Active Directory Cookbook for Windows Server 2003 and Windows 2000

by Allen, Robbie

ISBN13: 9780596004644

ISBN10: 0596004648

Format: Paperback

Pub. Date: 2003-09-01

Publisher(s): Oreilly & Associates Inc

Other versions by this Author

List Price: ~~$44.95~~

Rent Book

Select for Price

Add to Cart

There was a problem. Please try again later.

New Book

We're Sorry
Sold Out

Used Book

We're Sorry
Sold Out

eBook

We're Sorry
Not Available

Buy from our Marketplace starting at $6.34

Summary

Those of you who run networks on Windows 2000 know the benefits of using Active Directory for managing user information and permissions. You also know what a bear it can be. The newer version included with Windows Server 2003 has over 100 new and updated features to simplify deployment, but once it's in place many system administrators still find Active Directory challenging. If you're among those looking for practical hands-on support, help is here with our newActive Directory Cookbook for Windows Server 2003 & Windows 2000, a unique problem-solving guide that offers quick answers for both versions of the directory.The book contains hundreds of step-by-step solutions for both common and uncommon problems that you might encounter with Active Directory on a daily basis--including recipes to deal with the Lightweight Directory Access Protocol (LDAP), multi-master replication, Domain Name System (DNS), Group Policy, the Active Directory Schema, and many other features. Author Robbie Allen, a Senior Systems Architect at Cisco Systems and co-author of our Active Directory tutorial, based this collection of troubleshooting recipes on his own experience, along with input from Windows administrators throughout the industry. Each recipe includes a discussion to explain how and why the solution works, so you can adapt the problem-solving techniques to similar situations.If your company is considering an upgrade from Windows NT or 2000 to Windows Server 2003, theActive Directory Cookbook for Windows Server 2003 & Windows 2000will help reduce the time and trouble it takes to configure and deploy Active Directory for your network.This Cookbook is also a perfect companion to Active Directory, the tutorial that experts hail as the best source for understanding Microsoft's network directory service. While Active Directory provides the big picture,Active Directory Cookbook for Windows Server 2003 & Windows 2000gives you the quick solutions you need to cope with day-to-day dilemmas. Together, these books supply the knowledge and tools so you can get the most out of Active Directory to manage users, groups, computers, domains, organizational units, and security policies on your network.

Author Biography

Robbie Allen is a Senior Systems Architect in the Advanced Services Technology Group at Cisco Systems. He was instrumental in the deployment and automation of Active Directory, DNS, and DHCP at Cisco. Robbie enjoys working on the Unix and Windows platforms, especially when Perl is installed. He is a firm believer that all system administrators should be proficient in at least one scripting language and most of his writings preach the benefits of automation. Robbie has a web site at www.rallenhome.com.

Foreword

xvii

Preface

xxi

Getting Started

(12)

Where to Find the Tools

(2)

Getting Familiar with LDIF

(1)

Programming Notes

(4)

Replaceable Text

(1)

Where to Find More Information

(3)

Forests, Domains, and Trusts

(40)

Creating a Forest

(1)

Removing a Forest

(1)

Creating a Domain

(1)

Removing a Domain

(2)

Removing an Orphaned Domain

(1)

Finding the Domains in a Forest

(2)

Finding the NetBIOS Name of a Domain

(1)

Renaming a Domain

(1)

Changing the Mode of a Domain

(2)

Using ADPrep to Prepare a Domain or Forest for Windows Server 2003

(1)

Determining if ADPrep Has Completed

(2)

Checking Whether a Windows 2000 Domain Controller Can Be Upgraded to Windows Server 2003

(1)

Raising the Functional Level of a Windows Server 2003 Domain

(2)

Raising the Functional Level of a Windows Server 2003 Forest

(3)

Creating a Trust Between a Windows NT Domain and an AD Domain

(1)

Creating a Transitive Trust Between Two AD Forests

(2)

Creating a Shortcut Trust Between Two AD Domains

(1)

Creating a Trust to a Kerberos Realm

(2)

Viewing the Trusts for a Domain

(2)

Verifying a Trust

(2)

Resetting a Trust

(2)

Removing a Trust

(1)

Enabling SID Filtering for a Trust

(1)

Finding Duplicate SIDs in a Domain

(2)

Domain Controllers, Global Catalogs, and FSMOs

(41)

Promoting a Domain Controller

(1)

Promoting a Domain Controller from Media

(2)

Demoting a Domain Controller

(1)

Automating the Promotion or Demotion of a Domain Controller

(1)

Troubleshooting Domain Controller Promotion or Demotion Problems

(1)

Removing an Unsuccessfully Demoted Domain Controller

(3)

Renaming a Domain Controller

(1)

Finding the Domain Controllers for a Domain

(1)

Finding the Closest Domain Controller

(2)

Finding a Domain Controller's Site

(1)

Moving a Domain Controller to a Different Site

(3)

Finding the Services a Domain Controller Is Advertising

(1)

Configuring a Domain Controller to Use an External Time Source

(1)

Finding the Number of Logon Attempts Made Against a Domain Controller

(1)

Enabling the /3GB Switch to Increase the LSASS Cache

(1)

Cleaning Up Distributed Link Tracking Objects

(1)

Enabling and Disabling the Global Catalog

(2)

Determining if Global Catalog Promotion Is Complete

(1)

Finding the Global Catalog Servers in a Forest

(1)

Finding the Domain Controllers or Global Catalog Servers in a Site

(2)

Finding Domain Controllers and Global Catalogs via DNS

(1)

Changing the Preference for a Domain Controller

(2)

Disabling the Global Catalog Requirement During a Windows 2000 Domain Login

(1)

Disabling the Global Catalog Requirement During a Windows 2003 Domain Login

(1)

Finding the FSMO Role Holders

(2)

Transferring a FSMO Role

(2)

Seizing a FSMO Role

(1)

Finding the PDC Emulator FSMO Role Owner via DNS

(2)

Searching and Manipulating Objects

(52)

Viewing the RootDSE

(3)

Viewing the Attributes of an Object

(3)

Using LDAP Controls

101

(3)

Using a Fast or Concurrent Bind

104

(1)

Searching for Objects in a Domain

105

(3)

Searching the Global Catalog

108

(2)

Searching for a Large Number of Objects

110

(2)

Searching with an Attribute-Scoped Query

112

(2)

Searching with a Bitwise Filter

114

(2)

Creating an Object

116

(2)

Modifying an Object

118

(3)

Modifying a Bit-Flag Attribute

121

(2)

Dynamically Linking an Auxiliary Class

123

(2)

Creating a Dynamic Object

125

(1)

Refreshing a Dynamic Object

126

(2)

Modifying the Default TTL Settings for Dynamic Objects

128

(2)

Moving an Object to a Different OU or Container

130

(2)

Moving an Object to a Different Domain

132

(1)

Renaming an Object

133

(2)

Deleting an Object

135

(1)

Deleting a Container That Has Child Objects

136

(1)

Viewing the Created and Last Modified Timestamp of an Object

137

(2)

Modifying the Default LDAP Query Policy

139

(2)

Exporting Objects to an LDIF File

141

(1)

Importing Objects Using an LDIF File

142

(2)

Exporting Objects to a CSV File

144

(1)

Importing Objects Using a CSV File

144

(2)

Organizational Units

146

(17)

Creating an OU

147

(1)

Enumerating the OUs in a Domain

148

(2)

Enumerating the Objects in an OU

150

(1)

Deleting the Objects in an OU

151

(1)

Deleting an OU

152

(2)

Moving the Objects in an OU to a Different OU

154

(1)

Moving an OU

155

(1)

Determining How Many Child Objects an OU Has

156

(2)

Delegating Control of an OU

158

(1)

Allowing OUs to Be Created Within Containers

159

(1)

Linking a GPO to an OU

160

(3)

Users

163

(54)

Creating a User

164

(2)

Creating a Large Number of Users

166

(1)

Creating an inetOrgPerson User

167

(2)

Modifying an Attribute for Several Users at Once

169

(2)

Moving a User

171

(1)

Renaming a User

172

(1)

Copying a User

173

(2)

Unlocking a User

175

(1)

Finding Locked Out Users

176

(1)

Troubleshooting Account Lockout Problems

177

(2)

Viewing the Account Lockout and Password Policies

179

(3)

Enabling and Disabling a User

182

(2)

Finding Disabled Users

184

(1)

Viewing a User's Group Membership

185

(2)

Changing a User's Primary Group

187

(2)

Transferring a User's Group Membership to Another User

189

(2)

Setting a User's Password

191

(1)

Setting a User's Password via LDAP

192

(1)

Setting a User's Password via Kerberos

193

(1)

Preventing a User from Changing His Password

193

(2)

Requiring a User to Change Her Password at Next Logon

195

(1)

Preventing a User's Password from Expiring

196

(1)

Finding Users Whose Passwords Are About to Expire

197

(4)

Setting a User's Account Options (userAccountControl)

201

(2)

Setting a User's Account to Expire in the Future

203

(2)

Finding Users Whose Accounts Are About to Expire

205

(2)

Determining a User's Last Logon Time

207

(2)

Finding Users Who Have Not Logged On Recently

209

(2)

Setting a User's Profile Attributes

211

(1)

Viewing a User's Managed Objects

212

(1)

Modifying the Default Display Name Used When Creating Users in ADUC

213

(2)

Creating a UPN Suffix for a Forest

215

(2)

Groups

217

(16)

Creating a Group

218

(2)

Viewing the Direct Members of a Group

220

(1)

Viewing the Nested Members of a Group

221

(1)

Adding and Removing Members of a Group

222

(2)

Moving a Group

224

(1)

Changing the Scope or Type of a Group

225

(1)

Delegating Control for Managing Membership of a Group

226

(2)

Resolving a Primary Group ID

228

(3)

Enabling Universal Group Membership Caching

231

(2)

Computers

233

(28)

Creating a Computer

234

(2)

Creating a Computer for a Specific User or Group

236

(5)

Joining a Computer to a Domain

241

(3)

Moving a Computer

244

(1)

Renaming a Computer

245

(2)

Testing the Secure Channel for a Computer

247

(1)

Resetting a Computer

248

(1)

Finding Inactive or Unused Computers

249

(4)

Changing the Maximum Number of Computers a User Can Join to the Domain

253

(1)

Finding Computers with a Particular OS

254

(2)

Binding to the Default Container for Computers

256

(2)

Changing the Default Container for Computers

258

(3)

Group Policy Objects (GPOs)

261

(40)

Finding the GPOs in a Domain

263

(1)

Creating a GPO

264

(1)

Copying a GPO

265

(3)

Deleting a GPO

268

(1)

Viewing the Settings of a GPO

269

(3)

Modifying the Settings of a GPO

272

(1)

Importing Settings into a GPO

272

(3)

Assigning Logon/Logoff and Startup/Shutdown Scripts in a GPO

275

(1)

Installing Applications with a GPO

276

(1)

Disabling the User or Computer Settings in a GPO

277

(2)

Listing the Links for GPO

279

(2)

Creating a GPO Link to an OU

281

(2)

Blocking Inheritance of GPOs on an OU

283

(2)

Applying a Security Filter to a GPO

285

(3)

Creating a WMI Filter

288

(1)

Applying a WMI Filter to a GPO

289

(2)

Backing Up a GPO

291

(3)

Restoring a GPO

294

(2)

Simulating the RSoP

296

(1)

Viewing the RSoP

297

(2)

Refreshing GPO Settings on a Computer

299

(1)

Restoring a Default GPO

299

(2)

Schema

301

(39)

Registering the Active Directory Schema MMC Snap-in

303

(1)

Enabling Schema Updates

304

(2)

Generating an OID to Use for a New Class or Attribute

306

(1)

Generating a GUID to Use for a New Class or Attribute

307

(1)

Extending the Schema

308

(1)

Documenting Schema Extensions

309

(1)

Adding a New Attribute

310

(3)

Viewing an Attribute

313

(2)

Adding a New Class

315

(2)

Viewing a Class

317

(1)

Indexing an Attribute

318

(2)

Modifying the Attributes That Are Copied When Duplicating a User

320

(2)

Modifying the Attributes Included with Ambiguous Name Resolution

322

(2)

Adding or Removing an Attribute in the Global Catalog

324

(2)

Finding the Nonreplicated and Constructed Attributes

326

(3)

Finding the Linked Attributes

329

(1)

Finding the Structural, Auxiliary, Abstract, and 88 Classes

330

(2)

Finding the Mandatory and Optional Attributes of a Class

332

(2)

Modifying the Default Security of a Class

334

(1)

Deactivating Classes and Attributes

335

(1)

Redefining Classes and Attributes

336

(1)

Reloading the Schema Cache

337

(3)

Site Topology

340

(44)

Creating a Site

343

(2)

Listing the Sites

345

(1)

Deleting a Site

346

(1)

Creating a Subnet

347

(2)

Listing the Subnets

349

(1)

Finding Missing Subnets

350

(2)

Creating a Site Link

352

(1)

Finding the Site Links for a Site

353

(2)

Modifying the Sites That Are Part of a Site Link

355

(1)

Modifying the Cost for a Site Link

356

(1)

Disabling Site Link Transitivity or Site Link Schedules

357

(2)

Creating a Site Link Bridge

359

(2)

Finding the Bridgehead Servers for a Site

361

(1)

Setting a Preferred Bridgehead Server for a Site

362

(2)

Listing the Servers

364

(1)

Moving a Domain Controller to a Different Site

365

(1)

Configuring a Domain Controller to Cover Multiple Sites

366

(2)

Viewing the Site Coverage for a Domain Controller

368

(1)

Disabling Automatic Site Coverage for a Domain Controller

368

(1)

Finding the Site for a Client

369

(1)

Forcing a Host to a Particular Site

370

(2)

Creating a Connection Object

372

(1)

Listing the Connection Objects for a Server

373

(1)

Load-Balancing Connection Objects

374

(1)

Finding the ISTG for a Site

375

(1)

Transferring the ISTG to Another Server

376

(2)

Triggering the KCC

378

(1)

Determining if the KCC Is Completing Successfully

379

(1)

Disabling the KCC for a Site

380

(2)

Changing the Interval at Which the KCC Runs

382

(2)

Replication

384

(18)

Determining if Two Domain Controllers Are in Sync

384

(2)

Viewing the Replication Status of Several Domain Controllers

386

(1)

Viewing Unreplicated Changes Between Two Domain Controllers

386

(4)

Forcing Replication from One Domain Controller to Another

390

(1)

Changing the Intra-Site Replication Interval

391

(2)

Changing the Intersite Replication Interval

393

(1)

Disabling Inter-Site Compression of Replication Traffic

394

(1)

Checking for Potential Replication Problems

395

(1)

Enabling Enhanced Logging of Replication Events

395

(1)

Enabling Strict or Loose Replication Consistency

396

(1)

Finding Conflict Objects

397

(2)

Viewing Object Metadata

399

(3)

Domain Name System (DNS)

402

(30)

Creating a Forward Lookup Zone

404

(1)

Creating a Reverse Lookup Zone

405

(1)

Viewing a Server's Zones

406

(2)

Converting a Zone to an AD-Integrated Zone

408

(1)

Moving AD-Integrated Zones into an Application Partition

409

(2)

Delegating Control of a Zone

411

(2)

Creating and Deleting Resource Records

413

(2)

Querying Resource Records

415

(2)

Modifying the DNS Server Configuration

417

(1)

Scavenging Old Resource Records

418

(2)

Clearing the DNS Cache

420

(2)

Verifying That a Domain Controller Can Register Its Resource Records

422

(1)

Registering a Domain Controller's Resource Records

423

(1)

Preventing a Domain Controller from Dynamically Registering All Resource Records

424

(2)

Preventing a Domain Controller from Dynamically Registering Certain Resource Records

426

(3)

Deregistering a Domain Controller's Resource Records

429

(1)

Allowing Computers to Use a Different Domain Suffix from Their AD Domain

429

(3)

Security and Authentication

432

(26)

Enabling SSL/TLS

433

(1)

Encrypting LDAP Traffic with SSL, TLS, or Signing

434

(2)

Enabling Anonymous LDAP Access

436

(2)

Restricting Hosts from Performing LDAP Queries

438

(1)

Using the Delegation of Control Wizard

439

(1)

Customizing the Delegation of Control Wizard

440

(3)

Viewing the ACL for an Object

443

(1)

Customizing the ACL Editor

444

(1)

Viewing the Effective Permissions on an Object

445

(1)

Changing the ACL of an Object

446

(1)

Changing the Default ACL for an Object Class in the Schema

447

(1)

Comparing the ACL of an Object to the Default Defined in the Schema

448

(1)

Resetting an Object's ACL to the Default Defined in the Schema

448

(1)

Preventing the LM Hash of a Password from Being Stored

449

(1)

Enabling List Object Access Mode

450

(2)

Modifying the ACL on Administrator Accounts

452

(1)

Viewing and Purging Your Kerberos Tickets

453

(2)

Forcing Kerberos to Use TCP

455

(1)

Modifying Kerberos Settings

456

(2)

Logging, Monitoring, and Quotas

458

(33)

Enabling Extended dcpromo Logging

459

(2)

Enabling Diagnostics Logging

461

(2)

Enabling NetLogon Logging

463

(1)

Enabling GPO Client Logging

464

(1)

Enabling Kerberos Logging

465

(2)

Enabling DNS Server Debug Logging

467

(2)

Viewing DNS Server Performance Statistics

469

(3)

Enabling Inefficient and Expensive LDAP Query Logging

472

(2)

Using the STATS Control to View LDAP Query Statistics

474

(2)

Using Perfmon to Monitor AD

476

(2)

Using Perfmon Trace Logs to Monitor AD

478

(3)

Enabling Auditing of Directory Access

481

(1)

Creating a Quota

482

(2)

Finding the Quotas Assigned to a Security Principal

484

(1)

Changing How Tombstone Objects Count Against Quota Usage

485

(2)

Setting the Default Quota for All Security Principals in a Partition

487

(1)

Finding the Quota Usage for a Security Principal

488

(3)

Backup, Recovery, DIT Maintenance, and Deleted Objects

491

(26)

Backing Up Active Directory

493

(1)

Restarting a Domain Controller in Directory Services Restore Mode

494

(2)

Resetting the Directory Service Restore Mode Administrator Password

496

(1)

Performing a Nonauthoritative Restore

497

(1)

Performing an Authoritative Restore of an Object or Subtree

498

(2)

Performing a Complete Authoritative Restore

500

(1)

Checking the DIT File's Integrity

501

(1)

Moving the DIT Files

502

(1)

Repairing or Recovering the DIT

502

(1)

Performing an Online Defrag Manually

503

(2)

Determining How Much Whitespace Is in the DIT

505

(1)

Performing an Offline Defrag to Reclaim Space

506

(2)

Changing the Garbage Collection Interval

508

(1)

Logging the Number of Expired Tombstone Objects

509

(2)

Determining the Size of the Active Directory Database

511

(1)

Searching for Deleted Objects

512

(1)

Restoring a Deleted Object

513

(2)

Modifying the Tombstone Lifetime for a Domain

515

(2)

Application Partitions

517

(22)

Creating and Deleting an Application Partition

518

(3)

Finding the Application Partitions in a Forest

521

(2)

Adding or Removing a Replica Server for an Application Partition

523

(2)

Finding the Replica Servers for an Application Partition

525

(2)

Finding the Application Partitions Hosted by a Server

527

(2)

Verifying Application Partitions Are Instantiated on a Server Correctly

529

(1)

Setting the Replication Notification Delay for an Application Partition

530

(2)

Setting the Reference Domain for an Application Partition

532

(2)

Delegating Control of Managing an Application Partition

534

(5)

Interoperability and Integration

539

(18)

Accessing AD from a Non-Windows Platform

539

(1)

Programming with .NET

540

(2)

Programming with DSML

542

(1)

Programming with Perl

543

(1)

Programming with Java

544

(2)

Programming with Python

546

(1)

Integrating with MIT Kerberos

547

(1)

Integrating with Samba

548

(1)

Integrating with Apache

549

(1)

Replacing NIS

550

(1)

Using BIND for DNS

551

(1)

Authorizing a Microsoft DHCP Server

552

(1)

Using VMWare for Testing AD

553

(4)

Appendix: Tool List

557

(18)

Index

575

Active Directory Cookbook for Windows Server 2003 and Windows 2000

Rent Book

New Book

Used Book

eBook

How Marketplace Works:

Summary

Author Biography

Table of Contents

Digital License