book

Active Directory Domain Services 2008 How-To

Name: Active Directory Domain Services 2008 How-To
Author: John Policelli
ISBN: 9780768689129

by John Policelli

May 2009

Intermediate to advanced

528 pages

10h 15m

English

Sams

Read now

Unlock full access

Copyright
Dedication
About the Author
Acknowledgments
We Want to Hear from You!
Reader Services
Introduction
Overview of This BookHow-To Benefit from This BookHow-To Continue Expanding Your Knowledge
1. Introduction to Active Directory Domain Services
What’s New in Windows Server 2008 Active Directory Domain ServicesWindows Server 2008 System RequirementsInstalling Windows Server 2008
2. Prepare for Active Directory Domain Services Installation
Prepare an Existing Forest for Windows Server 2008 Active Directory Domain ServicesPrepare an Existing Domain for Windows Server 2008 Active Directory Domain ServicesPrepare an Existing Domain for a Read-Only Domain Controller
3. Install and Uninstall Active Directory Domain Services
Install a New Windows Server 2008 ForestInstall a New Forest by Using the Windows InterfaceInstall a New Forest by Using the Command LineInstall a New Forest by Using an Answer FileInstall a New Windows Server 2008 Child DomainInstall a Child Domain by Using the Windows InterfaceInstall a Child Domain by Using the Command LineInstall a Child Domain by Using an Answer FileInstall a New Windows Server 2008 Domain TreeInstall a Domain Tree by Using the Windows InterfaceInstall a Domain Tree by Using the Command LineInstall a Domain Tree by Using an Answer FileInstall an Additional Windows Server 2008 Domain ControllerInstall an Additional Domain Controller by Using the Windows InterfaceInstall an Additional Domain Controller by Using the Command LineInstall an Additional Domain Controller by Using an Answer FilePerform a Staged Installation of a Read-Only Domain ControllerStage 1: Create an RODC Account in AD DSStage 2: Attach Server to RODC AccountInstall AD DS from Restored Backup MediaCreate Installation MediaInstall AD DS from MediaRemove a Domain Controller from a DomainForcing the Removal of a Windows Server 2008 Domain ControllerPerforming Metadata CleanupRename a Domain Controller
4. Manage Trusts and Functional Levels
Create Forest TrustsCreate a Two-way Forest TrustCreate a One-way Incoming Forest TrustCreate a One-Way Outgoing Forest TrustCreate External TrustsCreate a Two-Way External TrustCreate a One-Way Incoming Forest TrustCreate a One-Way Outgoing Forest TrustCreate Realm TrustsCreate Shortcut TrustsChange the Routing Status of a Name SuffixEnable or Disable an Existing Name Suffix from RoutingExclude Name Suffixes from Routing to a Local ForestConfigure Authentication Scope for a TrustValidate TrustsRemove TrustsAdd a User Principal Name to a ForestRemove a User Principal Name from a ForestConfigure Domain Functional LevelsConfigure Forest Functional Levels
5. Manage Operations Master Roles and Global Catalog Servers
Enable the Global Catalog RoleEnable the Global Catalog Role by Using the Windows InterfaceEnable the Global Catalog Role by Using the Command LineDisable the Global Catalog RoleDisable the Global Catalog Role by Using the Windows InterfaceDisable the Global Catalog Role by Using the Command LineVerify Global Catalog Server ReadinessVerify Global Catalog Server Readiness by Using LDPVerify Global Catalog Server Readiness by Using NLTestVerify Global Catalog DNS RegistrationsDetermine Global Catalog ServersIdentify All Global Catalog Servers in the ForestIdentify All Global Catalog Servers in a DomainIdentify Operations Master Role HoldersIdentify Operations Master Role Holders by Using DsqueryIdentify Operations Master Role Holders by Using NetdomValidate Domain Controller AdvertisingTransfer the Schema Master RoleTransfer the Schema Master Role by Using the Windows InterfaceTransfer the Schema Master Role by Using the Command LineTransfer the Domain Naming Master RoleTransfer the Domain Naming Master Role by Using the Windows InterfaceTransfer the Domain Naming Master Role by Using the Command LineTransfer the RID Master RoleTransfer the RID Master Role by Using the Windows InterfaceTransfer the RID Master Role by Using the Command LineTransfer the PDC Emulator RoleTransfer the PDC Emulator Role by Using the Windows InterfaceTransfer the PDC Emulator Role by Using the Command LineTransfer the Infrastructure Master RoleTransfer the Infrastructure Master Role by Using the Windows InterfaceTransfer the Infrastructure Master Role by Using the Command LineSeize the Schema Master RoleSeize the Domain Naming Master RoleSeize the RID Master RoleSeize the PDC Emulator RoleSeize the Infrastructure Master Role

6. Manage Sites and Replication
Create SitesRemove SitesEnable Universal Group Membership CachingDisable Universal Group Membership CachingConfigure Site PropertiesCreate Site LinksRemove Site LinksConfigure Site Link PropertiesAssociate a Site with a Site LinkCreate Site Link BridgesRemove Site Link BridgesAdd a SubnetRemove a SubnetMove Domain Controllers Between SitesEnable a Domain Controller as a Preferred Bridgehead ServerDisable a Domain Controller as a Preferred Bridgehead ServerCreate Manual Connection ObjectsRemove Connection ObjectsDisable KCC for a SiteEnable KCC for a SiteDisable Inbound ReplicationEnable Inbound ReplicationDisable Outbound ReplicationEnable Outbound ReplicationDisable the Bridge All Site Links OptionEnable the Bridge All Site Links OptionVerify Replication Is FunctioningTrigger Replication
7. Manage the Active Directory Domain Services Schema
Install the Active Directory Schema Snap-InApply Active Directory Schema Administrative PermissionsView Schema Class and Attribute DefinitionsCreate AttributesDeactivate AttributesActivate AttributesIndex AttributesRemove Attributes from the IndexAdd Attributes to Ambiguous Name Resolution FilterRemove Attributes from Ambiguous Name Resolution FilterAdd Attributes to Global Catalog ReplicationRemove Attributes from Global Catalog ReplicationConfigure Attributes to Be Copied When Duplicating UsersConfigure Attributes Not to Be Copied When Duplicating UsersConfiguring Attributes to Be Indexed for Containerized SearchesConfiguring Attributes Not to Be Indexed for Containerized SearchesConfigure Attribute RangeCreate ClassesDeactivate ClassesActivate ClassesConfigure Classes to Be Visible in Advanced ViewConfigure Classes Not to Be Visible in Advanced ViewConfigure Class RelationshipsConfigure Class Attributes
8. Manage Active Directory Domain Services Data
Create User ObjectCreate User Object by Using the Windows InterfaceCreate User Object by Using the Command LineDelete User ObjectDelete User Object by Using the Windows InterfaceDelete User Object by Using the Command LineRename User ObjectRename User Object by Using the Windows InterfaceRename User Object by Using the Command LineCopy User ObjectMove User ObjectMove User Object by Using the Windows InterfaceMove User Object by Using the Command LineAdd User to GroupAdd User to Group by Using the Windows InterfaceAdd User to Group by Using the Command LineDisable a User ObjectDisable User Object by Using the Windows InterfaceDisable a User Object by Using the Command LineEnable a User ObjectEnable User Object by Using the Windows InterfaceEnable User Object by Using the Command LineReset a User Account PasswordReset a User Account Password by Using the Windows InterfaceReset a User Account Password by Using the Command LineModify a User Object’s General PropertiesModify a User Object’s Address PropertiesModify a User Object’s Account PropertiesModify a User’s Logon HoursModify the Computers a User Can Log On ToModify a User Object’s Profile PropertiesModify a User’s Object Telephone PropertiesModify a User’s Object Organization PropertiesModify a User’s ManagerView a User Object’s Direct ReportsModify a User’s Group MembershipModify a User Object’s Dial-in PropertiesModify a User Object’s Environment PropertiesModify a User Object’s Sessions PropertiesModify a User Object’s Remote Control PropertiesModify a User Object’s Terminal Services PropertiesModify a User Object’s COM+ PropertiesModify a User Object’s Published Certificates PropertiesView the Password Replication Policies Applied to a User ObjectModify a User Object’s Protection from Deletion PropertiesModify a User Object’s Custom AttributesCreate a Group ObjectCreate Group Object by Using the Windows InterfaceCreate Group Object by Using the Command LineDelete a Group ObjectDelete a Group Object by Using the Windows InterfaceDelete a Group Object by Using the Command LineRename a Group ObjectRename a Group Object by Using the Windows InterfaceRename a Group Object by Using the Command LineMove a Group ObjectMove a Group Object by Using the Windows InterfaceMove a Group Object by Using the Command LineAdd a Group to a GroupAdd a Group to a Group by Using the Windows InterfaceAdd a Group to a Group by Using the Command LineModify a Group Object’s General PropertiesModify a Group Object’s ScopeModify a Group Object’s TypeModify a Group Object’s MembersModify a Group Object Managed By PropertiesModify a Group Object Protection from DeletionModify a Group Object’s Custom AttributesCreate a Computer ObjectCreate a Computer Object by Using the Windows InterfaceCreate a Computer Object by Using the Command LineDelete a Computer ObjectDelete a Computer Object by Using the Windows InterfaceDelete a Computer Object by Using the Command LineMove a Computer ObjectMove a Computer Object by Using the Windows InterfaceMove a Computer Object by Using the Command LineAdd a Computer to a GroupAdd a Computer to a Group by Using the Windows InterfaceAdd a Computer to a Group by Using the Command LineDisable a Computer ObjectDisable a Computer Object by Using the Windows InterfaceDisable a Computer Object by Using the Command LineEnable a Computer ObjectEnable a Computer Object by Using the Windows InterfaceEnable a Computer Object by Using the Command LineModify a Computer Object’s General PropertiesView a Computer Object’s Operating System PropertiesModify a Computer Object’s Delegation PropertiesView the Password Replication Policies Applied to a Computer ObjectModify a Computer Object’s Location PropertiesModify a Computer Object’s Managed By PropertiesModify a Computer Object’s Protection from DeletionModify a Computer Object’s Custom AttributesCreate an Organizational UnitCreate an Organizational Unit by Using the Windows InterfaceCreate an Organizational Unit by Using the Command LineDelete an Organizational UnitDelete an Organizational Unit by Using the Windows InterfaceDelete an Organizational Unit by Using the Command LineRename an Organizational UnitRename an Organizational Unit by Using the Windows InterfaceRename an Organizational Unit by Using the Command LineMove an Organizational UnitMove an Organizational Unit by Using the Windows InterfaceMove an Organizational Unit Object by Using the Command LineModify an Organizational Unit’s General PropertiesModify an Organizational Unit’s Managed By PropertiesModify an Organizational Unit’s COM+ PropertiesModify an Organizational Unit’s Protection from DeletionModify an Organizational Unit’s Custom Attributes
9. Manage Group Policy
Create Group Policy ObjectsDelete Group Policy ObjectsCreate Starter GPOsDelete Starter GPOsCreate a New Group Policy Object from a Starter GPOEdit Group Policy Objects and Starter GPOsCopy Group Policy Objects and Starter GPOsComment Group Policy Objects and Starter GPOsView, Print, and Save a Report for Group Policy ObjectsBack Up Group Policy Objects and Starter GPOsRestore Group Policy Objects and Starter GPOsExport a Starter GPOImport a Starter GPOSearch Group Policy ObjectsCreate a Migration TableAutomatically Populate a Migration Table from a Group Policy ObjectLink a Group Policy ObjectRemove a Group Policy Object LinkDisable a Group Policy Object LinkEnable a Group Policy Object LinkEnforce a Group Policy Object LinkRemove the Enforcement of a Group Policy Object LinkBlock Inheritance of Group Policy ObjectsRemove Block Inheritance of Group Policy ObjectsChange the Order of Group Policy Object LinksFilter Group Policy Object Scope by Using Security GroupsDisable User Settings in a Group Policy ObjectDisable Computer Settings in a Group Policy ObjectCreate a WMI FilterImport a WMI FilterExport a WMI FilterCopy a WMI FilterLink a WMI Filter to a Group Policy ObjectDetermine a Resultant Set of PolicySimulate a Resultant Set of Policy Using Group Policy ModelingDelegate Permissions on a Group Policy ObjectModify Delegated Permissions on a Group Policy ObjectRemove Delegated Permissions on a Group Policy ObjectDelegate Permissions to Link Group Policy ObjectsModify Delegated Permissions to Link Group Policy ObjectsRemove Delegated Permissions to Link Group Policy ObjectsDelegate Permissions for Generating Group Policy Modeling DataModify Delegated Permissions for Generating Group Policy Modeling DataRemove Delegated Permissions for Generating Group Policy Modeling DataDelegate Permissions for Generating Group Policy ResultsModify Delegated Permissions for Generating Group Policy ResultsRemove Delegated Permissions for Generating Group Policy ResultsDelegate Permissions for WMI FiltersModify Delegated Permissions for WMI FiltersRemove Delegated Permissions for WMI Filters
10. Manage Password Replication Policies
Add a User, Group, or Computer to the Password Replication PolicyRemove a User, Group, or Computer from the Password Replication PolicyView Cached Credentials on a Read-Only Domain ControllerReview Accounts That Have Been Authenticated on a Read-only Domain ControllerAutomatically Move Accounts That Have Been Authenticated by an RODC to the Allowed ListPre-populate the Password Cache for Read-only Domain ControllerReset the Credentials That Are Cached on a Read-only Domain Controller
11. Manage Fine-Grained Password and Account Lockout Policies
Create Password Settings ObjectsDelete Password Settings ObjectsView Settings Defined in Password Settings ObjectsModify Settings Defined in Password Settings ObjectsApply a Password Settings Object to Users and Security GroupsModify the Precedence for Password Settings ObjectsView the Resultant Password Settings Objects for a User or GroupCreate Shadow Groups
12. Manage Active Directory Domain Services Backup and Recovery
Install the Windows Server Backup Server FeaturePerform an Unscheduled Backup of Critical Volumes of a Domain ControllerPerform an Unscheduled Backup of Critical Volumes of a Domain Controller by Using the Windows InterfacePerform an Unscheduled Backup of Critical Volumes of a Domain Controller by Using the Command LinePerform an Unscheduled System State Backup of a Domain ControllerPerform an Unscheduled Full Server Backup of a Domain ControllerPerform an Unscheduled Full Server Backup of a Domain Controller by Using the Windows InterfacePerform an Unscheduled Full Server Backup of a Domain Controller by Using the Command LineSchedule Regular Full Server Backups of a Domain ControllerSchedule Regular Full Server Backups of a Domain Controller by Using the Windows InterfaceSchedule Regular Full Server Backups of a Domain Controller by Using the Command LinePerform a Nonauthoritative Restore of Active Directory Domain ServicesPerform an Authoritative Restore of Deleted Active Directory Domain Services ObjectsPerform a Full Server Recovery of a Domain ControllerPerform a Full Server Recovery of a Domain Controller by Using the Windows InterfacePerform a Full Server Recovery of a Domain Controller by Using the Command LineCreate a Onetime Active Directory Domain Services SnapshotCreate Scheduled Active Directory Domain Services SnapshotsExpose an Active Directory Domain Services Snapshot as an LDAP ServerAccess Data Stored in Active Directory Domain Services SnapshotsAccess Data Stored in Active Directory Domain Services Snapshots by Using LDP.exeAccess Data Stored in Active Directory Domain Services Snapshots by Active Directory Users and Computers
13. Manage Active Directory Domain Services Auditing
Enable the Global Audit PolicyEnable the Global Audit Policy by Using the Windows InterfaceEnable the Global Audit Policy by Using the Command LineDisable the Global Audit PolicyDisable the Global Audit Policy by Using the Windows InterfaceDisable the Global Audit Policy by Using the Command LineRetrieve the State of Directory Service Access Auditing SubcategoriesEnable the Directory Service Access Auditing SubcategoryDisable the Directory Service Access Auditing SubcategoryEnable the Directory Service Changes Auditing SubcategoryDisable the Directory Service Changes Auditing SubcategoryEnable the Directory Service Replication Auditing SubcategoryDisable the Directory Service Replication Auditing SubcategoryEnable the Detailed Directory Service Replication Auditing SubcategoryDisable the Detailed Directory Service Replication Auditing SubcategoryConfigure Auditing on Object Security Access Control ListsExclude an Attribute from Directory Service Auditing

Content preview from Active Directory Domain Services 2008 How-To

About the Author

John Policelli (Microsoft MVP for Directory Services, MCTS, MCSA, ITSM, iNet+, Network+, and A+) is a solutions-focused IT consultant with more than a decade of combined success in architecture, security, strategic planning, and disaster recovery planning. John has designed and implemented dozens of complex directory service, e-messaging, web, networking, and security enterprise solutions.

John has spent the past nine years focused on identity and access management and providing thought leadership for some of the largest installations of Active Directory in Canada. He has been involved as an author, a technical reviewer, and a subject matter expert for more than 50 training, exam writing, press, and whitepaper projects related ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Windows Server 2008 Active Directory Domain Services

Publisher Resources

ISBN: 9780768689129Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Active Directory Domain Services 2008 How-To

by John Policelli

About the Author

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.