Web site. The APVer.vbs script, included with the original-release Adminpak Web download package, can help determine the installed version. Navigate to the folder where you expanded Adminpak.exe and type apver /? at the command prompt to view its options.
2. Check Known Compatibility Issues: Review the documented known compatibility issues within this article to ascertain if the problem you are facing is a recognized limitation. This often provides immediate workarounds or clarifies expected behavior.
3. Contact Support: If the issue persists after these initial checks, notify Microsoft Customer Support or your designated support provider, providing them with details of the steps taken and observations made.

Additionally, remember these important notes:
* Older versions of Adminpak.msi (Beta 3, RC1, RC2) must be removed before installing Windows XP SP1 on a Windows XP-based computer. Failure to do so may prevent uninstallation later via “Add or Remove Programs.”
* Windows XP Home Edition is not a supported operating system for Adminpak installations and cannot join Windows NT 4.0, Windows 2000, or Windows Server 2003 domains.

Known Issues for Windows Server 2003 Original-Release Adminpak.msi¶

Understanding specific compatibility and functionality issues associated with the original-release version of the Windows Server 2003 Adminpak.msi is crucial for effective remote server management. These issues range from installation quirks to operational limitations across various administrative snap-ins and command-line utilities.

Installation and Upgrade Issues¶

A common scenario involves Windows 2000 domain controllers, where Winnt32.exe or Winnt32 /checkupgradeonly might incorrectly report that Adminpak.msi is installed, even if it has never been installed or has already been removed. This false positive occurs because the Active Directory Installation Wizard (Dcpromo.exe) in Windows 2000 uses an internal feature of its Adminpak.msi version to install menu shortcuts on domain controllers. You can safely disregard this warning during an upgrade. After the upgrade to Windows Server 2003 is complete, it is important to manually install the correct Windows Server 2003 version of Adminpak.msi from the I386 folder of the installation media to ensure you have the most current domain administration tools.

Active Directory Domains and Trusts¶

The original-release Windows Server 2003 Administration Tools Pack introduced Lightweight Directory Access Protocol (LDAP) signing, a security enhancement. For Windows 2000 domain controllers to be remotely administered by Windows 2000 Service Pack 4 (SP4), Windows XP, or Windows Server 2003 clients using NTLM authentication, Windows 2000 Service Pack 3 must be installed on the domain controllers. Furthermore, when using a Windows 2000-based computer to administer Windows Server 2003-based domains, advanced UI features such as domain and forest functionality or advanced trusts will not be visible.

Active Directory Schema¶

Similar to Domains and Trusts, the original-release Windows Server 2003 Adminpak’s introduction of LDAP signing necessitates Windows 2000 SP3 for Windows 2000 domain controllers being remotely administered via NTLM authentication from SP4-enabled Windows 2000, Windows XP, or Windows Server 2003 clients. A subtle change in the schema snap-in is the removal of the “Schema may be modified on this Domain Controller” checkbox from the Change Schema Master dialog box. By default, schema updates are now enabled on Windows Server 2003-based domain controllers, simplifying configuration but requiring awareness of the change.

Active Directory Sites and Services¶

Again, LDAP signing in the original-release Adminpak requires Windows 2000 SP3 for remote administration of Windows 2000 domain controllers from Windows 2000 SP4, Windows XP, or Windows Server 2003 clients utilizing NTLM authentication. Notably, there is no direct support for editing certificate templates through this version of the snap-in. Additionally, the Show Services Node command on the View menu has been removed on Windows XP clients, which can alter the administrative interface. When the Service Pack 1 version of Active Directory Sites and Services is launched on 64-bit systems, it may fail to edit Group Policy, presenting an error message: “Windows cannot find gpedit.msc.” To resolve this, modify the command-line syntax to explicitly use the 32-bit MMC: %windir%\syswow64\mmc.exe %systemroot%\system32\dssite.msc -32. There are no known issues when managing Windows 2000-based forests from Windows Server 2003-based or Windows XP Professional-based clients.

Active Directory Users and Computers¶

LDAP signing is a recurring requirement, meaning Windows 2000 SP3 must be installed on Windows 2000 domain controllers if they are to be remotely administered by Windows 2000 SP4, Windows XP, or Windows Server 2003 clients using NTLM authentication. A significant functional change is the removal of the Dial-in tab, which configures Routing and Remote Access dial-in or VPN access and callback settings, when the original-release Adminpak is installed on Windows XP-based clients. This change requires administrators to adjust their management approach.

Workarounds for the missing Dial-in tab include:
* Installing hotfix Q837490 on pre-Service Pack 2 Windows XP clients. This hotfix restores the remote access dial-in tab for the original-release Windows Server 2003 Active Directory Users and Computers snap-in (Dsa.msc).
* Installing the Windows Server 2003 Service Pack 2 version of Adminpak on Windows XP-based computers with Windows XP Service Pack 2 or later.
* Utilizing Remote Access Policy for managing dial-in permissions. This is the recommended administration model introduced in Windows 2000 to manage remote access through Windows groups.
* Accessing Active Directory Users and Computers via Terminal Services or Remote Desktop from a Windows Server 2003-based or Windows 2000-based computer, or directly logging onto the console of such a server.

The remote access policy administration model provides benefits like detailed administration (allowing separate groups and administrators for dial-in permissions), leveraging groups for access control (consistent with most Windows programs), and precise connection-specific access policy control (differentiating permissions for dial-up, VPN, and wireless technologies). This model can be configured in the Remote Access Policies node of the Routing and Remote Access snap-in when the domain is in Windows 2000 native mode or later.

Furthermore, Windows XP-based computers joined to Windows 2000-based domain controller domains do not support the enhanced functionality for selecting multiple users and performing bulk edits of attributes like home folders and profile paths. This multiple-selection feature is only supported in forests with schema version 15 or later, typically after ADDPREP /ForestPrep and /DomainPrep have been run in a Windows 2000-based forest and domain. Similar to Sites and Services, launching the Service Pack 1 version of Active Directory Users and Computers on 64-bit systems may fail to edit Group Policy, yielding the “Windows cannot find gpedit.msc” error. The workaround involves using the 32-bit MMC path: %windir%\syswow64\mmc.exe %systemroot%\system32\dsa.msc -32 back.

Authorization Manager¶

This tool was a new addition to the Administration Tools Pack starting with the Windows Server 2003 RC1 version and subsequent releases. It allows for the management of role-based access control, offering a more granular approach to authorization within applications.

Certification Authority¶

Due to extensive schema changes between Windows 2000 and Windows Server 2003, cross-version administration of Certification Authority is not supported. This means Windows XP Professional-based clients cannot administer Windows 2000-based Certification Authorities, and Windows 2000-based clients cannot manage Windows Server 2003-based ones. To administer Windows Server 2003-based Certification Authorities, perform remote administration from the console or via a Terminal Services session on the target computer. For Windows 2000 Server-based Certification Authorities, use Windows 2000-based clients.

Cluster Administrator¶

A notable limitation for administrators using Windows XP Professional with Service Pack 2 is the inability to administer Cluster servers when employing the Windows Server 2003 Administration Tools Pack. However, this functionality is retained if you are using Windows XP Professional with Service Pack 1 alongside the Windows Server 2003 Administration Tools Pack. This highlights the importance of specific service pack levels for certain administrative tasks.

Connection Manager Administration Kit¶

Cross-version administration from Windows 2000 to Windows Server 2003 is generally not recommended for the Connection Manager Administration Kit (CMAK) because it fails to produce Windows XP profiles. This limitation implies that administrators should align the CMAK version with the target operating system for proper profile generation and deployment.

DHCP¶

Several issues exist with Dynamic Host Configuration Protocol (DHCP) administration. Windows 2000 tools are unable to generate a dump file of Windows Server 2003 DHCP configurations due to underlying code changes. Furthermore, the netsh dhcp server ip dump command output is truncated when issued from a Windows XP-based client against a Windows Server 2003-based DHCP server. By default, the netsh dhcp server command does not run from Windows XP-based clients, leading to “Parameter(s) passed are either incomplete or invalid” errors. To enable remote DHCP server administration from a Windows XP-based client, install the Administration Tools Pack and then run netsh add helper dhcpmon.dll at the command prompt.

Distributed File System (DFS)¶

DFS administration tools have seen improvements, including support for ring, hub and spoke, and custom topologies for File Replication Service (FRS) replication of DFS roots and links. They also allow configuration of connection priority in the Q321557 and SP3 releases of Windows 2000 Ntfrs.exe. If using a Windows XP-based client to administer Windows Server 2003 DFS, the Windows XP SP1 update is required. Additionally, the Adminpak now includes the Windows Server 2003 DFS Server Help file, providing better guidance for administrators.

DNS¶

When accessing a Domain Name System (DNS) server through its IP address, certain information, such as Forwarder details, may be returned incorrectly. To resolve this, it is recommended to access the DNS server using its host name rather than its IP address. This issue specifically applies to the original-release version of the Windows Server 2003 Administration Tools Pack.

Directory Service Command-Line Utilities¶

As with other Active Directory-related tools, the original-release Windows Server 2003 Administration Tools Pack includes LDAP signing. Consequently, Windows 2000 domain controllers being remotely administered by Windows 2000 SP4, Windows XP, or Windows Server 2003 clients using NTLM authentication must have Windows 2000 SP3 installed to ensure compatibility and secure communication.

Drag-and-Drop Functionality of Active Directory Snap-ins¶

The original release of Windows Server 2003 Adminpak.msi introduced drag-and-drop capabilities to the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. While convenient, this feature carries a significant risk: accidental or unknowing movement of organizational units (OUs) under different parent OUs can lead to severe consequences. These include Group Policy objects (GPOs) failing to apply as expected (due to changes in OU hierarchy or new GPOs applying based on the object’s new location), which can impact operating system behavior and access to resources. Furthermore, programs configured with hard-coded distinguished name paths may fail to locate required objects, breaking application functionality.

To mitigate these risks, the Windows Server 2003 SP2 version of Adminpak.msi introduced two new controls for drag-and-drop behavior:
* Warning Dialog Box (Default): A warning dialog box now appears by default when attempting a drag-and-drop operation. This warning can be dismissed for the current session but will reappear upon the next launch of the snap-in.
* Disabling Drag-and-Drop via Active Directory: For a more permanent solution, drag-and-drop capabilities can be globally disabled by setting the first part of the DisplaySpecifiers attribute to 0 (zero) in the configuration naming context within Active Directory. Since this is a forest-wide setting, it will disable the feature for every domain in the forest.

To disable the drag-and-drop feature:
1. If open, close the Active Directory Users and Computers or Active Directory Sites and Services snap-ins.
2. Click Start, then Run, type adsiedit.msc in the Open box, and click OK.
3. Expand Configuration, then CN=Configuration,DC=ForestRootName.
4. Right-click CN=DisplaySpecifiers, and then click Properties.
5. In the list of attributes, double-click flags.
6. In the Integer Attribute Editor dialog box, type 1 in the Value box.
7. Click OK twice, then close ADSI Edit.
* Note: The Active Directory Service Interfaces (ADSI) Edit tool is included with the Windows Server 2003 SP2 Support Tools.

Microsoft Exchange¶

The Adminpak.msi was updated to include Microsoft Exchange Simple Mail Transfer Protocol (SMTP) and Network News Transfer Protocol (NNTP) DLL files (Staxmem.dll, Smtpapi.dll, Smtpadm.dll, Smtpsnap.hlp, and Nntpsnap.hlp). These additions enable 32-bit Windows XP Professional-based clients to administer versions of Exchange released after Microsoft Exchange 2000. However, it is important to note that administration of Exchange-based servers newer than Exchange 2000 from 64-bit clients is not supported.

Help¶

The Ntcmds.chm Help file was incorporated into the Adminpak to support command-line administration, offering quick reference for numerous utilities. When the Administration Tools Pack is removed, the Windows XP Professional versions of the Ntart.chm and Ntcmds.chm files are restored from backups made during the Adminpak installation, ensuring help functionality for the base operating system.

Internet Information Services Command-Line Utilities¶

A suite of Internet Information Services (IIS) command-line utilities (IisApp.vbs, Iisback.vbs, IisCnfg.vbs, IisFtp.vbs, IisFtpdr.vbs, Iisvdir.vbs, Iisweb.vbs) are included, but they are exclusively compatible with Microsoft Internet Information Services (IIS) 6.0. A specific issue with IISCnfg.vbs arises when using the /export command: the destination file specified after the /f switch is created on the remote computer, not the local client. For instance, exporting the metabase will place the Config.xml file on the remote server. Conversely, for /import, IISCnfg checks for the file’s existence on both local and remote computers, but only uses the file on the remote server for the actual import. When importing, ensure the same path is used on the local computer as on the remote server.

Internet Authentication Service¶

The Internet Authentication Service (IAS) snap-in, which facilitates centralized authentication, authorization, and accounting, has been removed from the Administration Tools Pack in this release. This means administrators will need to manage IAS directly on the server or use other remote management methods.

Netsh¶

The netsh dhcp server ip dump command exhibits truncated output when run from a Windows XP-based client against a Windows Server 2003-based DHCP server. Furthermore, the netsh dhcp server command generally does not run by default from Windows XP-based clients, producing errors indicating incomplete or invalid parameters. To enable this functionality, administrators must install the Administration Tools Pack and then run netsh add helper dhcpmon.dll at the command prompt on the Windows XP client.

Network Load Balancing Manager¶

There were no known issues with the release version of the Windows Server 2003 Adminpak regarding Network Load Balancing Manager. However, the Service Pack 2 Adminpak installs a 32-bit Network Load Balancing Manager that does not bind correctly on 64-bit versions of Windows, limiting its utility in 64-bit environments.

Ntdsutil.exe¶

The authoritative restore command within Ntdsutil.exe relies on Ntdsbsrv.dll, which is not included in Windows XP Professional or the Windows Server 2003 Administration Tools Pack. Consequently, authoritative restores must be performed from the console of Active Directory-based domain controllers. If it is absolutely necessary to run this command on Windows XP-based clients, the Ntdsbsrv.dll file must be copied from a release version of a Windows Server 2003 installation.

Object Picker¶

The original-release Windows Server 2003 Administration Tools Pack’s introduction of LDAP signing is also relevant for the Object Picker. This means that Windows 2000 domain controllers, if being remotely administered by Windows 2000 SP4, Windows XP, or Windows Server 2003 computers using NTLM authentication, are required to have Windows 2000 SP3 installed to ensure proper object selection and security.

Remote Access User Extensions¶

Remote Access User Extensions were initially removed from the original-release version of the Windows Server 2003 Administration Tools Pack. However, they were later re-introduced and are available if the version of the Adminpak.msi file included in Windows Server 2003 Service Pack 2 (SP2) is installed on your Windows XP Professional-based computer. If you have the RTM or SP1 version of the Adminpak.msi file installed, you must uninstall it and then install the Windows Server 2003 SP2 version to regain these extensions.

Remote Desktop¶

The “Connect to Console” mode feature of Remote Desktop is supported exclusively for Windows Server 2003-based and Windows XP-based computers. This means older operating systems or configurations might not allow direct console connections, requiring alternative access methods.

Remote Storage¶

Cross-version administration for Remote Storage is not supported. This implies that managing Remote Storage from Windows 2000-based computers is not compatible with Windows Server 2003-based and Windows XP-based computers. Similarly, Windows Server 2003 and Windows XP versions running the Windows Server 2003 Administration Tools Pack cannot administer Windows 2000-based computers. For these scenarios, remote administration should be performed from a machine running the same operating system as the target, or directly from the console of the destination computer, or through a Terminal Services session.

Remote Installation Services (RIS) UI Administration Extension¶

No known issues have been reported for the Remote Installation Services (RIS) UI Administration Extension within the context of the original-release Adminpak. This suggests stable functionality for managing RIS deployments.

Routing and Remote Access¶

The Routing and Remote Access snap-in has been removed from the Administration Tools Pack in this version. This necessitates direct management on the server or the use of Terminal Services for any routing and remote access configurations.

Telephony¶

Telephony administrators using a Windows XP Professional-based computer cannot administer remote lines on a Windows 2000 Server-based computer. Specifically, the “Edit users” option, crucial for managing telephony settings, is unavailable. This limitation requires administrators to use a Windows 2000 client or manage directly from the Windows 2000 Server console.

Terminal Services Licensing Manager¶

No known issues have been reported for the Terminal Services Licensing Manager within the original-release Adminpak, indicating its stable operation for managing client access licenses for Terminal Services.

UDDI¶

No known issues have been reported for UDDI (Universal Description, Discovery, and Integration) within the original-release Adminpak. This implies functional compatibility for managing UDDI services remotely.

Group Policy Management Console (GPMC) on 64-bit Systems¶

When attempting to modify Group Policy on an x64-based version of Windows Server 2003 from the Active Directory Users and Computers snap-in, the Active Directory Sites and Services snap-in, or the Group Policy Management Console snap-in, users may encounter the error message: “Windows cannot find ‘gpedit.msc’.” This occurs because the snap-ins calling Gpedit.msc are currently 32-bit tools, while Gpedit.msc itself is a 64-bit snap-in on x64-based versions of Windows Server 2003. This problem is expected to be addressed in future 64-bit Adminpak.msi packages.

To work around this problem, consider these methods:
1. Use a 32-bit System: Modify the GPOs from a computer running a 32-bit version of Windows Server 2003, a 32-bit version of Windows XP, or a version of Windows 2000.
2. Explicitly Launch 32-bit MMC: Use the following commands to launch the snap-ins with the 32-bit Microsoft Management Console (MMC), which can then properly interact with Gpedit.msc:
* To start the Active Directory Users and Computers snap-in: %windir%\syswow64\mmc.exe %windir%\system32\dsa.msc -32
* To start the Active Directory Sites and Service snap-in: %windir%\syswow64\mmc.exe %windir%\system32\dssite.msc -32

The out-of-band (OOB) version of Microsoft Group Policy Management Console (GPMC) is designed to run on 32-bit platforms and is not supported on 64-bit versions of Microsoft Windows for Windows Server 2003 or Windows XP Service Pack 2 (SP2). There are no plans to update this OOB version for 64-bit support. However, in 64-bit versions of Windows Vista and Windows Server 2008, the 64-bit version of GPMC is supported. Note that GPMC Reporting cannot be installed on all 64-bit versions of Microsoft Windows. This specific version of GPMC is not part of any current Administration Tools package. You may still encounter the “Windows cannot find GPEDIT.MSC” error even when attempting to open GPMC using the explicit 32-bit MMC path.

WINS¶

The changes to the Windows Internet Name Service (WINS) remote procedure call (RPC) API across Windows Server 2003, Windows XP Professional, Windows 2000, and Windows NT 4.0 prevent the remote administration of Windows NT 4.0-based WINS servers from Windows 2000 and Windows Server 2003 versions of the WINS Microsoft Management Console (MMC) snap-in. This is not a regression, as Windows 2000 shared the same limitation, emphasizing the need for version compatibility when managing WINS servers.

Conclusion¶

Efficient remote management of Windows servers is indispensable for modern IT operations. The Administration Tools Pack (Adminpak) and its successor, Remote Server Administration Tools (RSAT), have played a pivotal role in enabling administrators to oversee Windows 2000, Windows XP, and Windows Server 2003 environments remotely. While these tools offer significant convenience, understanding their version-specific compatibilities, installation nuances, and known issues is critical for a smooth administrative experience. By leveraging the appropriate tools and methods—whether graphical snap-ins, Terminal Services, or command-line utilities—and being aware of cross-version limitations, IT professionals can maintain robust and responsive server infrastructures.

As technology evolves, so do the tools and best practices for server management. Staying informed about updates and changes in remote administration capabilities is essential for all IT professionals.

Do you have any experiences or insights regarding remote administration using Adminpak or RSAT that you’d like to share? Feel free to leave your comments below!