- Active Directory Cookbook
- Preface
- 1. Getting Started
- 2. Forests, Domains, and Trusts
- Introduction
- Creating a Forest
- Removing a Forest
- Creating a Domain
- Removing a Domain
- Removing an Orphaned Domain
- Finding the Domains in a Forest
- Finding the NetBIOS Name of a Domain
- Renaming a Domain
- Raising the Domain Functional Level to Windows Server 2012
- Raising the Functional Level of a Windows Server 2008 or 2008 R2 Forest
- Using AdPrep to Prepare a Domain or Forest for Windows Server 2012
- Determining Whether AdPrep Has Completed
- Checking Whether a Windows Domain Controller Can Be Upgraded to Windows Server 2003 or 2008
- Creating an External Trust
- Creating a Transitive Trust Between Two AD Forests
- Creating a Shortcut Trust Between Two AD Domains
- Creating a Trust to a Kerberos Realm
- Viewing the Trusts for a Domain
- Verifying a Trust
- Resetting a Trust
- Removing a Trust
- Enabling SID Filtering for a Trust
- Enabling Quarantine for a Trust
- Managing Selective Authentication for a Trust
- Finding Duplicate SIDs in a Domain
- Adding Additional Fields to Active Directory Users and Computers
- 3. Domain Controllers, Global Catalogs, and FSMOs
- Introduction
- Promoting a Server to a Domain Controller
- Promoting a Server to a Read-Only Domain Controller
- Performing a Two-Stage RODC Installation
- Modifying the Password Replication Policy
- Promoting a Server to a Windows Server 2012 Domain Controller from Media
- Demoting a Domain Controller
- Automating the Promotion or Demotion of a Domain Controller
- Troubleshooting Domain Controller Promotion or Demotion Problems
- Verifying the Promotion of a Domain Controller
- Removing an Unsuccessfully Demoted Domain Controller
- Renaming a Domain Controller
- Finding the Domain Controllers for a Domain
- Finding the Closest Domain Controller
- Finding a Domain Controller’s Site
- Moving a Domain Controller to a Different Site
- Finding the Services a Domain Controller Is Advertising
- Restoring a Deleted Domain Controller in Windows Server 2012
- Resetting the TCP/IP Stack on a Domain Controller
- Configuring a Domain Controller to Use an External Time Source
- Finding the Number of Logon Attempts Made Against a Domain Controller
- Enabling the /3GB Switch to Increase the LSASS Cache
- Enabling and Disabling the Global Catalog
- Determining Whether Global Catalog Promotion Is Complete
- Finding the Global Catalog Servers in a Forest
- Finding the Domain Controllers or Global Catalog Servers in a Site
- Finding Domain Controllers and Global Catalogs via DNS
- Changing the Preference for a Domain Controller
- Disabling the Global Catalog Requirement for User Logon
- Finding the FSMO Role Holders
- Transferring a FSMO Role
- Seizing a FSMO Role
- Finding the PDC Emulator FSMO Role Owner via DNS
- 4. Searching and Manipulating Objects
- Introduction
- Viewing the RootDSE
- Viewing the Attributes of an Object
- Counting Objects in Active Directory
- Using LDAP Controls
- Using a Fast or Concurrent Bind
- Connecting to an Object GUID
- Connecting to a Well-Known GUID
- Searching for Objects in a Domain
- Searching the Global Catalog
- Searching for a Large Number of Objects
- Searching with an Attribute-Scoped Query
- Searching with a Bitwise Filter
- Creating an Object
- Modifying an Object
- Modifying a Bit-Flag Attribute
- Dynamically Linking an Auxiliary Class
- Creating a Dynamic Object
- Refreshing a Dynamic Object
- Modifying the Default TTL Settings for Dynamic Objects
- Moving an Object to a Different OU or Container
- Moving an Object to a Different Domain
- Referencing an External Domain
- Renaming an Object
- Deleting an Object
- Deleting a Container That Has Child Objects
- Viewing the Created and Last-Modified Timestamp of an Object
- Modifying the Default LDAP Query Policy
- Exporting Objects to an LDIF File
- Importing Objects Using an LDIF File
- Exporting Objects to a CSV File
- Importing Objects Using PowerShell and a CSV File
- 5. Organizational Units
- Introduction
- Creating an OU
- Enumerating the OUs in a Domain
- Finding an OU
- Enumerating the Objects in an OU
- Deleting the Objects in an OU
- Deleting an OU
- Moving the Objects in an OU to a Different OU
- Moving an OU
- Renaming an OU
- Modifying an OU
- Determining Approximately How Many Child Objects an OU Has
- Delegating Control of an OU
- Assigning or Removing a Manager for an OU
- Linking a GPO to an OU
- Protecting an OU Against Accidental Deletion
- 6. Users
- Introduction
- Modifying the Default Display Name Used When Creating Users in ADUC or ADAC
- Creating a User
- Creating a Large Number of Users
- Creating an inetOrgPerson User
- Converting a user Object to an inetOrgPerson Object (or Vice Versa)
- Modifying an Attribute for Several Users at Once
- Deleting a User
- Setting a User’s Profile Attributes
- Moving a User
- Redirecting Users to an Alternative OU
- Renaming a User
- Copying a User
- Finding Locked-Out Users
- Unlocking a User
- Troubleshooting Account Lockout Problems
- Viewing the Domain-Wide Account Lockout and Password Policies
- Applying a Fine-Grained Password Policy to a User Object
- Viewing the Fine-Grained Password Policy That Is in Effect for a User Account
- Enabling and Disabling a User
- Finding Disabled Users
- Viewing a User’s Group Membership
- Removing All Group Memberships from a User
- Changing a User’s Primary Group
- Copying a User’s Group Membership to Another User
- Setting a User’s Password
- Preventing a User from Changing a Password
- Requiring a User to Change a Password at Next Logon
- Preventing a User’s Password from Expiring
- Finding Users Whose Passwords Are About to Expire
- Viewing the RODCs That Have Cached a User’s Password
- Setting a User’s Account Options (userAccountControl)
- Setting a User’s Account to Expire
- Determining a User’s Last Logon Time
- Finding Users Who Have Not Logged On Recently
- Viewing and Modifying a User’s Permitted Logon Hours
- Viewing a User’s Managed Objects
- Creating a UPN Suffix for a Forest
- Restoring a Deleted User
- Protecting a User Against Accidental Deletion
- 7. Groups
- Introduction
- Creating a Group
- Viewing the Permissions of a Group
- Viewing the Direct Members of a Group
- Viewing the Nested Members of a Group
- Adding and Removing Members of a Group
- Moving a Group Within a Domain
- Moving a Group to Another Domain
- Changing the Scope or Type of a Group
- Modifying Group Attributes
- Delegating Control for Managing Membership of a Group
- Resolving a Primary Group ID
- Enabling Universal Group Membership Caching
- Restoring a Deleted Group
- Protecting a Group Against Accidental Deletion
- Applying a Fine-Grained Password Policy to a Group Object
- 8. Computer Objects
- Introduction
- Creating a Computer
- Creating a Computer for a Specific User or Group
- Deleting a Computer
- Joining a Computer to a Domain
- Moving a Computer Within the Same Domain
- Moving a Computer to a New Domain
- Renaming a Computer
- Adding or Removing a Computer Account from a Group
- Testing the Secure Channel for a Computer
- Resetting a Computer Account
- Finding Inactive or Unused Computers
- Changing the Maximum Number of Computers a User Can Join to the Domain
- Modifying the Attributes of a computer Object
- Finding Computers with a Particular OS
- Binding to the Default Container for Computers
- Changing the Default Container for Computers
- Listing All the Computer Accounts in a Domain
- Identifying a Computer Role
- Protecting a Computer Against Accidental Deletion
- Viewing the RODCs That Have Cached a Computer’s Password
- 9. Group Policy Objects
- Introduction
- Finding the GPOs in a Domain
- Creating a GPO
- Copying a GPO
- Deleting a GPO
- Viewing the Settings of a GPO
- Modifying the Settings of a GPO
- Importing Settings into a GPO
- Creating a Migration Table
- Creating Custom Group Policy Settings
- Assigning Logon/Logoff and Startup/Shutdown Scripts in a GPO
- Installing Applications with a GPO
- Disabling the User or Computer Settings in a GPO
- Listing the Links for a GPO
- Creating a GPO Link to an OU
- Blocking Inheritance of GPOs on an OU
- Enforcing the Settings of a GPO Link
- Applying a Security Filter to a GPO
- Delegating Administration of GPOs
- Importing a Security Template
- Creating a WMI Filter
- Applying a WMI Filter to a GPO
- Configuring Loopback Processing for a GPO
- Backing Up a GPO
- Restoring a GPO
- Simulating the RSoP
- Viewing the RSoP
- Refreshing GPO Settings on a Computer
- Restoring a Default GPO
- Creating a Fine-Grained Password Policy
- Editing a Fine-Grained Password Policy
- Viewing the Effective PSO for a User
- 10. Schema
- Introduction
- Registering the Active Directory Schema MMC Snap-in
- Generating an OID to Use for a New Class or Attribute
- Extending the Schema
- Preparing the Schema for an Active Directory Upgrade
- Documenting Schema Extensions
- Adding a New Attribute
- Viewing an Attribute
- Adding a New Class
- Viewing a Class
- Indexing an Attribute
- Modifying the Attributes That Are Copied When Duplicating a User
- Modifying the Attributes Included with ANR
- Modifying the Set of Attributes Stored on a Global Catalog
- Finding Nonreplicated and Constructed Attributes
- Finding the Linked Attributes
- Finding the Structural, Auxiliary, Abstract, and 88 Classes
- Finding the Mandatory and Optional Attributes of a Class
- Modifying the Default Security of a Class
- Managing the Confidentiality Bit
- Adding an Attribute to the Read-Only Filtered Attribute Set (RO-FAS)
- Deactivating Classes and Attributes
- Redefining Classes and Attributes
- Reloading the Schema Cache
- Managing the Schema Master FSMO
- 11. Site Topology
- Introduction
- Creating a Site
- Listing Sites in a Domain
- Renaming a Site
- Deleting a Site
- Delegating Control of a Site
- Configuring Universal Group Caching for a Site
- Creating a Subnet
- Listing the Subnets
- Finding Missing Subnets
- Deleting a Subnet
- Changing a Subnet’s Site Assignment
- Creating a Site Link
- Finding the Site Links for a Site
- Modifying the Sites That Are Part of a Site Link
- Modifying the Cost for a Site Link
- Enabling Change Notification for a Site Link
- Modifying Replication Schedules
- Disabling Site Link Transitivity or Site Link Schedules
- Creating a Site Link Bridge
- Finding the Bridgehead Servers for a Site
- Setting a Preferred Bridgehead Server for a Site
- Listing the Servers
- Moving a Domain Controller to a Different Site
- Configuring a Domain Controller to Cover Multiple Sites
- Viewing the Site Coverage for a Domain Controller
- Disabling Automatic Site Coverage for a Domain Controller
- Finding the Site for a Client
- Forcing a Host into a Particular Site
- Creating a connection Object
- Listing the connection Objects for a Server
- Finding the ISTG for a Site
- Transferring the ISTG to Another Server
- Triggering the KCC
- Determining Whether the KCC Is Completing Successfully
- Disabling the KCC for a Site
- Changing the Interval at Which the KCC Runs
- 12. Replication
- Introduction
- Determining Whether Two Domain Controllers Are in Sync
- Viewing the Replication Status of Several Domain Controllers
- Viewing Unreplicated Changes Between Two Domain Controllers
- Forcing Replication from One Domain Controller to Another
- Enabling and Disabling Replication
- Changing the Intra-Site Replication Notification Interval
- Changing the Inter-Site Replication Interval
- Disabling Inter-Site Compression of Replication Traffic
- Checking for Potential Replication Problems
- Enabling Enhanced Logging of Replication Events
- Enabling Strict or Loose Replication Consistency
- Finding conflict Objects
- Finding Orphaned Objects
- Listing the Replication Partners for a DC
- Viewing Object Metadata
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.