book

Active Directory Cookbook, 4th Edition

by Brian Svidergol, Robbie Allen

May 2013

Intermediate to advanced

860 pages

21h 28m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Active Directory Cookbook
Preface
Who Should Read This Book?What’s in This Book?Conventions Used in This BookUsing Code ExamplesSafari® Books OnlineHow to Contact UsAcknowledgments
1. Getting Started
Approach to the BookAt Least Three Ways to Do It!Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012Where to Find the ToolsRunning Tools with Alternate CredentialsTargeting Specific Domain ControllersGetting Familiar with LDIFReplaceable TextWhere to Find More InformationCommand-Line ToolsMicrosoft Knowledge BaseMicrosoft Developer NetworkWebsitesMailing ListAdditional Resources
2. Forests, Domains, and Trusts
IntroductionThe Anatomy of a ForestThe Anatomy of a DomainThe Anatomy of a TrustCreating a ForestProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoRemoving a ForestProblemSolutionDiscussionSee AlsoCreating a DomainProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoRemoving a DomainProblemSolutionDiscussionSee AlsoRemoving an Orphaned DomainProblemSolutionUsing a command-line interfaceDiscussionSee AlsoFinding the Domains in a ForestProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing PowerShellSee AlsoFinding the NetBIOS Name of a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionRenaming a DomainProblemSolutionDiscussionSee AlsoRaising the Domain Functional Level to Windows Server 2012ProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoRaising the Functional Level of a Windows Server 2008 or 2008 R2 ForestProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoUsing AdPrep to Prepare a Domain or Forest for Windows Server 2012ProblemSolutionDiscussionSee AlsoDetermining Whether AdPrep Has CompletedProblemSolutionDiscussionSee AlsoChecking Whether a Windows Domain Controller Can Be Upgraded to Windows Server 2003 or 2008ProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoCreating an External TrustProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoCreating a Transitive Trust Between Two AD ForestsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionCreating a Shortcut Trust Between Two AD DomainsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionCreating a Trust to a Kerberos RealmProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoViewing the Trusts for a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoVerifying a TrustProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoResetting a TrustProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoRemoving a TrustProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionEnabling SID Filtering for a TrustProblemSolutionUsing a command-line interfaceUsing PowerShell to view SID filtering settingsDiscussionSee AlsoEnabling Quarantine for a TrustProblemSolutionUsing a command-line interfaceDiscussionManaging Selective Authentication for a TrustProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionFinding Duplicate SIDs in a DomainProblemSolutionUsing a command-line interfaceDiscussionSee AlsoAdding Additional Fields to Active Directory Users and ComputersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
3. Domain Controllers, Global Catalogs, and FSMOs
IntroductionThe Anatomy of a Domain ControllerPromoting a Server to a Domain ControllerProblemSolutionDiscussionSee AlsoPromoting a Server to a Read-Only Domain ControllerProblemSolutionDiscussionSee AlsoPerforming a Two-Stage RODC InstallationProblemSolutionDiscussionSee AlsoModifying the Password Replication PolicyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoPromoting a Server to a Windows Server 2012 Domain Controller from MediaProblemSolutionDiscussionSee AlsoDemoting a Domain ControllerProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoAutomating the Promotion or Demotion of a Domain ControllerProblemSolutionDiscussionSee AlsoTroubleshooting Domain Controller Promotion or Demotion ProblemsProblemSolutionDiscussionSee AlsoVerifying the Promotion of a Domain ControllerProblemSolutionUsing a command-line interfaceDiscussionSee AlsoRemoving an Unsuccessfully Demoted Domain ControllerProblemSolutionDiscussionSee AlsoRenaming a Domain ControllerProblemSolutionDiscussionFinding the Domain Controllers for a DomainProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoFinding the Closest Domain ControllerProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceUsing PowerShellFinding a Domain Controller’s SiteProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMoving a Domain Controller to a Different SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoFinding the Services a Domain Controller Is AdvertisingProblemSolutionDiscussionSee AlsoRestoring a Deleted Domain Controller in Windows Server 2012ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoResetting the TCP/IP Stack on a Domain ControllerProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoConfiguring a Domain Controller to Use an External Time SourceProblemSolutionUsing the RegistryUsing a command lineDiscussionSee AlsoFinding the Number of Logon Attempts Made Against a Domain ControllerProblemSolutionDiscussionSee AlsoEnabling the /3GB Switch to Increase the LSASS CacheProblemSolutionUsing a command-line interfaceDiscussionEnabling and Disabling the Global CatalogProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDetermining Whether Global Catalog Promotion Is CompleteProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Global Catalog Servers in a ForestProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Domain Controllers or Global Catalog Servers in a SiteProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionFinding Domain Controllers and Global Catalogs via DNSProblemSolutionDiscussionSee AlsoChanging the Preference for a Domain ControllerProblemSolutionDiscussionSee AlsoDisabling the Global Catalog Requirement for User LogonProblemSolutionFinding the FSMO Role HoldersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoTransferring a FSMO RoleProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceUsing PowerShellSee AlsoSeizing a FSMO RoleProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the PDC Emulator FSMO Role Owner via DNSProblemSolutionUsing a command-line interfaceDiscussionSee Also
4. Searching and Manipulating Objects
IntroductionThe Anatomy of an ObjectViewing the RootDSEProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Attributes of an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoCounting Objects in Active DirectoryProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellUsing LDAP ControlsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoUsing a Fast or Concurrent BindProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoConnecting to an Object GUIDProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoConnecting to a Well-Known GUIDProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSearching for Objects in a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoSearching the Global CatalogProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoSearching for a Large Number of ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoSearching with an Attribute-Scoped QueryProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSearching with a Bitwise FilterProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoCreating an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoModifying an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoModifying a Bit-Flag AttributeProblemSolutionUsing VBScriptUsing PowerShellDiscussionUsing PowerShellSee AlsoDynamically Linking an Auxiliary ClassProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating a Dynamic ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoRefreshing a Dynamic ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Default TTL Settings for Dynamic ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoMoving an Object to a Different OU or ContainerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoMoving an Object to a Different DomainProblemSolutionUsing a graphical user interface (ADMT 3.2)Using PowerShellDiscussionSee AlsoReferencing an External DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoRenaming an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoDeleting an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoDeleting a Container That Has Child ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Created and Last-Modified Timestamp of an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Default LDAP Query PolicyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoExporting Objects to an LDIF FileProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoImporting Objects Using an LDIF FileProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoExporting Objects to a CSV FileProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoImporting Objects Using PowerShell and a CSV FileProblemSolutionUsing PowerShellDiscussionSee Also
5. Organizational Units
IntroductionThe Anatomy of an Organizational UnitCreating an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoEnumerating the OUs in a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceFinding an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoEnumerating the Objects in an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellSee AlsoDeleting the Objects in an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDeleting an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMoving the Objects in an OU to a Different OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoMoving an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoRenaming an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoModifying an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDetermining Approximately How Many Child Objects an OU HasProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoDelegating Control of an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoAssigning or Removing a Manager for an OUProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoLinking a GPO to an OUProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoProtecting an OU Against Accidental DeletionProblemSolutionUsing a graphical user interfaceUsing a command-line interface (all versions)Using PowerShellDiscussion
6. Users
IntroductionThe Anatomy of a UserModifying the Default Display Name Used When Creating Users in ADUC or ADACProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellSee AlsoCreating a Large Number of UsersProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceUsing PowerShellSee AlsoCreating an inetOrgPerson UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoConverting a user Object to an inetOrgPerson Object (or Vice Versa)ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying an Attribute for Several Users at OnceProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDeleting a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoSetting a User’s Profile AttributesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMoving a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoRedirecting Users to an Alternative OUProblemSolutionUsing a graphical user interfaceUsing the command-line interfaceDiscussionSee AlsoRenaming a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCopying a UserProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing a graphical user interfaceSee AlsoFinding Locked-Out UsersProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoUnlocking a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoTroubleshooting Account Lockout ProblemsProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoViewing the Domain-Wide Account Lockout and Password PoliciesProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing PowerShellSee AlsoApplying a Fine-Grained Password Policy to a User ObjectProblemSolutionUsing a graphical user interface (steps specific to Windows Server 2012)Using a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Fine-Grained Password Policy That Is in Effect for a User AccountProblemSolutionUsing a graphical user interfaceUsing a command promptUsing PowerShellDiscussionSee AlsoEnabling and Disabling a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding Disabled UsersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing a User’s Group MembershipProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoRemoving All Group Memberships from a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoChanging a User’s Primary GroupProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoCopying a User’s Group Membership to Another UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSetting a User’s PasswordProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoPreventing a User from Changing a PasswordProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceSee AlsoRequiring a User to Change a Password at Next LogonProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionPreventing a User’s Password from ExpiringProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding Users Whose Passwords Are About to ExpireProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoViewing the RODCs That Have Cached a User’s PasswordProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSetting a User’s Account Options (userAccountControl)ProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSetting a User’s Account to ExpireProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDetermining a User’s Last Logon TimeProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoFinding Users Who Have Not Logged On RecentlyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoViewing and Modifying a User’s Permitted Logon HoursProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoViewing a User’s Managed ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionCreating a UPN Suffix for a ForestProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoRestoring a Deleted UserProblemSolutionUsing a graphical user interface (steps specific to Windows Server 2012)DiscussionSee AlsoProtecting a User Against Accidental DeletionProblemSolutionUsing a graphical user interfaceUsing a command-line interface (all versions)Using PowerShellDiscussion
7. Groups
IntroductionThe Anatomy of a GroupCreating a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceSee AlsoViewing the Permissions of a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Direct Members of a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Nested Members of a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoAdding and Removing Members of a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMoving a Group Within a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoMoving a Group to Another DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionChanging the Scope or Type of a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying Group AttributesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellSee AlsoDelegating Control for Managing Membership of a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoResolving a Primary Group IDProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoEnabling Universal Group Membership CachingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoRestoring a Deleted GroupProblemSolutionUsing a graphical user interface (steps specific to Windows Server 2012)Using PowerShellDiscussionSee AlsoProtecting a Group Against Accidental DeletionProblemSolutionUsing a graphical user interfaceUsing a command-line interface (all versions)Using PowerShell (all versions)DiscussionApplying a Fine-Grained Password Policy to a Group ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
8. Computer Objects
IntroductionThe Anatomy of a ComputerCreating a ComputerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating a Computer for a Specific User or GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoDeleting a ComputerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellJoining a Computer to a DomainProblemSolutionUsing a graphical user interface (steps specific to Windows 7, Windows 8, and Windows Server 2012)Using a command-line interfaceUsing a command-line interface with PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoMoving a Computer Within the Same DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMoving a Computer to a New DomainProblemSolutionUsing a graphical user interface (ADMT 3.2)Using a command-line interfaceDiscussionSee AlsoRenaming a ComputerProblemSolutionUsing a graphical user interface (steps specific to Windows 7, Windows 8, and Windows Server 2012)Using a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoAdding or Removing a Computer Account from a GroupProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoTesting the Secure Channel for a ComputerProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoResetting a Computer AccountProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding Inactive or Unused ComputersProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoChanging the Maximum Number of Computers a User Can Join to the DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Attributes of a computer ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoFinding Computers with a Particular OSProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoBinding to the Default Container for ComputersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging the Default Container for ComputersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoListing All the Computer Accounts in a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoIdentifying a Computer RoleProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceProtecting a Computer Against Accidental DeletionProblemSolutionUsing a graphical user interface (steps specific to Windows Server 2008 and later)Using a command-line interface (all versions)Using PowerShell (all versions)DiscussionViewing the RODCs That Have Cached a Computer’s PasswordProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also

9. Group Policy Objects
IntroductionManaging GPOsFinding the GPOs in a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoCreating a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCopying a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoDeleting a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoViewing the Settings of a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoModifying the Settings of a GPOProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoImporting Settings into a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoCreating a Migration TableProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoCreating Custom Group Policy SettingsProblemSolutionDiscussionSee AlsoAssigning Logon/Logoff and Startup/Shutdown Scripts in a GPOProblemSolutionUsing a graphical user interface (steps specific to Windows Server 2008 and later)DiscussionInstalling Applications with a GPOProblemSolutionUsing a graphical user interfaceDiscussionDisabling the User or Computer Settings in a GPOProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoListing the Links for a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoCreating a GPO Link to an OUProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoBlocking Inheritance of GPOs on an OUProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoEnforcing the Settings of a GPO LinkProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoApplying a Security Filter to a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoDelegating Administration of GPOsProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoImporting a Security TemplateProblemSolutionUsing a graphical user interfaceDiscussionCreating a WMI FilterProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoApplying a WMI Filter to a GPOProblemSolutionUsing a graphical user interfaceDiscussionConfiguring Loopback Processing for a GPOProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoBacking Up a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoRestoring a GPOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSimulating the RSoPProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoViewing the RSoPProblemSolutionUsing a command-line interfaceDiscussionSee AlsoRefreshing GPO Settings on a ComputerProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoRestoring a Default GPOProblemSolutionUsing a command-line interfaceDiscussionCreating a Fine-Grained Password PolicyProblemSolutionUsing a graphical user interface (steps specific to Windows 7, Windows 8, and Windows Server 2012)Using PowerShellDiscussionSee AlsoEditing a Fine-Grained Password PolicyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Effective PSO for a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
10. Schema
IntroductionThe Anatomy of Schema ObjectsRegistering the Active Directory Schema MMC Snap-inProblemSolutionDiscussionGenerating an OID to Use for a New Class or AttributeProblemSolutionDiscussionExtending the SchemaProblemSolutionDiscussionSee AlsoPreparing the Schema for an Active Directory UpgradeProblemSolutionFrom a graphical user interfaceDiscussionSee AlsoDocumenting Schema ExtensionsProblemSolutionDiscussionSee AlsoAdding a New AttributeProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing an AttributeProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoAdding a New ClassProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing a ClassProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoIndexing an AttributeProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Attributes That Are Copied When Duplicating a UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Attributes Included with ANRProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Set of Attributes Stored on a Global CatalogProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding Nonreplicated and Constructed AttributesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Linked AttributesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionFinding the Structural, Auxiliary, Abstract, and 88 ClassesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionFinding the Mandatory and Optional Attributes of a ClassProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionModifying the Default Security of a ClassProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoManaging the Confidentiality BitProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoAdding an Attribute to the Read-Only Filtered Attribute Set (RO-FAS)ProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDeactivating Classes and AttributesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoRedefining Classes and AttributesProblemSolutionDiscussionSee AlsoReloading the Schema CacheProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoManaging the Schema Master FSMOProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
11. Site Topology
IntroductionThe Anatomy of Site Topology ObjectsCreating a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoListing Sites in a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionRenaming a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDeleting a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDelegating Control of a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a graphical user interfaceConfiguring Universal Group Caching for a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating a SubnetProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoListing the SubnetsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoFinding Missing SubnetsProblemSolutionUsing PowerShellSee AlsoDeleting a SubnetProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging a Subnet’s Site AssignmentProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating a Site LinkProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoFinding the Site Links for a SiteProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionModifying the Sites That Are Part of a Site LinkProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying the Cost for a Site LinkProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionEnabling Change Notification for a Site LinkProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoModifying Replication SchedulesProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoDisabling Site Link Transitivity or Site Link SchedulesProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoCreating a Site Link BridgeProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Bridgehead Servers for a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSetting a Preferred Bridgehead Server for a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoListing the ServersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionMoving a Domain Controller to a Different SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoConfiguring a Domain Controller to Cover Multiple SitesProblemSolutionUsing a graphical user interfaceDiscussionViewing the Site Coverage for a Domain ControllerProblemSolutionUsing a command-line interfaceDiscussionSee AlsoDisabling Automatic Site Coverage for a Domain ControllerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Site for a ClientProblemSolutionUsing a command-line interfaceDiscussionSee AlsoForcing a Host into a Particular SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating a connection ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoListing the connection Objects for a ServerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the ISTG for a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoTransferring the ISTG to Another ServerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoTriggering the KCCProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDetermining Whether the KCC Is Completing SuccessfullyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionDisabling the KCC for a SiteProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellUsing PowerShellDiscussionSee AlsoChanging the Interval at Which the KCC RunsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
12. Replication
IntroductionDetermining Whether Two Domain Controllers Are in SyncProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing the Replication Status of Several Domain ControllersProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing Unreplicated Changes Between Two Domain ControllersProblemSolutionUsing a command-line interfaceDiscussionSee AlsoForcing Replication from One Domain Controller to AnotherProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoEnabling and Disabling ReplicationProblemSolutionUsing a command-line interfaceDiscussionSee AlsoChanging the Intra-Site Replication Notification IntervalProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging the Inter-Site Replication IntervalProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDisabling Inter-Site Compression of Replication TrafficProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChecking for Potential Replication ProblemsProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoEnabling Enhanced Logging of Replication EventsProblemSolutionDiscussionSee AlsoEnabling Strict or Loose Replication ConsistencyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding conflict ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding Orphaned ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoListing the Replication Partners for a DCProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing Object MetadataProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
13. DNS and DHCP
IntroductionThe Anatomy of a DNS ObjectCreating a Forward Lookup ZoneProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceUsing PowerShellSee AlsoCreating a Reverse Lookup ZoneProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing a Server’s ZonesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellSee AlsoConverting a Zone to an AD Integrated ZoneProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMoving AD Integrated Zones into an Application PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoConfiguring Zone TransfersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoConfiguring ForwardingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing PowerShellSee AlsoConfiguring Conditional ForwardingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionDelegating Control of an Active Directory Integrated ZoneProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating and Deleting Resource RecordsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceSee AlsoQuerying Resource RecordsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoModifying the DNS Server ConfigurationProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoScavenging Old Resource RecordsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionClearing the DNS CacheProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionVerifying That a Domain Controller Can Register Its Resource RecordsProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoEnabling DNS Server Debug LoggingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoRegistering a Domain Controller’s Resource RecordsProblemSolutionUsing a command-line interfaceDiscussionSee AlsoDeregistering a Domain Controller’s Resource RecordsProblemSolutionUsing a command-line interfaceDiscussionPreventing a Domain Controller from Dynamically Registering All Resource RecordsProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoPreventing a Domain Controller from Dynamically Registering Certain Resource RecordsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoAllowing Computers to Use a Domain Suffix That Is Different from Their AD DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoAuthorizing a DHCP ServerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellSee AlsoRestricting DHCP AdministratorsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
14. Security and Authentication
IntroductionEnabling SSL/TLSProblemSolutionUsing a graphical user interface (solution specific to Windows Server 2012)DiscussionSee AlsoSecuring LDAP Traffic with SSL, TLS, or SigningProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoDisabling LDAP SigningProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoEnabling Anonymous LDAP AccessProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoUsing the Delegation of Control WizardProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoCustomizing the Delegation of Control WizardProblemSolutionDiscussionSee AlsoRevoking Delegated PermissionsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoViewing the ACL for an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCustomizing the ACL EditorProblemSolutionDiscussionSee AlsoViewing the Effective Permissions on an ObjectProblemSolutionUsing a graphical user interface (solution specific to Windows Server 2012)Using a command-line interfaceDiscussionSee AlsoConfiguring Permission InheritanceProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging the ACL of an ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging the Default ACL for an Object Class in the SchemaProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoComparing the ACL of an Object to the Default Defined in the SchemaProblemSolutionUsing a command-line interfaceDiscussionSee AlsoResetting an Object’s ACL to the Default Defined in the SchemaProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionEnabling Strong Domain AuthenticationProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoEnabling List Object Access ModeProblemSolutionUsing a graphical user interfaceUsing VBScriptDiscussionUsing VBScriptSee AlsoModifying the ACL on Administrator AccountsProblemSolutionDiscussionSee AlsoViewing and Purging Your Kerberos TicketsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoForcing Kerberos to Use TCPProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing VBScriptUsing PowerShellDiscussionSee AlsoModifying Kerberos SettingsProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoViewing Access TokensProblemSolutionUsing a command-line interfaceDiscussionSee AlsoCreating a Claim TypeProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoCreating a Resource PropertyProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoConfiguring a Central Access RuleProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoCreating a Central Access PolicyProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoApplying a Central Access PolicyProblemSolutionDiscussionSee AlsoEnabling Domain Controller Support for Claims and Compound AuthenticationProblemSolutionDiscussionSee AlsoEnabling Claims for Devices in a DomainProblemSolutionDiscussionSee Also
15. Logging, Monitoring, and Quotas
IntroductionThe Anatomy of a Quota Object ContainerThe Anatomy of a Quota ObjectEnabling Diagnostics LoggingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoEnabling NetLogon LoggingProblemSolutionUsing a command-line interfaceDiscussionSee AlsoEnabling GPO Client LoggingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoEnabling Kerberos LoggingProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoViewing DNS Server Performance StatisticsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoMonitoring the Windows Time ServiceProblemSolutionUsing a command-line interfaceDiscussionSee AlsoEnabling Inefficient and Expensive LDAP Query LoggingProblemSolutionDiscussionSee AlsoUsing the STATS Control to View LDAP Query StatisticsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoMonitoring the Performance of Active DirectoryProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing Perfmon Trace Logs to Monitor Active DirectoryProblemSolutionUsing a graphical user interfaceDiscussionCreating an Administrative AlertProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoEmailing an Administrator on a Performance AlertProblemSolutionUsing PowerShellDiscussionSee AlsoEnabling Auditing of Directory AccessProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoEnabling Auditing of Registry KeysProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoCreating a QuotaProblemSolutionUsing a command-line interfaceDiscussionSee AlsoFinding the Quotas Assigned to a Security PrincipalProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging How Tombstone Objects Count Against Quota UsageProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSetting the Default Quota for All Security Principals in a PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionFinding the Quota Usage for a Security PrincipalProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee Also
16. Backup, Recovery, DIT Maintenance, and Deleted Objects
IntroductionThe Anatomy of a Deleted ObjectBacking Up the Active Directory DatabaseProblemSolutionUsing a command-line interfaceUsing Windows PowerShellDiscussionSee AlsoCreating an Active Directory SnapshotProblemSolutionUsing a command-line interfaceDiscussionSee AlsoMounting an Active Directory SnapshotProblemSolutionUsing a command-line interfaceDiscussionSee AlsoAccessing Active Directory Snapshot DataProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoRestarting a Domain Controller in Directory Services Repair ModeProblemSolutionUsing a graphical user interfaceUsing the command-line interfaceDiscussionSee AlsoResetting the Directory Services Repair Mode Administrator PasswordProblemSolutionUsing a command-line interfaceDiscussionSee AlsoPerforming a Nonauthoritative RestoreProblemSolutionUsing a command-line interfaceDiscussionSee AlsoPerforming an Authoritative Restore of an Object or SubtreeProblemSolutionUsing a graphical user interface (steps specific to Windows Server 2012)Using a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceUsing PowerShellSee AlsoPerforming a Complete Authoritative RestoreProblemSolutionDiscussionSee AlsoChecking the DIT File’s IntegrityProblemSolutionUsing a command-line interfaceDiscussionSee AlsoMoving the DIT FilesProblemSolutionUsing a command-line interfaceDiscussionSee AlsoRepairing or Recovering the DITProblemSolutionUsing a command-line interfaceDiscussionSee AlsoPerforming an Online Defrag ManuallyProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoPerforming a Database RecoveryProblemSolutionUsing a command-line interfaceDiscussionSee AlsoCreating a Reserve FileProblemSolutionUsing a command-line interfaceDiscussionSee AlsoDetermining How Much Whitespace Is in the DITProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing Windows PowerShellDiscussionSee AlsoPerforming an Offline Defrag to Reclaim SpaceProblemSolutionUsing a command-line interfaceDiscussionSee AlsoChanging the Garbage Collection IntervalProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing Windows PowerShellDiscussionSee AlsoLogging the Number of Expired Tombstone ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDetermining the Size of the Active Directory DatabaseProblemSolutionUsing a command-line interfaceDiscussionSee AlsoSearching for Deleted ObjectsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoUndeleting a Single ObjectProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoUndeleting a Container ObjectProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing Windows PowerShellDiscussionSee AlsoModifying the Tombstone Lifetime for a DomainProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee Also
17. Application Partitions
IntroductionThe Anatomy of an Application PartitionCreating and Deleting an Application PartitionProblemSolutionUsing a command-line interfaceDiscussionSee AlsoFinding the Application Partitions in a ForestProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoAdding or Removing a Replica Server for an Application PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Replica Servers for an Application PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoFinding the Application Partitions Hosted by a ServerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoVerifying Application Partitions Are Instantiated Correctly on a ServerProblemSolutionUsing a command-line interfaceDiscussionSee AlsoSetting the Replication Notification Delay for an Application PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoSetting the Reference Domain for an Application PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoDelegating Control of Managing an Application PartitionProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee Also
18. Active Directory Lightweight Directory Service
IntroductionInstalling AD LDSProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoCreating a New AD LDS InstanceProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoCreating a New Replica of an AD LDS Configuration SetProblemSolutionUsing a graphical user interfaceUsing a command-line interface on all versionsDiscussionSee AlsoStopping and Starting an AD LDS InstanceProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging the Ports Used by an AD LDS InstanceProblemSolutionDiscussionSee AlsoListing the AD LDS Instances Installed on a ComputerProblemSolutionUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoExtending the AD LDS SchemaProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoManaging AD LDS Application PartitionsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoManaging AD LDS Organizational UnitsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoManaging AD LDS UsersProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoChanging the Password for an AD LDS UserProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoEnabling and Disabling an AD LDS UserProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating AD LDS GroupsProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoManaging AD LDS Group MembershipsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoViewing and Modifying AD LDS Object AttributesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoImporting Data into an AD LDS InstanceProblemSolutionUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoConfiguring Intra-Site ReplicationProblemSolutionUsing a graphical user interfaceDiscussionSee AlsoForcing AD LDS ReplicationProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoManaging AD LDS Replication AuthenticationProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoManaging AD LDS PermissionsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionUsing a command-line interfaceSee AlsoEnabling Auditing of AD LDS AccessProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussion
19. Active Directory Federation Services
IntroductionInstalling AD FS PrerequisitesProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoInstalling the AD FS Federation ServiceProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoConfiguring an LDAP Attribute StoreProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoConfiguring a Microsoft SQL Server Attribute StoreProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionCreating Claim DescriptionsProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoCreating a Relying Party TrustProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoConfiguring a Claims Provider TrustProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoConfiguring an Alternate UPN SuffixProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionUsing a command-line interfaceSee AlsoConfiguring AD FS 2.x and AD FS 1.x InteroperabilityProblemSolutionUsing a graphical user interfaceUsing Windows PowerShellDiscussionSee AlsoConfiguring Logging for AD FSProblemSolutionUsing Windows PowerShellDiscussionSee Also
20. Microsoft Exchange Server 2013
IntroductionExchange Server and Active DirectoryExchange Server 2013 ArchitectureExchange Server ToolsExchange Management ShellExchange Administration CenterExchange Scripts FolderThird-Party ToolsFinding Exchange Server CmdletsProblemSolutionUsing PowerShellDiscussionSee AlsoPreparing Active Directory for ExchangeProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoInstalling the First Exchange Server 2013 Server in an OrganizationProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoCreating Unattended Installation Files for Exchange ServerProblemSolutionUsing a command-line interfaceDiscussionSee AlsoInstalling Exchange Management ToolsProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceDiscussionSee AlsoStopping and Starting Exchange ServerProblemSolutionUsing a graphical user interfaceUsing a command-line interfaceUsing PowerShellDiscussionSee AlsoMail-Enabling a UserProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionMail-Disabling a UserProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoMailbox-Enabling a UserProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoDeleting a User’s MailboxProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoMoving a MailboxProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing PowerShellSee AlsoViewing Mailbox Sizes and Message CountsProblemSolutionUsing PowerShellDiscussionUsing PowerShellSee AlsoConfiguring Mailbox LimitsProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoCreating an Address ListProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionUsing a graphical user interfaceUsing PowerShellSee AlsoCreating a Database Availability GroupProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoCreating a Mailbox DatabaseProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee AlsoEnabling or Disabling Anti-Malware ScanningProblemSolutionUsing PowerShellDiscussionSee AlsoEnabling Message TrackingProblemSolutionUsing a graphical user interfaceUsing PowerShellDiscussionSee Also
21. Microsoft Forefront Identity Manager
IntroductionRequirements for FIM 2010 R2SQL and FIM collocationFIM PrimerImporting dataThe connector spaceThe metaverseProjection and joinsThe many faces of the connectorState-based synchronizationManagement AgentsRun profilesThe Metaverse DesignerAttribute flow rulesThe scenarioSee AlsoCreating a SQL Server Management AgentProblemSolutionDiscussionSee AlsoCreating an Active Directory Management AgentProblemSolutionDiscussionSee AlsoSetting Up a Metaverse Object Deletion RuleProblemSolutionDiscussionSee AlsoSetting Up a Simple Import Attribute FlowProblemSolutionDiscussionSee AlsoSetting Up a Simple Export Attribute Flow to Active DirectoryProblemSolutionDiscussionSee AlsoDefining an Advanced Import Attribute FlowProblemSolutionDiscussionSee AlsoImplementing an Advanced Attribute Flow Rules ExtensionProblemSolutionDiscussionSee AlsoSetting Up Advanced Export Attribute Flow in Active DirectoryProblemSolutionDiscussionSee AlsoConfiguring a Run Profile to Do an Initial Load of Data from a SQL Server Management AgentProblemSolutionDiscussionSee AlsoLoading Initial SQL Server Database Data into FIM 2010 R2 Using a Run ProfileProblemSolutionDiscussionSee AlsoConfiguring a Run Profile to Load the Container Structure from Active DirectoryProblemSolutionDiscussionSee AlsoLoading the Initial Active Directory Container Structure into FIM 2010 R2 Using a Run ProfileProblemSolutionDiscussionSee AlsoSetting Up a SQL Server Management Agent to Project Objects to the MetaverseProblemSolutionDiscussionSee AlsoWriting a Rules Extension to Provision User ObjectsProblemSolutionDiscussionSee AlsoCreating a Run Profile for ProvisioningProblemSolutionDiscussionSee AlsoExecuting the Provisioning RuleProblemSolutionDiscussionSee AlsoCreating a Run Profile to Export Objects from the AD MA to Active DirectoryProblemSolutionDiscussionSee AlsoExporting Objects to Active Directory Using an Export Run ProfileProblemSolutionDiscussionSee AlsoCreating a Run Profile ScriptProblemSolutionDiscussionSee AlsoCreating a Controlling ScriptProblemSolutionDiscussionSee AlsoEnabling Directory Synchronization from Active Directory to the HR DatabaseProblemSolutionDiscussionSee AlsoConfiguring a Run Profile to Load the telephoneNumber from Active DirectoryProblemSolutionDiscussionSee AlsoLoading telephoneNumber Changes from AD into FIM Using a Delta Import/Delta Sync Run ProfileProblemSolutionDiscussionSee AlsoExporting telephoneNumber Data to a SQL Server DatabaseProblemSolutionDiscussionSee AlsoUsing a SQL Server MA Export Run Profile to Export the telephoneNumber to a SQL Server DatabaseProblemSolutionDiscussionSee AlsoSearching Data in the Connector SpaceProblemSolutionDiscussionSee AlsoSearching Data in the MetaverseProblemSolutionDiscussionSee AlsoDeleting Data in the Connector Space and MetaverseProblemSolutionDiscussionSee AlsoExtending Object Types to Include a New AttributeProblemSolutionDiscussionPreviewing Changes to the FIM ConfigurationProblemSolutionDiscussionSee AlsoCommitting Changes to Individual Identities Using the Commit Preview FeatureProblemSolutionDiscussionSee AlsoPassing Data Between Rules Extensions Using Transaction PropertiesProblemSolutionDiscussionSee AlsoUsing a Single Rules Extension to Affect Multiple Attribute FlowsProblemSolutionDiscussionFlowing a Null Value to a Data SourceProblemSolutionDiscussionSee AlsoImporting and Decoding the accountExpires AttributeProblemSolutionDiscussionSee AlsoExporting and Encoding the accountExpires AttributeProblemSolutionDiscussionSee Also
Index
About the Authors
Colophon
Copyright

Content preview from Active Directory Cookbook, 4th Edition

Chapter 14. Security and Authentication

Introduction

The default Windows 2000 installation of Active Directory was not as secure as it could have been out of the box. It allowed anonymous queries to be executed, which could take up valuable processing resources, and it did not place any requirements on encrypting or signing traffic between clients and domain controllers. As a result, usernames, passwords, and search results could be sent over the network in clear text. Fortunately, beginning with Windows Server 2003, things tightened up significantly. LDAP traffic is signed by default, and anonymous queries are disabled by default. Additionally, Transport Layer Security (TLS), the more flexible cousin of Secure Sockets Layer (SSL), is supported, allowing for end-to-end encryption of traffic between domain controllers and clients.

Active Directory’s ACL model provides ultimate flexibility for securing objects throughout a forest; you can restrict access down to the attribute level if you need to. With this flexibility comes increased complexity. An object’s ACL is initially generated from the default ACL for the object’s class, inherited permissions, and permissions directly applied on the object.

An ACL is a collection of ACEs, which defines the permission and properties that a security principal can use on the object to which the ACL is applied. Defining these entries and populating the ACL is the foundation of Active Directory security and delegation.

In this chapter, we will explore ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781449361419Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Active Directory Cookbook, 4th Edition

by Brian Svidergol, Robbie Allen

Chapter 14. Security and Authentication

Introduction

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.