book

Active Directory Cookbook

Name: Active Directory Cookbook
Author: Robbie Allen
ISBN: 9780596004644

by Robbie Allen

September 2003

Intermediate to advanced

624 pages

15h 49m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Active Directory Cookbook
Foreword
Preface
Who Should Read This Book?
What’s in This Book?
Conventions Used in This Book
We’d Like Your Feedback!
Acknowledgments
1. Getting Started
Approach to the BookAt Least Three Ways to Do It!Windows 2000 Versus Windows Server 2003
1.1. Where to Find the Tools
Running Tools with Alternate CredentialsTargeting Specific Domain Controllers
1.2. Getting Familiar with LDIF

1.3. Programming Notes
Serverless BindsRunning Scripts Using Alternate CredentialsDefining Variables and Error Checking
1.4. Replaceable Text
1.5. Where to Find More Information
Command-Line ToolsMicrosoft Knowledge BaseMicrosoft Developers NetworkWeb SitesNewsgroupsMailing ListsBooksMagazines
2. Forests, Domains, and Trusts
IntroductionThe Anatomy of a DomainThe Anatomy of a TrustThe Anatomy of a Forest
2.1. Creating a Forest
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
2.2. Removing a Forest
ProblemSolutionDiscussionSee Also
2.3. Creating a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
2.4. Removing a Domain
ProblemSolutionDiscussionSee Also
2.5. Removing an Orphaned Domain
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
2.6. Finding the Domains in a Forest
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
2.7. Finding the NetBIOS Name of a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
2.8. Renaming a Domain
ProblemSolutionDiscussionSee Also
2.9. Changing the Mode of a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
2.10. Using ADPrep to Prepare a Domain or Forest for Windows Server 2003
ProblemSolutionDiscussionSee Also
2.11. Determining if ADPrep Has Completed
ProblemSolutionDiscussionSee Also
2.12. Checking Whether a Windows 2000 Domain Controller Can Be Upgraded to Windows Server 2003
ProblemSolutionDiscussionSee Also
2.13. Raising the Functional Level of a Windows Server 2003 Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
2.14. Raising the Functional Level of a Windows Server 2003 Forest
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
2.15. Creating a Trust Between a Windows NT Domain and an AD Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
2.16. Creating a Transitive Trust Between Two AD Forests
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussion
2.17. Creating a Shortcut Trust Between Two AD Domains
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussion
2.18. Creating a Trust to a Kerberos Realm
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
2.19. Viewing the Trusts for a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
2.20. Verifying a Trust
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
2.21. Resetting a Trust
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceSee Also
2.22. Removing a Trust
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
2.23. Enabling SID Filtering for a Trust
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
2.24. Finding Duplicate SIDs in a Domain
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
3. Domain Controllers, Global Catalogs, and FSMOs
IntroductionThe Anatomy of a Domain Controller
3.1. Promoting a Domain Controller
ProblemSolutionDiscussionSee Also
3.2. Promoting a Domain Controller from Media
ProblemSolutionDiscussionSee Also
3.3. Demoting a Domain Controller
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
3.4. Automating the Promotion or Demotion of a Domain Controller
ProblemSolutionDiscussionSee Also
3.5. Troubleshooting Domain Controller Promotion or Demotion Problems
ProblemSolutionDiscussionSee Also
3.6. Removing an Unsuccessfully Demoted Domain Controller
ProblemSolutionDiscussionSee Also
3.7. Renaming a Domain Controller
ProblemSolutionWindows 2000 Active DirectoryWindows Server 2003 Active DirectoryDiscussionSee Also
3.8. Finding the Domain Controllers for a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
3.9. Finding the Closest Domain Controller
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
3.10. Finding a Domain Controller’s Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
3.11. Moving a Domain Controller to a Different Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
3.12. Finding the Services a Domain Controller Is Advertising
ProblemSolutionDiscussionSee Also
3.13. Configuring a Domain Controller to Use an External Time Source
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
3.14. Finding the Number of Logon Attempts Made Against a Domain Controller
ProblemSolutionDiscussionSee Also
3.15. Enabling the /3GB Switch to Increase the LSASS Cache
ProblemSolutionDiscussionSee Also
3.16. Cleaning Up Distributed Link Tracking Objects
ProblemSolutionDiscussionSee Also
3.17. Enabling and Disabling the Global Catalog
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
3.18. Determining if Global Catalog Promotion Is Complete
ProblemSolutionDiscussionSee Also
3.19. Finding the Global Catalog Servers in a Forest
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
3.20. Finding the Domain Controllers or Global Catalog Servers in a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
3.21. Finding Domain Controllers and Global Catalogs via DNS
ProblemSolutionDiscussionSee Also
3.22. Changing the Preference for a Domain Controller
ProblemSolutionDiscussion
3.23. Disabling the Global Catalog Requirement During a Windows 2000 Domain Login
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
3.24. Disabling the Global Catalog Requirement During a Windows 2003 Domain Login
ProblemSolution
3.25. Finding the FSMO Role Holders
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
3.26. Transferring a FSMO Role
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
3.27. Seizing a FSMO Role
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
3.28. Finding the PDC Emulator FSMO Role Owner via DNS
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
4. Searching and Manipulating Objects
IntroductionThe Anatomy of an Object
4.1. Viewing the RootDSE
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
4.2. Viewing the Attributes of an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.3. Using LDAP Controls
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
4.4. Using a Fast or Concurrent Bind
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
4.5. Searching for Objects in a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.6. Searching the Global Catalog
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.7. Searching for a Large Number of Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.8. Searching with an Attribute-Scoped Query
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.9. Searching with a Bitwise Filter
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.10. Creating an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.11. Modifying an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.12. Modifying a Bit-Flag Attribute
ProblemSolutionUsing VBScriptDiscussionSee Also
4.13. Dynamically Linking an Auxiliary Class
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.14. Creating a Dynamic Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.15. Refreshing a Dynamic Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.16. Modifying the Default TTL Settings for Dynamic Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
4.17. Moving an Object to a Different OU or Container
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.18. Moving an Object to a Different Domain
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.19. Renaming an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.20. Deleting an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
4.21. Deleting a Container That Has Child Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.22. Viewing the Created and Last Modified Timestamp of an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.23. Modifying the Default LDAP Query Policy
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
4.24. Exporting Objects to an LDIF File
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceSee Also
4.25. Importing Objects Using an LDIF File
ProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee Also
4.26. Exporting Objects to a CSV File
ProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee Also
4.27. Importing Objects Using a CSV File
ProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee Also
5. Organizational Units
IntroductionThe Anatomy of an Organizational Unit
5.1. Creating an OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
5.2. Enumerating the OUs in a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScript
5.3. Enumerating the Objects in an OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScript
5.4. Deleting the Objects in an OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
5.5. Deleting an OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
5.6. Moving the Objects in an OU to a Different OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
5.7. Moving an OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
5.8. Determining How Many Child Objects an OU Has
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
5.9. Delegating Control of an OU
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
5.10. Allowing OUs to Be Created Within Containers
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
5.11. Linking a GPO to an OU
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
6. Users
IntroductionThe Anatomy of a User
6.1. Creating a User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
6.2. Creating a Large Number of Users
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.3. Creating an inetOrgPerson User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.4. Modifying an Attribute for Several Users at Once
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
6.5. Moving a User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.6. Renaming a User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.7. Copying a User
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing VBScriptSee Also
6.8. Unlocking a User
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
6.9. Finding Locked Out Users
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
6.10. Troubleshooting Account Lockout Problems
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
6.11. Viewing the Account Lockout and Password Policies
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
6.12. Enabling and Disabling a User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.13. Finding Disabled Users
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.14. Viewing a User’s Group Membership
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.15. Changing a User’s Primary Group
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
6.16. Transferring a User’s Group Membership to Another User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.17. Setting a User’s Password
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.18. Setting a User’s Password via LDAP
ProblemSolutionDiscussionSee Also
6.19. Setting a User’s Password via Kerberos
ProblemSolutionDiscussionSee Also
6.20. Preventing a User from Changing His Password
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.21. Requiring a User to Change Her Password at Next Logon
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
6.22. Preventing a User’s Password from Expiring
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.23. Finding Users Whose Passwords Are About to Expire
ProblemSolutionUsing a command-line interfaceUsing PerlDiscussionSee Also
6.24. Setting a User’s Account Options (userAccountControl)
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.25. Setting a User’s Account to Expire in the Future
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.26. Finding Users Whose AccountsAre About to Expire
ProblemSolutionUsing PerlDiscussionSee Also
6.27. Determining a User’s Last Logon Time
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
6.28. Finding Users Who Have Not Logged On Recently
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PerlDiscussionSee Also
6.29. Setting a User’s Profile Attributes
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
6.30. Viewing a User’s Managed Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
6.31. Modifying the Default Display Name Used When Creating Users in ADUC
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
6.32. Creating a UPN Suffix for a Forest
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
7. Groups
IntroductionThe Anatomy of a Group
7.1. Creating a Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
7.2. Viewing the Direct Members of a Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
7.3. Viewing the Nested Members of a Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
7.4. Adding and Removing Members of a Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
7.5. Moving a Group
ProblemSolutionDiscussionSee Also
7.6. Changing the Scope or Type of a Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
7.7. Delegating Control for Managing Membership of a Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
7.8. Resolving a Primary Group ID
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
7.9. Enabling Universal Group Membership Caching
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
8. Computers
IntroductionThe Anatomy of a Computer
8.1. Creating a Computer
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
8.2. Creating a Computer for a Specific User or Group
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
8.3. Joining a Computer to a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
8.4. Moving a Computer
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
8.5. Renaming a Computer
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
8.6. Testing the Secure Channel for a Computer
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
8.7. Resetting a Computer
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
8.8. Finding Inactive or Unused Computers
ProblemSolutionUsing a command-line interfaceUsing PerlDiscussionUsing a command-line interfaceUsing PerlSee Also
8.9. Changing the Maximum Number of Computers a User Can Join to the Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
8.10. Finding Computers with a Particular OS
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
8.11. Binding to the Default Container for Computers
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
8.12. Changing the Default Container for Computers
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
9. Group Policy Objects (GPOs)
IntroductionManaging GPOs
9.1. Finding the GPOs in a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.2. Creating a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.3. Copying a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.4. Deleting a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.5. Viewing the Settings of a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.6. Modifying the Settings of a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interface or VBScriptDiscussionSee Also
9.7. Importing Settings into a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.8. Assigning Logon/Logoff and Startup/Shutdown Scripts in a GPO
ProblemSolutionUsing a graphical user interfaceDiscussion
9.9. Installing Applications with a GPO
ProblemSolutionUsing a graphical user interfaceDiscussion
9.10. Disabling the User or Computer Settings in a GPO
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.11. Listing the Links for GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.12. Creating a GPO Link to an OU
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.13. Blocking Inheritance of GPOs on an OU
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.14. Applying a Security Filter to a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.15. Creating a WMI Filter
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
9.16. Applying a WMI Filter to a GPO
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.17. Backing Up a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.18. Restoring a GPO
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing VBScriptSee Also
9.19. Simulating the RSoP
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
9.20. Viewing the RSoP
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
9.21. Refreshing GPO Settings on a Computer
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
9.22. Restoring a Default GPO
ProblemSolutionUsing a command-line interfaceDiscussion
10. Schema
IntroductionThe Anatomy of Schema Objects
10.1. Registering the Active Directory Schema MMC Snap-in
ProblemSolutionDiscussionSee Also
10.2. Enabling Schema Updates
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.3. Generating an OID to Use for a New Class or Attribute
ProblemSolutionDiscussion
10.4. Generating a GUID to Use for a New Class or Attribute
ProblemSolutionDiscussion
10.5. Extending the Schema
ProblemSolutionDiscussionSee Also
10.6. Documenting Schema Extensions
ProblemSolutionDiscussionSee Also
10.7. Adding a New Attribute
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.8. Viewing an Attribute
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.9. Adding a New Class
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.10. Viewing a Class
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.11. Indexing an Attribute
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.12. Modifying the Attributes That Are Copied When Duplicating a User
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.13. Modifying the Attributes Included with Ambiguous Name Resolution
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.14. Adding or Removing an Attribute in the Global Catalog
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.15. Finding the Nonreplicated and Constructed Attributes
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.16. Finding the Linked Attributes
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
10.17. Finding the Structural, Auxiliary, Abstract, and 88 Classes
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
10.18. Finding the Mandatory and Optional Attributes of a Class
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
10.19. Modifying the Default Security of a Class
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
10.20. Deactivating Classes and Attributes
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
10.21. Redefining Classes and Attributes
ProblemSolutionDiscussionSee Also
10.22. Reloading the Schema Cache
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11. Site Topology
IntroductionThe Anatomy of Site Topology Objects
11.1. Creating a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.2. Listing the Sites
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
11.3. Deleting a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
11.4. Creating a Subnet
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.5. Listing the Subnets
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.6. Finding Missing Subnets
ProblemSolution
11.7. Creating a Site Link
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.8. Finding the Site Links for a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
11.9. Modifying the Sites That Are Part of a Site Link
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.10. Modifying the Cost for a Site Link
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
11.11. Disabling Site Link Transitivity or Site Link Schedules
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.12. Creating a Site Link Bridge
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.13. Finding the Bridgehead Servers for a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.14. Setting a Preferred Bridgehead Server for a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.15. Listing the Servers
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
11.16. Moving a Domain Controller to a Different Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.17. Configuring a Domain Controller to Cover Multiple Sites
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.18. Viewing the Site Coverage for a Domain Controller
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.19. Disabling Automatic Site Coverage for a Domain Controller
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.20. Finding the Site for a Client
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.21. Forcing a Host to a Particular Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.22. Creating a Connection Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
11.23. Listing the Connection Objects for a Server
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.24. Load-Balancing Connection Objects
ProblemSolutionUsing a command-line interfaceDiscussion
11.25. Finding the ISTG for a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.26. Transferring the ISTG to Another Server
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
11.27. Triggering the KCC
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.28. Determining if the KCC Is Completing Successfully
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussion
11.29. Disabling the KCC for a Site
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
11.30. Changing the Interval at Which the KCC Runs
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12. Replication
Introduction
12.1. Determining if Two Domain Controllers Are in Sync
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12.2. Viewing the Replication Status of Several Domain Controllers
ProblemSolutionUsing a command-line interfaceDiscussion
12.3. Viewing Unreplicated Changes Between Two Domain Controllers
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12.4. Forcing Replication from One Domain Controller to Another
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12.5. Changing the Intra-Site Replication Interval
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12.6. Changing the Inter-Site Replication Interval
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
12.7. Disabling Inter-Site Compression of Replication Traffic
ProblemSolutionDiscussionSee Also
12.8. Checking for Potential Replication Problems
ProblemSolutionDiscussionSee Also
12.9. Enabling Enhanced Logging of Replication Events
ProblemSolutionSee Also
12.10. Enabling Strict or Loose Replication Consistency
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12.11. Finding Conflict Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
12.12. Viewing Object Metadata
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13. Domain Name System (DNS)
IntroductionThe Anatomy of a DNS Object
13.1. Creating a Forward Lookup Zone
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
13.2. Creating a Reverse Lookup Zone
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.3. Viewing a Server’s Zones
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
13.4. Converting a Zone to an AD-Integrated Zone
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.5. Moving AD-Integrated Zones into an Application Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.6. Delegating Control of a Zone
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.7. Creating and Deleting Resource Records
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptSee Also
13.8. Querying Resource Records
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
13.9. Modifying the DNS Server Configuration
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.10. Scavenging Old Resource Records
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
13.11. Clearing the DNS Cache
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
13.12. Verifying That a Domain Controller Can Register Its Resource Records
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
13.13. Registering a Domain Controller’s Resource Records
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
13.14. Preventing a Domain Controller from Dynamically Registering All Resource Records
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.15. Preventing a Domain Controller from Dynamically Registering Certain Resource Records
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
13.16. Deregistering a Domain Controller’s Resource Records
ProblemSolutionUsing a command-line interfaceDiscussion
13.17. Allowing Computers to Use a Different Domain Suffix from Their AD Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
14. Security and Authentication
Introduction
14.1. Enabling SSL/TLS
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
14.2. Encrypting LDAP Traffic with SSL, TLS, or Signing
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
14.3. Enabling Anonymous LDAP Access
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
14.4. Restricting Hosts from Performing LDAP Queries
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
14.5. Using the Delegation of Control Wizard
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
14.6. Customizing the Delegation of Control Wizard
ProblemSolutionDiscussionSee Also
14.7. Viewing the ACL for an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
14.8. Customizing the ACL Editor
ProblemSolutionDiscussionSee Also
14.9. Viewing the Effective Permissions on an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussion
14.10. Changing the ACL of an Object
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
14.11. Changing the Default ACL for an Object Class in the Schema
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
14.12. Comparing the ACL of an Object to the Default Defined in the Schema
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
14.13. Resetting an Object’s ACL to the Default Defined in the Schema
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussion
14.14. Preventing the LM Hash of a Password from Being Stored
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
14.15. Enabling List Object Access Mode
ProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionSee Also
14.16. Modifying the ACL on Administrator Accounts
ProblemSolutionDiscussionSee Also
14.17. Viewing and Purging Your Kerberos Tickets
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
14.18. Forcing Kerberos to Use TCP
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
14.19. Modifying Kerberos Settings
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
15. Logging, Monitoring, and Quotas
IntroductionThe Anatomy of a Quota Object ContainerThe Anatomy of a Quota Object
15.1. Enabling Extended dcpromo Logging
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
15.2. Enabling Diagnostics Logging
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
15.3. Enabling NetLogon Logging
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
15.4. Enabling GPO Client Logging
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
15.5. Enabling Kerberos Logging
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
15.6. Enabling DNS Server Debug Logging
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
15.7. Viewing DNS Server Performance Statistics
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionUsing a command-line interfaceUsing VBScriptSee Also
15.8. Enabling Inefficient and Expensive LDAP Query Logging
ProblemSolutionDiscussionSee Also
15.9. Using the STATS Control to View LDAP Query Statistics
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
15.10. Using Perfmon to Monitor AD
ProblemSolutionUsing a graphical user interfaceDiscussion
15.11. Using Perfmon Trace Logs to Monitor AD
ProblemSolutionDiscussionSee Also
15.12. Enabling Auditing of Directory Access
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
15.13. Creating a Quota
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
15.14. Finding the Quotas Assigned to a Security Principal
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
15.15. Changing How Tombstone Objects Count Against Quota Usage
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
15.16. Setting the Default Quota for All Security Principals in a Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
15.17. Finding the Quota Usage for a Security Principal
ProblemSolutionDiscussionSee Also
16. Backup, Recovery, DIT Maintenance, and Deleted Objects
IntroductionThe Anatomy of a Deleted Object
16.1. Backing Up Active Directory
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
16.2. Restarting a Domain Controller in Directory Services Restore Mode
ProblemSolutionDiscussionSee Also
16.3. Resetting the Directory Service Restore Mode Administrator Password
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
16.4. Performing a Nonauthoritative Restore
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
16.5. Performing an Authoritative Restore of an Object or Subtree
ProblemSolutionDiscussionSee Also
16.6. Performing a Complete Authoritative Restore
ProblemSolutionDiscussionSee Also
16.7. Checking the DIT File’s Integrity
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
16.8. Moving the DIT Files
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
16.9. Repairing or Recovering the DIT
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
16.10. Performing an Online Defrag Manually
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
16.11. Determining How Much Whitespace Is in the DIT
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
16.12. Performing an Offline Defrag to Reclaim Space
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
16.13. Changing the Garbage Collection Interval
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
16.14. Logging the Number of Expired Tombstone Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
16.15. Determining the Size of the Active Directory Database
ProblemSolutionUsing a command-line interfaceDiscussionSee Also
16.16. Searching for Deleted Objects
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
16.17. Restoring a Deleted Object
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
16.18. Modifying the Tombstone Lifetime for a Domain
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
17. Application Partitions
IntroductionThe Anatomy of an Application Partition
17.1. Creating and Deleting an Application Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
17.2. Finding the Application Partitions in a Forest
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
17.3. Adding or Removing a Replica Server for an Application Partition
ProblemSolutionUsing a command-line interfaceUsing VBScriptDiscussionSee Also
17.4. Finding the Replica Servers for an Application Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
17.5. Finding the Application Partitions Hosted by a Server
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
17.6. Verifying Application Partitions Are Instantiated on a Server Correctly
ProblemSolutionUsing a command-line interfaceDiscussion
17.7. Setting the Replication Notification Delay for an Application Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussion
17.8. Setting the Reference Domain for an Application Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
17.9. Delegating Control of Managing an Application Partition
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptDiscussionSee Also
18. Interoperability and Integration
Introduction
18.1. Accessing AD from a Non-Windows Platform
ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing a programming languageDiscussionSee Also
18.2. Programming with .NET
ProblemSolutionDiscussionSee Also
18.3. Programming with DSML
ProblemSolutionDiscussionSee Also
18.4. Programming with Perl
ProblemSolutionDiscussionSee Also
18.5. Programming with Java
ProblemSolutionDiscussionSee Also
18.6. Programming with Python
ProblemSolutionDiscussion
18.7. Integrating with MIT Kerberos
ProblemSolutionDiscussionSee Also
18.8. Integrating with Samba
ProblemSolutionDiscussionSee Also
18.9. Integrating with Apache
ProblemSolutionDiscussionSee Also
18.10. Replacing NIS
ProblemSolutionSee Also
18.11. Using BIND for DNS
ProblemSolutionDiscussionSee Also
18.12. Authorizing a Microsoft DHCP Server
ProblemSolutionUsing a graphical user interfaceDiscussionSee Also
18.13. Using VMWare for Testing AD
ProblemSolutionDiscussionSee Also
A. Tool List
ACL Diagnostics Command (acldiag.exe)
Active Directory Domains and Trusts Snap-in (domain.msc)
Active Directory Installation Wizard (dcpromo.exe)
Active Directory Load Balancer Command (adlb.exe)
Active Directory Schema Snap-in (schmmgmt.msc)
Active Directory Sites and Services (dssite.msc)
Active Directory Users and Computers Snap-in (dsa.msc)
AD Prep Utility (adprep.exe)
ADSI Edit (adsiedit.msc)
Audit Policy Command (auditpol.exe)
Backup Wizard (ntbackup.exe)
CSVDE Command (csvde.exe)
Default Domain Controller Security Policy Snap-in (dcpol.msc)
Default Domain Security Policy Snap-in (dompol.msc)
Default Group Policy Restore Command (dcgpofix.exe)
DNS Snap-in (dnsmgmt.msc)
DNSCmd Command (dnscmd.exe)
Domain Controller Diagnosis Command (dcdiag.exe)
DS ACL Command (dsacls.exe)
DS Add Command (dsadd.exe)
DS Get Command (dsget.exe)
DS Modify Command (dsmodify.exe)
DS Move Command (dsmove.exe)
DS Query Command (dsquery.exe)
DS Remove Command (dsrm.exe)
Enumprop Command (enumprop.exe)
Group Policy Management Console (gpmc.msc)
Group Policy Object Editor (gpedit.msc)
Group Policy Verification Tool (gpotool.exe)
Group Policy Results Command (gpresult.exe)
Group Policy Refresh Command (gpupdate.exe)
IP Configuration (ipconfig.exe)
Kerberos List (klist.exe)
Kerberos Tray (kerbtray.exe)
LDIFDE Command (ldifde.exe)
LDP (ldp.exe)
Move Tree Command (movetree.exe)
Netdom Command (netdom.exe)
Network Connectivity Tester (netdiag.exe)
NLTest Command (nltest.exe)
Nslookup Command (nslookup.exe)
NTDS Util Command (ntdsutil.exe)
OID Generator Command (oidgen.exe)
Redirect Default Computers Command (redircmp.exe)
Redirect Default Users Command (redirusr.exe)
Reg Command (reg.exe)
Registry Editor (regedit.exe)
Rename Domain Command (rendom.exe)
Replication Diagnostics Command (repadmin.exe)
Replication Monitor (replmon.exe)
Resultant Set of Policy Snap-in (rsop.msc)
SecEdit Command (secedit.exe)
Time Service (w32tm.exe)
Unlock (unlock.exe)
UUID Generator Command (uuidgen.exe)
WinNT32 Command (winnt32.exe)
Index
Colophon

Content preview from Active Directory Cookbook

16.2. Restarting a Domain Controller in Directory Services Restore Mode

Problem

You want to restart a domain controller in DS Restore Mode.

Solution

To enter DS Restore Mode, you must reboot the server at the console. Press F8 after the power-on self test (POST), which will bring up a menu, as shown in Figure 16-1. From the menu, select Directory Services Restore Mode.

Figure 16-1. Boot options

Discussion

The Active Directory database is live and locked by the system when a domain controller is booted into normal mode. If you want to perform integrity checks, manipulate the Active Directory database in some way or restore part of the database, you have to reboot into DS Restore Mode. In this mode, Active Directory does not start up and the database files ( ntds.dit ) are not locked.

It is not always practical to be logged into the console of the server when you need to reboot it into DS Restore Mode. You can work around this by modifying the boot.ini file for the server to automatically boot into DS Restore Mode after reboot. You can then use Terminal Services to log on to the machine remotely while it is in that mode. See MS KB 256588 for more information on how to enable this capability. Be careful if you try to access DS Restore Mode via Terminal Services. Unless you have configured everything properly, you may end up with the domain controller booted into DS Restore Mode and not be ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Active Directory Administration Cookbook

Publisher Resources

ISBN: 0596004648Catalog Page Errata

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills