book

Active Directory, 3rd Edition

by Joe Richards, Robbie Allen, Alistair G. Lowe-Norris

January 2006

Beginner

832 pages

27h 52m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Active Directory, 3rd Edition
SPECIAL OFFER: Upgrade this ebook with O’Reilly
A Note Regarding Supplemental Files
Preface
Intended Audience
Contents of the Book
Part I, Active Directory BasicsPart II, Designing an Active Directory InfrastructurePart III, Scripting Active Directory with ADSI, ADO, and WMI
Conventions Used in This Book
Using Code Examples
How to Contact Us
Safari Enabled
Acknowledgments
For the Third Edition (Joe)For the Second Edition (Robbie)For the First Edition (Alistair)

I. Active Directory Basics
1. A Brief Introduction
1.1. Evolution of the Microsoft NOS1.1.1. Brief History of Directories
1.2. Windows NT Versus Active Directory
1.3. Windows 2000 Versus Windows Server 2003
1.4. Windows Server 2003 Versus Windows Server 2003 R2
1.5. Summary
2. Active Directory Fundamentals
2.1. How Objects Are Stored and Identified2.1.1. Uniquely Identifying Objects2.1.1.1. ADsPaths2.1.1.2. Examples
2.2. Building Blocks
2.2.1. Domains and Domain Trees2.2.2. Forests2.2.3. Organizational Units2.2.4. Global Catalog2.2.5. Flexible Single Master of Operations (FSMO)2.2.6. Windows 2000 Domain Mode2.2.7. Windows Server 2003 Functional Levels2.2.8. Groups2.2.8.1. Groups in Windows NT2.2.8.2. Group availability in various functional levels2.2.8.3. Group nesting in different functional levels2.2.8.4. Group membership across domain boundaries2.2.8.5. Converting groups2.2.8.6. Wrap-up
2.3. Summary
3. Naming Contexts and Application Partitions
3.1. Domain Naming Context
3.2. Configuration Naming Context
3.3. Schema Naming Context
3.4. Application Partitions
3.4.1. Storing Dynamic Data
3.5. Summary
4. Active Directory Schema
4.1. Structure of the Schema4.1.1. X.500 and the OID Namespace
4.2. Attributes (attributeSchema Objects)
4.2.1. Dissecting an Example Active Directory Attribute
4.3. Attribute Properties
4.3.1. Attribute Syntax4.3.2. System Flags4.3.2.1. Constructed attributes4.3.2.2. Category 1 objects4.3.3. Search Flags4.3.3.1. Indexed attributes4.3.3.2. ANR4.3.3.3. Preserve attribute in tombstone4.3.3.4. Tuple index4.3.3.5. Confidential4.3.4. Property Sets and attributeSecurityGUID4.3.5. Linked Attributes
4.4. Classes (classSchema Objects)
4.4.1. Object Class Category and Inheritance4.4.2. Dissecting an Example Active Directory Class4.4.2.1. How inheritance affects mustContain, mayContain, possSuperiors, and auxiliaryClass4.4.2.2. Viewing the user class with the Active Directory Schema snap-in4.4.3. Dynamically Linked Auxiliary Classes
4.5. Summary
5. Site Topology and Replication
5.1. Site Topology5.1.1. Subnets5.1.2. Sites5.1.3. Site Links5.1.4. Connection Objects5.1.5. Knowledge Consistency Checker (KCC)5.1.6. Site and Replication Management Tools
5.2. Data Replication
5.2.1. A Background to Metadata (Data That Governs the Replication Process)5.2.1.1. Update Sequence Numbers (USN) and highestCommittedUSN5.2.1.2. Originating updates versus replicated updates5.2.1.3. DSA GUID and Invocation ID5.2.1.4. High-watermark vector (direct up-to-dateness vector)5.2.1.5. Up-to-dateness vector5.2.1.6. Recap5.2.2. How an Object's Metadata Is Modified During Replication5.2.2.1. Step 1: Initial creation of a user on Server A5.2.2.2. Step 2: Replication of the originating write to Server B5.2.2.3. Step 3: Password change for the user on Server B5.2.2.4. Step 4: Password change replication to Server A5.2.3. The Replication of a Naming Context Between Two Servers5.2.3.1. Step 1: Replication with a partner is initiated5.2.3.2. Step 2: The partner works out what updates to send5.2.3.3. Step 3: The partner sends the updates to the initiating server5.2.3.4. Step 4: The initiating server processes the updates5.2.3.5. Step 5: The initiating server checks whether it is up to date5.2.3.6. Recap5.2.4. How Replication Conflicts Are Reconciled5.2.4.1. Conflict due to identical property change5.2.4.2. Conflict due to a move or creation of an object under a now-deleted parent5.2.4.3. Conflict due to creation of objects with names that conflict5.2.4.4. Replicating the conflict resolution
5.3. Summary
6. Active Directory and DNS
6.1. DNS Fundamentals6.1.1. Zones6.1.2. Resource Records6.1.3. DDNS
6.2. DC Locator
6.3. Resource Records Used by Active Directory
6.3.1. Overriding SRV Record Registration
6.4. Delegation Options
6.4.1. Not Delegating the AD DNS Zones6.4.1.1. Political factors6.4.1.2. Initial setup and configuration6.4.1.3. Support and maintenance6.4.1.4. Integration issues6.4.2. Delegating the AD DNS Zones6.4.2.1. Political factors6.4.2.2. Initial setup and configuration6.4.2.3. Support and maintenance6.4.2.4. Integration issues6.4.3. DNS for Standalone AD
6.5. Active Directory Integrated DNS
6.5.1. Replication Impact
6.6. Using Application Partitions for DNS
6.7. Summary
7. Profiles and Group Policy Primer
7.1. A Profile Primer7.1.1. The Default User and All User Folders7.1.2. Logging On Locally to the Workstation7.1.3. Logging On to the Domain7.1.4. Cached Profile Deletion7.1.5. A Server-Based Default User Profile
7.2. Capabilities of GPOs
7.2.1. Group Policy Refresh Frequency7.2.2. Software Installation Settings (Computer and User)7.2.3. Windows Settings (Computer)7.2.4. Administrative Templates (Computer)7.2.4.1. Windows components7.2.4.2. Windows settings (user)7.2.4.3. Administrative templates (user)7.2.5. Windows Components
7.3. Additional Resources
7.4. Summary
II. Designing an Active Directory Infrastructure
8. Designing the Namespace
8.1. The Complexities of a Design
8.2. Where to Start
8.3. Overview of the Design Process
8.4. Domain Namespace Design
8.4.1. Objectives8.4.1.1. Represent the structure of your business8.4.1.2. Minimize the number of domains8.4.2. Step 1: Decide on the Number of Domains8.4.2.1. Isolated replication8.4.2.2. Unique domain policy8.4.2.3. In-place upgrade of current domain8.4.2.4. Final notes8.4.3. Step 2: Design and Name the Tree Structure8.4.3.1. Choose the forest root domain8.4.3.2. Design the namespace naming scheme8.4.3.3. Create additional trees8.4.3.4. Create additional forests8.4.3.5. Arrange subdomain hierarchy8.4.4. Step 3: Design the Workstation and Server-Naming Scheme
8.5. Design of the Internal Domain Structure
8.5.1. Step 4: Design the Hierarchy of Organizational Units8.5.1.1. Recreating the business model8.5.1.2. Delegating full administration8.5.1.3. Delegating other rights8.5.2. Step 5: Design the Users and Groups8.5.2.1. Naming and placing users8.5.2.2. Naming and placing groups8.5.2.3. Creating proper security group designs8.5.3. Step 6: Design the Global Catalog8.5.3.1. Including and excluding attributes8.5.4. Step 7: Design the Application Partition Structure
8.6. Other Design Considerations
8.7. Design Examples
8.7.1. TwoSiteCorp8.7.1.1. Step 1: Set the number of domains8.7.1.2. Step 2: Design and name the tree structure8.7.1.3. Step 3: Design the workstation and server-naming scheme8.7.1.4. Step 4: Design the hierarchy of Organizational Units8.7.1.5. Step 5: Design the users and groups8.7.1.6. Step 6: Design the Global Catalog8.7.1.7. Step 7: Design the application partition structure8.7.1.8. Recap8.7.2. RetailCorp8.7.2.1. Step 1: Identify the number of domains8.7.2.2. Step 2: Design and name the tree structure8.7.2.3. Step 3: Design the workstation and server-naming scheme8.7.2.4. Step 4: Design the hierarchy of Organizational Units8.7.2.5. Step 5: Design the users and groups8.7.2.6. Step 6: Design the Global Catalog8.7.2.7. Step 7: Design the application partition structure8.7.2.8. Recap8.7.3. PetroCorp8.7.3.1. Step 1: Set the number of domains8.7.3.2. Step 2: Design and name the tree structure8.7.3.3. Step 3: Design the workstation and server-naming scheme8.7.3.4. Step 4: Design the hierarchy of Organizational Units8.7.3.5. Step 5: Design the users and groups8.7.3.6. Step 6: Design the Global Catalog8.7.3.7. Step 7: Design the application partition structure8.7.3.8. Recap
8.8. Designing for the Real World
8.8.1. Identify the Number of Domains8.8.2. Design to Help Business Plans and Budget Proposals8.8.3. Recognizing Nirvana's Problems
8.9. Summary
9. Creating a Site Topology
9.1. Intrasite and Intersite Topologies9.1.1. The KCC9.1.2. Automatic Intrasite Topology Generation by the KCC9.1.2.1. Two servers9.1.2.2. Three servers9.1.2.3. Four servers9.1.2.4. Eight servers9.1.2.5. Now what?9.1.3. Site Links: The Basic Building Blocks of Intersite Topologies9.1.3.1. Cost9.1.3.2. Schedule9.1.3.3. Transport9.1.3.4. When the KCC becomes involved9.1.3.5. Having the KCC compound your mistakes9.1.4. Site Link Bridges: The Second Building Blocks of Intersite Topologies
9.2. Designing Sites and Links for Replication
9.2.1. Step 1: Gather Background Data for Your Network9.2.2. Step 2: Design the Sites9.2.3. Step 3: Design the Domain Controller Locations9.2.3.1. Where to put DCs9.2.3.2. How many DCs to have9.2.3.3. Reasons for putting a server in more than one site9.2.4. Step 4: Plan Intrasite Replication9.2.5. Step 5: Decide How You Will Use the KCC to Your Advantage9.2.6. Step 6: Create Site Links for Low-Cost, Well-Connected Links9.2.7. Step 7: Create Site Links for Medium-Cost Links9.2.8. Step 8: Create Site Links for High-Cost Links9.2.9. Step 9: Create Site Link Bridges9.2.10. Step 10: Design the Replication Schedule
9.3. Examples
9.3.1. TwoSiteCorp9.3.2. RetailCorp9.3.3. PetroCorp
9.4. Additional Resources
9.5. Summary
10. Designing Organization-Wide Group Policies
10.1. How GPOs Work10.1.1. How GPOs Are Stored in Active Directory10.1.2. How GPOs Are Used in Active Directory10.1.3. Prioritizing the Application of Multiple Policies10.1.4. Standard GPO Inheritance Rules in Organizational Units10.1.5. Blocking Inheritance and Overriding the Block in Organizational Unit GPOs10.1.5.1. Summary10.1.6. When Policies Apply10.1.7. Local Group Policy Objects10.1.8. How Existing Windows NT 4.0 System Policies Affect GPO Processing10.1.9. When to Use Windows NT System Policies10.1.10. Combating Slowdown Due to GPOs10.1.10.1. Limiting the number of GPOs that apply10.1.10.2. Block Inheritance and No Override10.1.10.3. Disabling parts of GPOs10.1.10.4. Limiting cross-domain linking10.1.10.5. Limiting GPO application across WAN links10.1.10.6. Use simple queries in WMI filters10.1.11. The Power of Access Control Lists on Group Policy Objects10.1.12. Loopback Merge Mode and Loopback Replace Mode10.1.13. WMI Filtering in Windows Server 200310.1.14. How GPOs Work Across RAS and Slow Links10.1.15. Summary of Policy Options
10.2. Managing Group Policies
10.2.1. Using the Group Policy Object Editor10.2.2. Using the Group Policy Management Console (GPMC)10.2.3. Scripting Group Policies
10.3. Using GPOs to Help Design the Organizational Unit Structure
10.3.1. Identifying Areas of Policy10.3.2. How GPOs Influenced a Real Organizational Unit Design10.3.2.1. The merits of collapsing the Organizational Unit structure10.3.2.2. A bridge too far10.3.2.3. Loopback mode10.3.3. Guidelines for Designing GPOs10.3.4. Designing Delegation and Change Control10.3.4.1. The importance of change-control procedures10.3.4.2. Designing the delegation of GPO administration10.3.4.3. Creating customized GPOEs for administrators
10.4. Debugging Group Policies
10.4.1. Using the RSoP10.4.2. Enabling Extra Logging
10.5. Summary
11. Active Directory Security: Permissions and Auditing
11.1. Permission Basics11.1.1. Permission ACE11.1.2. Property Sets, Validated Writes, and Extended Rights11.1.3. Inherited Versus Explicit Permissions11.1.4. Default Security Descriptors11.1.5. Permission Lockdown11.1.6. Confidentiality Bit
11.2. Using the GUI to Examine Permissions
11.2.1. Reverting to the Default Permissions11.2.2. Viewing the Effective Permissions for a User or Group11.2.3. Using the Delegation of Control Wizard
11.3. Using the GUI to Examine Auditing
11.4. Designing Permission Schemes
11.4.1. The Five Golden Rules of Permissions Design11.4.1.1. Rule 1: Apply permissions to groups whenever possible11.4.1.2. Rule 2: Design group permissions so that you have minimum duplication11.4.1.3. Rule 3: Manage Advanced permissions only when absolutely necessary11.4.1.4. Rule 4: Allow inheritance; do not protect sections of the domain tree from inheritance11.4.1.5. Rule 5: Keep a log of unusual changes11.4.2. How to Plan Permissions11.4.3. Bringing Order out of Chaos
11.5. Designing Auditing Schemes
11.6. Real-World Examples
11.6.1. Hiding Specific Personal Details for All Users in an Organizational Unit from a Group11.6.2. Allowing Only a Specific Group of Users to Access a New Published Resource11.6.3. Restricting Everyone but HR from Viewing Social Security Numbers with Confidential Access Capability
11.7. Summary
12. Designing and Implementing Schema Extensions
12.1. Nominating Responsible People in Your Organization
12.2. Thinking of Changing the Schema
12.2.1. Designing the Data12.2.2. To Change or Not to Change12.2.3. The Global Picture
12.3. Creating Schema Extensions
12.3.1. Running the Schema Manager MMC for the First Time12.3.2. The Schema Cache12.3.3. The Schema FSMO12.3.4. Using LDIF to Extend the Schema12.3.5. Checks the System Makes When You Modify the Schema12.3.6. Making Classes and Attributes Defunct
12.4. Summary
13. Backup, Recovery, and Maintenance
13.1. Backing Up Active Directory13.1.1. Using the NT Backup Utility
13.2. Restoring a Domain Controller
13.2.1. Restore from Replication13.2.1.1. Manually removing a domain controller from Active Directory13.2.2. Restore from Backup
13.3. Restoring Active Directory
13.3.1. Non-Authoritative Restore13.3.2. Partial Authoritative Restore13.3.3. Complete Authoritative Restore
13.4. FSMO Recovery
13.5. DIT Maintenance
13.5.1. Checking the Integrity of the DIT13.5.2. Reclaiming Space13.5.3. Changing the DS Restore Mode Admin Password
13.6. Summary
14. Upgrading to Windows Server 2003
14.1. New Features in Windows Server 2003
14.2. Differences with Windows 2000
14.3. Functional Levels Explained
14.3.1. How to Raise the Functional Level
14.4. Preparing for ADPrep
14.4.1. ForestPrep14.4.2. DomainPrep
14.5. Upgrade Process
14.5.1. Inventory Domain Controllers14.5.2. Inventory Clients14.5.3. Trial Run14.5.4. Prepare the Forest and Domains14.5.4.1. Exchange 200014.5.4.2. SFU 2.014.5.5. Upgrade Domain Controllers
14.6. Post-Upgrade Tasks
14.6.1. Monitor14.6.2. Raise Functional Levels14.6.3. Tweak Settings14.6.4. Start Implementing New Features
14.7. Summary
15. Upgrading to Windows Server 2003 R2
15.1. New Active Directory Features in Windows Server 2003 Service Pack 1
15.2. Differences with Windows Server 2003
15.3. New Active Directory Features in Windows Server 2003 R2
15.4. Preparing for ADPrep
15.4.1. ForestPrep
15.5. Service Pack 1 Upgrade Process
15.6. R2 Upgrade Process
15.6.1. Prepare the Forest15.6.2. Upgrade Domain Controllers
15.7. Summary
16. Migrating from Windows NT
16.1. The Principles of Upgrading Windows NT Domains16.1.1. Preparing for a Domain Upgrade16.1.2. Forests and the Forest Root Domain16.1.3. Windows NT Domain Upgrades16.1.3.1. Solution 1: Migration to a new forest root domain16.1.3.2. Solution 2: Migration with one domain as the domain-tree root16.1.3.3. Solution 3: Migration to separate domain trees in a forest16.1.4. A Solution-Independent Migration Process16.1.5. Consolidating Domains After the Move16.1.5.1. Windows 2003 Interim and Windows 2003 functional levels and groups16.1.5.2. Computers16.1.5.3. Users16.1.5.4. Member servers and removing domains
16.2. Summary
17. Integrating Microsoft Exchange
17.1. A Quick Word About Exchange/AD Interaction
17.2. Preparing Active Directory for Exchange
17.2.1. Forestprep17.2.2. Domainprep17.2.3. Running Forestprep and Domainprep17.2.4. Active Directory Site Design and Domain Controller Placement17.2.5. Other Considerations
17.3. Exchange 5.5 and the Active Directory Connector
17.3.1. Configuring the ADC17.3.2. Mailbox-Enabling Objects via the GUI17.3.3. Why Bidirectional Replication May Not Solve Your Problems
17.4. Summary
18. Active Directory Application Mode (ADAM)
18.1. ADAM Terms
18.2. Differences Between AD and ADAM V1.0
18.2.1. Standalone Application Service18.2.2. Configurable LDAP Ports18.2.3. No SRV Records18.2.4. No Global Catalog18.2.5. Top-Level Application Partition Object Classes18.2.6. Group and User Scope18.2.7. FSMOs18.2.8. Schema18.2.9. Service Account18.2.10. Configuration/Schema Partition Names18.2.11. Default Directory Security18.2.12. User Principal Names18.2.13. Authentication
18.3. ADAM R2 Updates
18.3.1. Users in the Configuration Partition18.3.2. Password Reset/Change Chaining to Windows18.3.3. Virtual List View (VLV) Searching18.3.4. Confidentiality Bit18.3.5. New and Updated Tools18.3.6. Installation18.3.7. Authentication18.3.8. R2 ADAM for R2 Server Only
18.4. ADAM R2 Installation
18.4.1. Installing Components18.4.2. Installing a New ADAM Instance18.4.3. Installing an ADAM Replica
18.5. Tools
18.5.1. ADAM ADSIEDIT18.5.2. ADAM Schema Management18.5.3. ADAM Install18.5.4. ADAMSync18.5.5. ADAM Uninstall18.5.6. AD Schema Analyzer18.5.7. CSVDE18.5.8. DSACLS18.5.9. DSDBUTIL18.5.10. DSDiag18.5.11. DSMgmt18.5.12. LDIFDE18.5.13. LDP18.5.14. RepAdmin
18.6. ADAM Schema
18.6.1. Virtual List View (VLV) Index Support18.6.2. Default Security Descriptors18.6.3. Bindable Objects and Bindable Proxy Objects
18.7. Using ADAM
18.7.1. Creating Application Partitions18.7.2. Creating Containers18.7.3. Creating Users18.7.4. Creating User Proxies18.7.4.1. Special considerations18.7.5. Renaming Users18.7.6. Creating Groups18.7.7. Adding Members to Groups18.7.8. Removing Members from Groups18.7.9. Deleting Objects18.7.10. Deleting Application Partitions
18.8. Summary
19. Interoperability, Integration, and Future Direction
19.1. Microsoft's Directory Strategy19.1.1. Active Directory Application Mode19.1.2. Microsoft Identity Integration Server19.1.3. Active Directory's Role
19.2. Interoperating with Other Directories
19.2.1. Getting Data from One Directory to Another19.2.2. Using Common Tools Across Directories19.2.3. Porting Scripts to Work Across Directories19.2.4. Making Searches Across Directories Seamless
19.3. Integrating Applications and Services
19.3.1. The Application Integration Challenge19.3.1.1. Challenges for application vendors19.3.1.2. Challenges for Active Directory administrators19.3.1.3. ADAM to the rescue19.3.2. Integrating Unix19.3.2.1. Kerberos and LDAP support19.3.2.2. Migrating from NIS19.3.2.3. Integrating with NFS19.3.2.4. Synchronizing passwords19.3.2.5. Third-party integration tools
19.4. Summary
III. Scripting Active Directory with ADSI, ADO, and WMI
20. Scripting with ADSI
20.1. What Are All These Buzzwords?20.1.1. ActiveX20.1.2. Windows Scripting Host (WSH)20.1.3. Active Server Pages (ASPs)20.1.4. Active Directory Service Interfaces (ADSI)20.1.5. ActiveX Data Objects (ADO)20.1.6. Windows Management Instrumentation (WMI)20.1.7. .NET and .NET Framework
20.2. Writing and Running Scripts
20.2.1. A Brief Primer on COM and WSH20.2.2. How to Write Scripts20.2.3. WSH 2.0 Versus 5.6
20.3. ADSI
20.3.1. Objects and Interfaces20.3.2. Namespaces, ProgIDs, and ADsPaths20.3.3. Retrieving Objects
20.4. Simple Manipulation of ADSI Objects
20.4.1. Creating the OU20.4.2. Creating the Users20.4.3. Tearing Down What Was Created
20.5. Further Information
20.6. Summary
21. IADs and the Property Cache
21.1. The IADs Properties21.1.1. Using IADs::Get and IADs::Put21.1.2. The Property Cache21.1.3. Be Careful21.1.4. More Complexities of Property Access: IADs::GetEx and IADs::PutEx21.1.4.1. Using IADs::GetEx21.1.4.2. Using IADs::PutEx
21.2. Manipulating the Property Cache
21.2.1. Property Cache Mechanics21.2.2. Adding Individual Values21.2.3. Adding Sets of Values21.2.4. Walking Through the Property Cache21.2.4.1. Approach 1: Using the IADsPropertyList::PropertyCount property method21.2.4.2. Approach 2: Using the IADsPropertyList::Next method21.2.4.3. Approach 3: Using the IADsPropertyList::Next and IADsPropertyList::Skip methods21.2.5. Writing the Modifications21.2.6. Walking the Property Cache: The Solution21.2.7. Walking the Property Cache Using the Formal Schema Class Definition
21.3. Checking for Errors in VBScript
21.4. Summary
22. Using ADO for Searching
22.1. The First Search22.1.1. Step 1: Define the Constants and Variables22.1.2. Step 2: Establish an ADO Database Connection22.1.3. Step 3: Open the ADO Connection22.1.4. Step 4: Execute the Query22.1.5. Step 5: Navigate Through the Resultset22.1.6. Step 6: Close the ADO Connection22.1.7. The Entire Script for a Simple Search
22.2. Other Ways of Connecting and Retrieving Results
22.2.1. Searching with SQL22.2.1.1. Using the Connection::Execute method22.2.1.2. Using the Recordset::Open method22.2.1.3. Executing a specific command22.2.1.4. The Command object and Recordset::Open
22.3. Understanding Search Filters
22.3.1. Items Within a Filter22.3.2. Connecting Filters
22.4. Optimizing Searches
22.4.1. Efficient Searching22.4.2. Objectclass Versus Objectcategory22.4.3. Filtering an Existing Resultset22.4.3.1. Using a criteria string22.4.3.2. Using bookmarks
22.5. Advanced Search Function: SearchAD
22.6. Summary
23. Users and Groups
23.1. Creating a Simple User Account
23.2. Creating a Full-Featured User Account
23.2.1. WinNT Provider23.2.2. LDAP Provider
23.3. Creating Many User Accounts
23.4. Modifying Many User Accounts
23.5. Account Unlocker Utility
23.6. Creating a Group
23.7. Adding Members to a Group
23.7.1. Adding Many USER Groups to DRUP Groups
23.8. Evaluating Group Membership
23.9. Summary
24. Basic Exchange Tasks
24.1. Notes on Managing Exchange
24.2. Exchange Management Tools
24.3. Mail-Enabling Versus Mailbox-Enabling
24.4. Exchange Delegation
24.5. Mail-Enabling a User
24.6. Mail-Disabling a User
24.7. Creating and Mail-Enabling a Contact
24.8. Mail-Disabling a Contact
24.9. Mail-Enabling a Group (Distribution List)
24.10. Mail-Disabling a Group
24.11. Mailbox-Enabling a User
24.12. Mailbox-Disabling a User (Mailbox Deletion)
24.13. Purging a Disconnected Mailbox
24.14. Reconnecting a Disconnected Mailbox
24.15. Moving a Mailbox
24.16. Enumerating Disconnected Mailboxes
24.17. Viewing Mailbox Sizes and Message Counts
24.18. Viewing All Store Details of All Mailboxes on a Server
24.19. Dumping All Store Details of All Mailboxes on All Servers in Exchange Org
24.20. Summary
25. Shares and Print Queues
25.1. The Interface Methods and Properties
25.2. Creating and Manipulating Shares with ADSI
25.3. Enumerating Sessions and Resources
25.3.1. Identifying a Machine's Sessions25.3.2. Identifying a Machine's Resources25.3.3. A Utility to Show User Sessions25.3.3.1. Obtaining the data25.3.3.2. Manipulating the data25.3.3.3. The sort subprocedure25.3.3.4. The duplicate-removal subprocedure25.3.3.5. Displaying the data25.3.3.6. Room for improvement
25.4. Manipulating Print Queues and Print Jobs
25.4.1. Identifying Print Queues in Active Directory25.4.2. Binding to a Print Queue25.4.3. IADsPrintQueueOperations and Print Queues25.4.4. Print Jobs
25.5. Summary
26. Permissions and Auditing
26.1. How to Create an ACE Using ADSI26.1.1. Trustee26.1.2. AccessMask26.1.3. AceType26.1.4. AceFlags26.1.5. Flags, ObjectType, and InheritedObjectType
26.2. A Simple ADSI Example
26.2.1. Discussion
26.3. A Complex ADSI Example
26.3.1. Discussion26.3.1.1. Unlock account26.3.1.2. Set/clear "User Must Change Password On Next Logon" flag26.3.1.3. Reset Password26.3.2. Making Your Own ACEs26.3.2.1. Delegate member attribute on groups26.3.2.2. Delegate ability to view Confidential Attribute26.3.2.3. How to implement other delegations
26.4. Creating Security Descriptors
26.5. Listing the Security Descriptor of an Object
26.6. Summary
27. Extending the Schema and the Active Directory Snap-ins
27.1. Modifying the Schema with ADSI27.1.1. IADsClass and IADsProperty27.1.2. Creating the Mycorp-LanguagesSpoken Attribute27.1.3. Creating the FinanceUser class27.1.3.1. Creating instances of the new class27.1.4. Finding the Schema Container and Schema FSMO27.1.5. Transferring the Schema FSMO Role27.1.6. Forcing a Reload of the Schema Cache27.1.7. Finding Which Attributes Are in the GC for an Object27.1.8. Adding an Attribute to the GC
27.2. Customizing the Active Directory Administrative Snap-ins
27.2.1. Display Specifiers27.2.2. Property Pages27.2.3. Context Menus27.2.4. Icons27.2.5. Display Names27.2.6. Leaf or Container27.2.7. Object Creation Wizard
27.3. Summary
28. Using ADSI and ADO from ASP or VB
28.1. VBScript Limitations and Solutions
28.2. How to Avoid Problems When Using ADSI and ASP
28.3. Combining VBScript and HTML
28.3.1. Incorporating Scripts into Active Server Pages28.3.1.1. Client-side scripting28.3.1.2. Server-side scripting28.3.2. ActiveX Controls and ASPs28.3.3. Forms
28.4. Binding to Objects via Authentication
28.4.1. When to Use VBScript's GetObject Function28.4.2. When to Use IADsOpenDSObject::OpenDSObject28.4.3. When to Use IADsContainer::GetObject28.4.4. Authenticating from Passwords Input via Forms28.4.5. A Simple Password Changer28.4.6. Adding Users to Groups
28.5. Incorporating Searches into ASP
28.5.1. ASP Searches Allowing User Navigation of a Resultset28.5.2. Enhancing the User Navigation ASP28.5.2.1. Empty resultsets28.5.2.2. Starting from scratch28.5.2.3. Filters28.5.2.4. Displaying the location of individual records28.5.2.5. The enhanced ASP search28.5.2.6. Problems with this example28.5.3. Other Ideas for Expansion
28.6. Migrating Your ADSI Scripts from VBScript to VB
28.6.1. Platform Software Development Kit28.6.2. The Differences Between VB and VBScript28.6.2.1. Screen functions28.6.2.2. Variables28.6.2.3. Loop constructs28.6.3. Getting Help from VB When Coding in ADSI28.6.4. A Simple Password Changer in VB28.6.5. The ModifyUserDetails Program in VB
28.7. Summary
29. Scripting with WMI
29.1. Origins of WMI
29.2. WMI Architecture
29.2.1. CIMOM and CIM Repository29.2.2. WMI Providers
29.3. Getting Started with WMI Scripting
29.3.1. Referencing an Object29.3.2. Enumerating Objects of a Particular Class29.3.3. Searching with WQL29.3.4. Authentication with WMI
29.4. WMI Tools
29.4.1. WMI from a Command Line29.4.2. WMI from the Web29.4.3. WMI SDK29.4.4. Scriptomatic Version 2.0; WMI Scripting Tool
29.5. Manipulating Services
29.6. Querying the Event Logs
29.7. Querying AD with WMI
29.8. Monitoring Trusts
29.9. Monitoring Replication
29.10. Summary
30. Manipulating DNS
30.1. DNS Provider Overview30.1.1. Installing the DNS Provider30.1.2. Managing DNS with the DNS Provider
30.2. Manipulating DNS Server Configuration
30.2.1. Listing a DNS Server's Properties30.2.2. Configuring a DNS server30.2.3. Restarting the DNS Service30.2.4. DNS Server Configuration Check Script
30.3. Creating and Manipulating Zones
30.3.1. Creating a Zone30.3.2. Configuring a Zone30.3.3. Listing the Zones on a Server
30.4. Creating and Manipulating Resource Records
30.4.1. Finding Resource Records in a Zone30.4.2. Creating Resource Records
30.5. Summary
31. Getting Started with VB.NET and System.Directory Services
31.1. The .NET Framework
31.2. Using VB.NET
31.3. Overview of System.DirectoryServices
31.4. DirectoryEntry Basics
31.5. Searching with DirectorySearcher
31.6. Manipulating Objects
31.7. Summary
Index
About the Authors
Colophon
SPECIAL OFFER: Upgrade this ebook with O’Reilly

Content preview from Active Directory, 3rd Edition

Configuration Naming Context

The Configuration NC is the primary repository for configuration information for a forest and is replicated to every domain controller in the forest. The root of the Configuration NC is found in the Configuration container, which is a sub-container of the forest root domain. For example, the mycorp.com forest would have a Configuration NC located at cn=configuration,dc=mycorp,dc=com.

Table 3-2 contains a list of the default top-level containers found in the Configuration NC.

Table 3-2. Default top-level containers of the Configuration NC

Relative distinguished name	Description
`cn=DisplaySpecifiers`	Container that holds display specifier objects, which define various properties and functions of the Active Directory MMC Snap-ins.
`cn=Extended-Rights`	Container for extended rights (`controlAccessRight`) objects.
`cn=ForestUpdates`	Contains objects that are used to represent the state of forest and domain functional level changes. This container is new in Windows Server 2003.
`cn=LostandFoundConfig`	Container for orphaned objects.
`cn=NTDS Quotas`	Container to store quota objects, which are used to restrict the number of objects that security principals can create in a partition or container. This container is new in Windows Server 2003.
`cn=Partitions`	Contains objects for each naming context, application partition, and external reference.
`cn=Physical Locations`	Contains location objects (`physicalLocation`), which can be associated with ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0596101732Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Active Directory, 3rd Edition

by Joe Richards, Robbie Allen, Alistair G. Lowe-Norris

Configuration Naming Context

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

More than 5,000 organizations count on O’Reilly

Julian F.

Addison B.

Amir M.

Mark W.

You might also like

Active Directory, Second Edition

Active Directory, 4th Edition

Mastering Active Directory - Second Edition

Active Directory Cookbook

Publisher Resources