Active Directory

by Richards, Joe

• ISBN13: 9780596101732
• ISBN10: 0596101732
• Edition: 3rd
• Format: Paperback
• Copyright: 2006-02-01
• Publisher: Oreilly & Associates Inc

Summary

This book has been updated to provide readers with a clear, detailed look at Active Directory for Windows Server 2003 SP1 and R2. Working with Microsoft's network directory service for the first time can be a headache for system and network administrators, IT professionals, technical project managers, and programmers alike. Active Directory, 3rd Edition guides them through the maze of concepts, design issues and scripting options so they can get the most out of their deployment.

Author Biography

Joe Richards is a consultant / admin / tool writer who happens to have a secret identity as a Microsoft MVP for Windows Server Directory Services. . His specialty is Directory Services but has "minors" in Security and Active Directory programming. By day he works for a large services/consulting/manufacturing company. He takes time to chat with people on listservs and newsgroups, write about stuff he knows, and whips up various fairly useful tools.

Robbie Allen is a technical leader at Cisco Systems, where he has been involved in the deployment of Active Directory, DNS, DHCP, and several network management solutions. Robbie was named a Windows Server MVP in 2004 and 2005 for his contributions to the Windows community and the publication of several popular O'Reilly books. Robbie is currently studying at MIT in its system design and management program. For more information, see Robbie's web site at www.rallenhome.com.

Alistair G. Lowe-Norris is an Architectural Enterprise Strategy Consultant for Microsoft UK. He worked for Leicester University as the project manager and technical lead of the Rapid Deployment Program for Windows 2000, responsible for rolling out one of the world's largest deployments of Windows 2000 preceding release of the final product. Since 1998 he has been the technical editor and a monthly columnist for the Windows Scripting Solutions magazine and a technical editor and author for Windows & .NET Magazine (previously Windows NT Magazine and Windows 2000 Magazine).

Table of Contents

Preface	xiii
Part I. Active Directory Basics
A Brief Introduction	3	(12)
Evolution of the Microsoft NOS	4	(1)
Windows NT Versus Active Directory	5	(5)
Windows 2000 Versus Windows Server 2003	10	(3)
Windows Server 2003 Versus Windows Server 2003 R2	13	(1)
Summary	14	(1)
Active Directory Fundamentals	15	(22)
How Objects Are Stored and Identified	15	(3)
Building Blocks	18	(18)
Summary	36	(1)
Naming Contexts and Application Partitions	37	(7)
Domain Naming Context	38	(1)
Configuration Naming Context	39	(1)
Schema Naming Context	40	(1)
Application Partitions	41	(2)
Summary	43	(1)
Active Directory Schema	44	(34)
Structure of the Schema	44	(6)
Attributes (attributeSchema Objects)	50	(4)
Attribute Properties	54	(10)
Classes (classSchema Objects)	64	(13)
Summary	77	(1)
Site Topology and Replication	78	(23)
Site Topology	78	(6)
Data Replication	84	(15)
Summary	99	(2)
Active Directory and DNS	101	(18)
DNS Fundamentals	101	(2)
DC Locator	103	(2)
Resource Records Used by Active Directory	105	(4)
Delegation Options	109	(5)
Active Directory Integrated DNS	114	(3)
Using Application Partitions for DNS	117	(1)
Summary	118	(1)
Profiles and Group Policy Primer	119	(30)
A Profile Primer	121	(5)
Capabilities of GPOs	126	(19)
Additional Resources	145	(1)
Summary	146	(3)
Part II. Designing an Active Directory Infrastructure
Designing the Namespace	149	(44)
The Complexities of a Design	150	(1)
Where to Start	151	(1)
Overview of the Design Process	152	(1)
Domain Namespace Design	153	(11)
Design of the Internal Domain Structure	164	(11)
Other Design Considerations	175	(1)
Design Examples	176	(11)
Designing for the Real World	187	(4)
Summary	191	(2)
Creating a Site Topology	193	(26)
Intrasite and Intersite Topologies	193	(13)
Designing Sites and Links for Replication	206	(6)
Examples	212	(5)
Additional Resources	217	(1)
Summary	217	(2)
Designing Organization-Wide Group Policies	219	(51)
How GPOs Work	219	(24)
Managing Group Policies	243	(7)
Using GPOs to Help Design the Organizational Unit Structure	250	(15)
Debugging Group Policies	265	(4)
Summary	269	(1)
Active Directory Security: Permissions and Auditing	270	(37)
Permission Basics	271	(8)
Using the GUI to Examine Permissions	279	(9)
Using the GUI to Examine Auditing	288	(1)
Designing Permission Schemes	289	(12)
Designing Auditing Schemes	301	(1)
Real-World Examples	302	(4)
Summary	306	(1)
Designing and Implementing Schema Extensions	307	(16)
Nominating Responsible People in Your Organization	308	(1)
Thinking of Changing the Schema	309	(5)
Creating Schema Extensions	314	(8)
Summary	322	(1)
Backup, Recovery, and Maintenance	323	(24)
Backing Up Active Directory	323	(4)
Restoring a Domain Controller	327	(5)
Restoring Active Directory	332	(6)
FSMO Recovery	338	(3)
DIT Maintenance	341	(5)
Summary	346	(1)
Upgrading to Windows Server 2003	347	(21)
New Features in Windows Server 2003	348	(3)
Differences with Windows 2000	351	(2)
Functional Levels Explained	353	(3)
Preparing for ADPrep	356	(4)
Upgrade Process	360	(4)
Post-Upgrade Tasks	364	(2)
Summary	366	(2)
Upgrading to Windows Server 2003 R2	368	(8)
New Active Directory Features in Windows Server 2003 Service Pack 1	369	(1)
Differences with Windows Server 2003	370	(1)
New Active Directory Features in Windows Server 2003 R2	371	(1)
Preparing for ADPrep	371	(2)
Service Pack 1 Upgrade Process	373	(1)
R2 Upgrade Process	374	(1)
Summary	375	(1)
Migrating from Windows NT	376	(10)
The Principles of Upgrading Windows NT Domains	376	(9)
Summary	385	(1)
Integrating Microsoft Exchange	386	(22)
A Quick Word About Exchange/AD Interaction	386	(1)
Preparing Active Directory for Exchange	387	(5)
Exchange 5.5 and the Active Directory Connector	392	(15)
Summary	407	(1)
Active Directory Application Mode (ADAM)	408	(43)
ADAM Terms	409	(1)
Differences Between AD and ADAM V1.0	410	(8)
ADAM R2 Updates	418	(2)
ADAM R2 Installation	420	(14)
Tools	434	(3)
ADAM Schema	437	(3)
Using ADAM	440	(9)
Summary	449	(2)
Interoperability, Integration, and Future Direction	451	(18)
Microsoft's Directory Strategy	451	(3)
Interoperating with Other Directories	454	(2)
Integrating Applications and Services	456	(9)
Summary	465	(4)
Part III. Scripting Active Directory with ADSI, ADO, and WMI
Scripting with ADSI	469	(22)
What Are All These Buzzwords?	469	(4)
Writing and Running Scripts	473	(3)
ADSI	476	(9)
Simple Manipulation of ADSI Objects	485	(4)
Further Information	489	(1)
Summary	490	(1)
IADs and the Property Cache	491	(29)
The IADs Properties	491	(10)
Manipulating the Property Cache	501	(16)
Checking for Errors in VBScript	517	(2)
Summary	519	(1)
Using ADO for Searching	520	(25)
The First Search	521	(5)
Other Ways of Connecting and Retrieving Results	526	(3)
Understanding Search Filters	529	(3)
Optimizing Searches	532	(7)
Advanced Search Function: SearchAD	539	(4)
Summary	543	(2)
Users and Groups	545	(25)
Creating a Simple User Account	545	(1)
Creating a Full-Featured User Account	546	(9)
Creating Many User Accounts	555	(3)
Modifying Many User Accounts	558	(2)
Account Unlocker Utility	560	(5)
Creating a Group	565	(1)
Adding Members to a Group	566	(2)
Evaluating Group Membership	568	(1)
Summary	569	(1)
Basic Exchange Tasks	570	(21)
Notes on Managing Exchange	570	(1)
Exchange Management Tools	571	(1)
Mail-Enabling Versus Mailbox-Enabling	571	(1)
Exchange Delegation	572	(2)
Mail-Enabling a User	574	(2)
Mail-Disabling a User	576	(1)
Creating and Mail-Enabling a Contact	577	(1)
Mail-Disabling a Contact	578	(1)
Mail-Enabling a Group (Distribution List)	578	(1)
Mail-Disabling a Group	579	(1)
Mailbox-Enabling a User	580	(2)
Mailbox-Disabling a User (Mailbox Deletion)	582	(1)
Purging a Disconnected Mailbox	582	(1)
Reconnecting a Disconnected Mailbox	583	(1)
Moving a Mailbox	584	(2)
Enumerating Disconnected Mailboxes	586	(1)
Viewing Mailbox Sizes and Message Counts	586	(1)
Viewing All Store Details of All Mailboxes on a Server	587	(1)
Dumping All Store Details of All Mailboxes on All Servers in Exchange Org	588	(2)
Summary	590	(1)
Shares and Print Queues	591	(25)
The Interface Methods and Properties	591	(2)
Creating and Manipulating Shares with ADSI	593	(2)
Enumerating Sessions and Resources	595	(11)
Manipulating Print Queues and Print Jobs	606	(9)
Summary	615	(1)
Permissions and Auditing	616	(36)
How to Create an ACE Using ADSI	616	(12)
A Simple ADSI Example	628	(2)
A Complex ADSI Example	630	(6)
Creating Security Descriptors	636	(6)
Listing the Security Descriptor of an Object	642	(9)
Summary	651	(1)
Extending the Schema and the Active Directory Snap-ins	652	(20)
Modifying the Schema with ADSI	652	(11)
Customizing the Active Directory Administrative Snap-ins	663	(7)
Summary	670	(2)
Using ADSI and ADO from ASP or VB	672	(41)
VBScript Limitations and Solutions	673	(1)
How to Avoid Problems When Using ADSI and ASP	674	(1)
Combining VBScript and HTML	674	(6)
Binding to Objects via Authentication	680	(11)
Incorporating Searches into ASP	691	(13)
Migrating Your ADSI Scripts from VBScript to VB	704	(8)
Summary	712	(1)
Scripting with WMI	713	(22)
Origins of WMI	714	(1)
WMI Architecture	714	(2)
Getting Started with WMI Scripting	716	(3)
WMI Tools	719	(2)
Manipulating Services	721	(3)
Querying the Event Logs	724	(3)
Querying AD with WMI	727	(2)
Monitoring Trusts	729	(3)
Monitoring Replication	732	(2)
Summary	734	(1)
Manipulating DNS	735	(18)
DNS Provider Overview	735	(2)
Manipulating DNS Server Configuration	737	(6)
Creating and Manipulating Zones	743	(4)
Creating and Manipulating Resource Records	747	(5)
Summary	752	(1)
Getting Started with VB.NET and System.Directory Services	753	(16)
The .NET Framework	753	(1)
Using VB.NET	754	(1)
Overview of System.DirectoryServices	755	(2)
DirectoryEntry Basics	757	(6)
Searching with DirectorySearcher	763	(1)
Manipulating Objects	764	(3)
Summary	767	(2)
Index	769