- Active Directory Cookbook
- Preface
- 1. Getting Started
- 2. Forests, Domains, and Trusts
- Introduction
- Creating a Forest
- Removing a Forest
- Creating a Domain
- Removing a Domain
- Removing an Orphaned Domain
- Finding the Domains in a Forest
- Finding the NetBIOS Name of a Domain
- Renaming a Domain
- Raising the Domain Functional Level to Windows Server 2012
- Raising the Functional Level of a Windows Server 2008 or 2008 R2 Forest
- Using AdPrep to Prepare a Domain or Forest for Windows Server 2012
- Determining Whether AdPrep Has Completed
- Checking Whether a Windows Domain Controller Can Be Upgraded to Windows Server 2003 or 2008
- Creating an External Trust
- Creating a Transitive Trust Between Two AD Forests
- Creating a Shortcut Trust Between Two AD Domains
- Creating a Trust to a Kerberos Realm
- Viewing the Trusts for a Domain
- Verifying a Trust
- Resetting a Trust
- Removing a Trust
- Enabling SID Filtering for a Trust
- Enabling Quarantine for a Trust
- Managing Selective Authentication for a Trust
- Finding Duplicate SIDs in a Domain
- Adding Additional Fields to Active Directory Users and Computers
- 3. Domain Controllers, Global Catalogs, and FSMOs
- Introduction
- Promoting a Server to a Domain Controller
- Promoting a Server to a Read-Only Domain Controller
- Performing a Two-Stage RODC Installation
- Modifying the Password Replication Policy
- Promoting a Server to a Windows Server 2012 Domain Controller from Media
- Demoting a Domain Controller
- Automating the Promotion or Demotion of a Domain Controller
- Troubleshooting Domain Controller Promotion or Demotion Problems
- Verifying the Promotion of a Domain Controller
- Removing an Unsuccessfully Demoted Domain Controller
- Renaming a Domain Controller
- Finding the Domain Controllers for a Domain
- Finding the Closest Domain Controller
- Finding a Domain Controller’s Site
- Moving a Domain Controller to a Different Site
- Finding the Services a Domain Controller Is Advertising
- Restoring a Deleted Domain Controller in Windows Server 2012
- Resetting the TCP/IP Stack on a Domain Controller
- Configuring a Domain Controller to Use an External Time Source
- Finding the Number of Logon Attempts Made Against a Domain Controller
- Enabling the /3GB Switch to Increase the LSASS Cache
- Enabling and Disabling the Global Catalog
- Determining Whether Global Catalog Promotion Is Complete
- Finding the Global Catalog Servers in a Forest
- Finding the Domain Controllers or Global Catalog Servers in a Site
- Finding Domain Controllers and Global Catalogs via DNS
- Changing the Preference for a Domain Controller
- Disabling the Global Catalog Requirement for User Logon
- Finding the FSMO Role Holders
- Transferring a FSMO Role
- Seizing a FSMO Role
- Finding the PDC Emulator FSMO Role Owner via DNS
- 4. Searching and Manipulating Objects
- Introduction
- Viewing the RootDSE
- Viewing the Attributes of an Object
- Counting Objects in Active Directory
- Using LDAP Controls
- Using a Fast or Concurrent Bind
- Connecting to an Object GUID
- Connecting to a Well-Known GUID
- Searching for Objects in a Domain
- Searching the Global Catalog
- Searching for a Large Number of Objects
- Searching with an Attribute-Scoped Query
- Searching with a Bitwise Filter
- Creating an Object
- Modifying an Object
- Modifying a Bit-Flag Attribute
- Dynamically Linking an Auxiliary Class
- Creating a Dynamic Object
- Refreshing a Dynamic Object
- Modifying the Default TTL Settings for Dynamic Objects
- Moving an Object to a Different OU or Container
- Moving an Object to a Different Domain
- Referencing an External Domain
- Renaming an Object
- Deleting an Object
- Deleting a Container That Has Child Objects
- Viewing the Created and Last-Modified Timestamp of an Object
- Modifying the Default LDAP Query Policy
- Exporting Objects to an LDIF File
- Importing Objects Using an LDIF File
- Exporting Objects to a CSV File
- Importing Objects Using PowerShell and a CSV File
- 5. Organizational Units
- Introduction
- Creating an OU
- Enumerating the OUs in a Domain
- Finding an OU
- Enumerating the Objects in an OU
- Deleting the Objects in an OU
- Deleting an OU
- Moving the Objects in an OU to a Different OU
- Moving an OU
- Renaming an OU
- Modifying an OU
- Determining Approximately How Many Child Objects an OU Has
- Delegating Control of an OU
- Assigning or Removing a Manager for an OU
- Linking a GPO to an OU
- Protecting an OU Against Accidental Deletion
- 6. Users
- Introduction
- Modifying the Default Display Name Used When Creating Users in ADUC or ADAC
- Creating a User
- Creating a Large Number of Users
- Creating an inetOrgPerson User
- Converting a user Object to an inetOrgPerson Object (or Vice Versa)
- Modifying an Attribute for Several Users at Once
- Deleting a User
- Setting a User’s Profile Attributes
- Moving a User
- Redirecting Users to an Alternative OU
- Renaming a User
- Copying a User
- Finding Locked-Out Users
- Unlocking a User
- Troubleshooting Account Lockout Problems
- Viewing the Domain-Wide Account Lockout and Password Policies
- Applying a Fine-Grained Password Policy to a User Object
- Viewing the Fine-Grained Password Policy That Is in Effect for a User Account
- Enabling and Disabling a User
- Finding Disabled Users
- Viewing a User’s Group Membership
- Removing All Group Memberships from a User
- Changing a User’s Primary Group
- Copying a User’s Group Membership to Another User
- Setting a User’s Password
- Preventing a User from Changing a Password
- Requiring a User to Change a Password at Next Logon
- Preventing a User’s Password from Expiring
- Finding Users Whose Passwords Are About to Expire
- Viewing the RODCs That Have Cached a User’s Password
- Setting a User’s Account Options (userAccountControl)
- Setting a User’s Account to Expire
- Determining a User’s Last Logon Time
- Finding Users Who Have Not Logged On Recently
- Viewing and Modifying a User’s Permitted Logon Hours
- Viewing a User’s Managed Objects
- Creating a UPN Suffix for a Forest
- Restoring a Deleted User
- Protecting a User Against Accidental Deletion
- 7. Groups
- Introduction
- Creating a Group
- Viewing the Permissions of a Group
- Viewing the Direct Members of a Group
- Viewing the Nested Members of a Group
- Adding and Removing Members of a Group
- Moving a Group Within a Domain
- Moving a Group to Another Domain
- Changing the Scope or Type of a Group
- Modifying Group Attributes
- Delegating Control for Managing Membership of a Group
- Resolving a Primary Group ID
- Enabling Universal Group Membership Caching
- Restoring a Deleted Group
- Protecting a Group Against Accidental Deletion
- Applying a Fine-Grained Password Policy to a Group Object
- 8. Computer Objects
- Introduction
- Creating a Computer
- Creating a Computer for a Specific User or Group
- Deleting a Computer
- Joining a Computer to a Domain
- Moving a Computer Within the Same Domain
- Moving a Computer to a New Domain
- Renaming a Computer
- Adding or Removing a Computer Account from a Group
- Testing the Secure Channel for a Computer
- Resetting a Computer Account
- Finding Inactive or Unused Computers
- Changing the Maximum Number of Computers a User Can Join to the Domain
- Modifying the Attributes of a computer Object
- Finding Computers with a Particular OS
- Binding to the Default Container for Computers
- Changing the Default Container for Computers
- Listing All the Computer Accounts in a Domain
- Identifying a Computer Role
- Protecting a Computer Against Accidental Deletion
- Viewing the RODCs That Have Cached a Computer’s Password
- 9. Group Policy Objects
- Introduction
- Finding the GPOs in a Domain
- Creating a GPO
- Copying a GPO
- Deleting a GPO
- Viewing the Settings of a GPO
- Modifying the Settings of a GPO
- Importing Settings into a GPO
- Creating a Migration Table
- Creating Custom Group Policy Settings
- Assigning Logon/Logoff and Startup/Shutdown Scripts in a GPO
- Installing Applications with a GPO
- Disabling the User or Computer Settings in a GPO
- Listing the Links for a GPO
- Creating a GPO Link to an OU
- Blocking Inheritance of GPOs on an OU
- Enforcing the Settings of a GPO Link
- Applying a Security Filter to a GPO
- Delegating Administration of GPOs
- Importing a Security Template
- Creating a WMI Filter
- Applying a WMI Filter to a GPO
- Configuring Loopback Processing for a GPO
- Backing Up a GPO
- Restoring a GPO
- Simulating the RSoP
- Viewing the RSoP
- Refreshing GPO Settings on a Computer
- Restoring a Default GPO
- Creating a Fine-Grained Password Policy
- Editing a Fine-Grained Password Policy
- Viewing the Effective PSO for a User
- 10. Schema
- Introduction
- Registering the Active Directory Schema MMC Snap-in
- Generating an OID to Use for a New Class or Attribute
- Extending the Schema
- Preparing the Schema for an Active Directory Upgrade
- Documenting Schema Extensions
- Adding a New Attribute
- Viewing an Attribute
- Adding a New Class
- Viewing a Class
- Indexing an Attribute
- Modifying the Attributes That Are Copied When Duplicating a User
- Modifying the Attributes Included with ANR
- Modifying the Set of Attributes Stored on a Global Catalog
- Finding Nonreplicated and Constructed Attributes
- Finding the Linked Attributes
- Finding the Structural, Auxiliary, Abstract, and 88 Classes
- Finding the Mandatory and Optional Attributes of a Class
- Modifying the Default Security of a Class
- Managing the Confidentiality Bit
- Adding an Attribute to the Read-Only Filtered Attribute Set (RO-FAS)
- Deactivating Classes and Attributes
- Redefining Classes and Attributes
- Reloading the Schema Cache
- Managing the Schema Master FSMO
- 11. Site Topology
- Introduction
- Creating a Site
- Listing Sites in a Domain
- Renaming a Site
- Deleting a Site
- Delegating Control of a Site
- Configuring Universal Group Caching for a Site
- Creating a Subnet
- Listing the Subnets
- Finding Missing Subnets
- Deleting a Subnet
- Changing a Subnet’s Site Assignment
- Creating a Site Link
- Finding the Site Links for a Site
- Modifying the Sites That Are Part of a Site Link
- Modifying the Cost for a Site Link
- Enabling Change Notification for a Site Link
- Modifying Replication Schedules
- Disabling Site Link Transitivity or Site Link Schedules
- Creating a Site Link Bridge
- Finding the Bridgehead Servers for a Site
- Setting a Preferred Bridgehead Server for a Site
- Listing the Servers
- Moving a Domain Controller to a Different Site
- Configuring a Domain Controller to Cover Multiple Sites
- Viewing the Site Coverage for a Domain Controller
- Disabling Automatic Site Coverage for a Domain Controller
- Finding the Site for a Client
- Forcing a Host into a Particular Site
- Creating a connection Object
- Listing the connection Objects for a Server
- Finding the ISTG for a Site
- Transferring the ISTG to Another Server
- Triggering the KCC
- Determining Whether the KCC Is Completing Successfully
- Disabling the KCC for a Site
- Changing the Interval at Which the KCC Runs
- 12. Replication
- Introduction
- Determining Whether Two Domain Controllers Are in Sync
- Viewing the Replication Status of Several Domain Controllers
- Viewing Unreplicated Changes Between Two Domain Controllers
- Forcing Replication from One Domain Controller to Another
- Enabling and Disabling Replication
- Changing the Intra-Site Replication Notification Interval
- Changing the Inter-Site Replication Interval
- Disabling Inter-Site Compression of Replication Traffic
- Checking for Potential Replication Problems
- Enabling Enhanced Logging of Replication Events
- Enabling Strict or Loose Replication Consistency
- Finding conflict Objects
- Finding Orphaned Objects
- Listing the Replication Partners for a DC
- Viewing Object Metadata
A note on the digital index
A link in an index entry is displayed as the section title in which that entry appears. Because some sections have multiple index markers, it is not unusual for an entry to have several links to the same section. Clicking on any link will take you directly to the place in the text in which the marker appears.
Symbols
- . (period), using for hostname in AdMod or AdFind, Using a command-line interface
- 15 Field Engineering diagnostics logging settings, Solution
- 32- or 64-bit computers, Discussion
- /3GB switch, enabling to increase LSASS cache, Problem
- 5807 events, Solution
- 88 classes, finding, Problem
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.