My Notes to Myself and Others... : Active Directory

Active Directory Topology Diagrammer

Erik Rozman — Wed, 03 Oct 2007 06:16:22 GMT

As you know,documentation is imperative, and slapping a huge and complicated Visio
on the wall of your office (to impress your boss) has it's advantages to... :)

Take a look at:
Microsoft Active Directory Topology Diagrammer

Overview

With the Active Directory Topology Diagrammer tool, you can read your Active Directory structure through Microsoft ActiveX® Data Objects (ADO). The Active Directory Topology Diagrammer tool automates Microsoft Office Visio to draw a diagram of the Active Directory Domain topology, your Active Directory Site topology, your OU structure or your current Exchange 200X Server Organization. With the Active Directory Topology Diagrammer tool, you can also draw partial Information from your Active Directory, like only one Domain or one site. The objects are linked together, and arranged in a reasonable layout that you can later interactively work with the objects in Microsoft Office Visio.

System Requirements

Supported Operating Systems: Longhorn (Windows Code Name) ; Windows 2000; Windows Server 2003; Windows Vista; Windows XP; Windows XP 64-bit

Microsoft .NET Framework Version 2.0
Microsoft Office Visio 2003 or 2007

Technorati Tags: Microsoft, Active Directory, Windows

Exchange 2007 and Windows 2008

Erik Rozman — Fri, 17 Aug 2007 10:23:50 GMT

A post about the interoperability of these two systems has been published on the Exchange team
blog.
The highlights are:

Exchange 2007 (RTM) can not be installed on Windows 2008.
Exchange 2007 SP1 (when released) will be supported on Windows 2008.
Exchange 2007 and Exchange 2003 (SP2) are supported with Windows 2008 domains.
Management tools for Exchange 2007 (RTM) and 2003 are not supported on Vista or/and Windows 2008.
Management tools for Exchange 2007 SP1 (when released) will be supported on Vista or/and Windows 2008.

For the additional (somewhat confusing) details,take a look at the post:

http://msexchangeteam.com/archive/2007/08/16/446709.aspx

Windows 2008 Technical Library

Erik Rozman — Fri, 10 Aug 2007 08:27:03 GMT

With the advent of Windows 2008 (Beta),and basically everyone getting their hands on a copy and
trying to learn how to use it, the Windows 2008 Technical Library can be a great resource.
The library describes what's new and provides step by step guides to explore the features:

http://technet2.microsoft.com/windowsserver2008/en/library/bab0f1a1-54aa-4cef-9164-139e8bcc44751033.mspx?mfr=true

Windows Server 2008 Component Posters

Erik Rozman — Tue, 24 Jul 2007 20:21:00 GMT

These two posters, originally published in the July 2007 issue of TechNet Magazine, provide a
strong visual tool to aide in the understanding of various features and components of Windows
Server 2008. One poster focuses exclusively on powerful new Active Directory technologies,
while the other provides a technical look at a variety of new features available in Windows Server
2008 (such as Server Core, Network Access Protection, and more).

http://www.microsoft.com/downloads/details.aspx?FamilyID=c2b9e44e-0bbd-47cb-bc09-b3d48be7f867&displaylang=en

Active Directory Explorer

Erik Rozman — Thu, 12 Jul 2007 17:29:00 GMT

This tool (from Mark Russinovich and Bryce Cogswell) is basically ADSI Edit on steroids.
It allows you to connect to your AD environment directly thus providing you a "raw" view
of your directory and in turn the ability to change the directory directly(which might cause a lot
of pain since you are working without the net provided by the traditional AD tools).

A feature of this tool that seems extremely useful to me is it's ability to take a snapshot
of a directory (and then another snapshot) and eventually to compare the two snapshots
providing you with a list of what has changed.

The tools ability to filter the results and to provide a very focused view of what has changed
makes this tool very useful even in dynamic environments.

Download the tool from:
http://www.microsoft.com/technet/sysinternals/utilities/adexplorer.mspx

TombstoneLifetime 2003 SP1

Erik Rozman — Sat, 04 Mar 2006 18:53:00 GMT

A major yet not so known change. From 60 days we are going to 180 days
on new Active Directory(SP1) implementations and upgrades that have slipstreamed copy.

In other words your backups should be valid for 180 days and deleted objects
are saved for 180 days...

http://support.microsoft.com/kb/q216993/

ADModify- Making bulk changes in style

Erik Rozman — Sat, 04 Mar 2006 17:15:00 GMT

ADModify is a tool that will enable an AD/Exchange admin to make bulk
changes in user properties.

One of the special treats of this tool is the fact that it provides a simple GUI for
configuring the accepted MAPI level for clients.

You can download the tool at:
http://www.gotdotnet.com/workspaces/workspace.aspx?id=f5cbbfa9-e46b-4a7a-8ed8-3e44523f32e2

Blackberry and Goodlink may be affected by Exchange store patch

Erik Rozman — Sat, 18 Feb 2006 14:44:00 GMT

I happened to stumble upon this one by chance-and I do admit I am really happy since
I am very familiar with the situation. It seems that a patch intended for the information store
changes the behavior of permissions thus causing lose of functionality of the aforementioned services.

For additional information on this topic please visit:

http://support.microsoft.com/kb/912918/en-us

http://support.microsoft.com/kb/895949/

And the post on the Exchange team blog:

http://blogs.technet.com/exchange/archive/2006/01/13/417440.aspx

GPO-Curse or Blessing?

Erik Rozman — Mon, 30 Jan 2006 17:48:00 GMT

Ok,
I know what you are thinking-is he serious?!?!

Actually I am serious and as someone that has taught AD classes I have to say
that GPO is the heart of AD. It is the most flexible tool to be used to harness the
power of AD. On the other hand I have seen it become a curse when it is overused
or used incorrectly.

In this post I would like to outline the overuse of GPOs. When a large number of
GPOs is created management becomes complicated and in some cases it may become
very complicated.

GPO settings accumulate when several GPOs apply to an object if none of the settings
collide. If the settings do colide the rule of thumb is that the "closest" GPO to the object has
precedence:
Local settings
Site
Domain
OU--------------"closest"

If additional factors are involved such as 'Block inheritance' or 'No override/Enforce' are also
involved it can be quite complicated to decipher which settings apply to a specific object.

That's the reason why it is recommended to use a minimal number of GPOs.

An additional tool that might help you get out of a bind if you have a large number of GPOs
is the Group Policy Management Console. This tool(add-on) provides a dedicated interface
for managing and more importantly understanding GPOs.

Using this tool you can understand which settings are configured and which GPO(for each)
owns each setting. This can be achieved by using the "Group Policy Results" branch.
The wizard hiding behind the branch enables you to enter the computer and user name you
wish to analyze and provides the exact settings that apply to them on the "Settings" tab found in
the left pane.

You can download GPMC at:
http://www.microsoft.com/downloads/details.aspx?FamilyID=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887&DisplayLang=en

Ok,so I have been dragged to a technical topic when actually all I wanted to say was-Please
do not create too many GPOs... :)

Setting the language of the OWA interface

Erik Rozman — Sat, 28 Jan 2006 18:19:00 GMT

When you work at a multinational/multilingual company the OWA interface's language might become
important. Currently (Exchange 2003) provides the language of the interface based on the settings
configured on the IE used to access OWA.

The problem is that at times your users might be logging on to OWA from different locations
such as airports or Internet cafes which may block the IE settings. In that case your users
might get the interface in a different language then the one they are used to see.

To prevent this from happening you might want to hard code the language used by the OWA interface.

The following KB article explains how to do it:
http://support.microsoft.com/default.aspx?scid=kb;en-us;310599&sd=tech

The problem is that as you can see it isn't that simple. Tal H. (Thanks!!!) created the DLL
file needed for the English language and I have it attached here.

[Disclaimer-Use this file at your own risk. I (or anyone else) do not take any responsibilty
for any damage,direct or indirect, that might be caused by using the attached file.
The file is provided as is,no warranties!!]
AcceptLanguage.txt
(Rename the file to AcceptLanguage.DLL)

LimitLogin v1.0

Erik Rozman — Tue, 15 Mar 2005 15:00:00 GMT

Microsoft has released a tool we have been waiting for-a tool that enables
SysAdmins to control conccurent logins to their AD environment.

Based on the short time I have been exposed to this tool I can say that
it looks cool but it has its limitations.

The download can be found at:
http://download.microsoft.com/download/f/d/0/fd05def7-68a1-4f71-8546-25c359cc0842/limitlogin.exe

Comparing directory (AD) information between DCs

Erik Rozman — Sat, 08 Jan 2005 00:28:00 GMT

While verifying AD replication it may be useful to compare the directory information
stored on different domain controllers. There is a toold that can compare the information
and it is called DSASTAT.EXE. The tool can be found among the Windows Support Tools.

For additional information take a look at:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/Resources/Documentation/windowsserv/2003/all/techref/en-us/dsastat.asp