Active Directory Cookbook

Take the guesswork out of deploying, administering, and automating Active Directory. With hundreds of proven recipes, the updated edition of this popular cookbook provides quick, step-by-step solutions to common (and not so common) problems you might encounter when working with Microsoft's network directory service. This fourth edition includes troubleshooting recipes for Windows Server 2012, Windows 8, and Exchange 2013, based on valuable input from Windows administrators. You'll also find quick solutions for the Lightweight Directory Access Protocol (LDAP), Active Directory Lightweight Directory Services (AD LDS), multi-master replication, DNS, Group Policy, and many other features. Manage new AD features, such as the Recycle Bin, Group Managed Service Accounts, and fine-grained password policies Work with AD from the command line and use Windows PowerShell to automate tasks Remove and create forests, domains, and trusts Create groups, modify group scope and type, and manage membership Delegate control, view and modify permissions, and handle Kerberos tickets Import and export data with LDAP Data Interchange Format (LDIF) Synchronize multiple directories and enforce data integrity within a single or multiple stores Back up AD, and perform authoritative and non-authoritative restores

Autorentext

Brian Svidergol specializes in Microsoft infrastructure and cloud-based solutions around Windows, Active Directory, Microsoft Exchange, System Center, virtualization, and MDOP. He holds the MCT, MCITP (EA), MCITP (VA), MCITP (Exchange 2010), and several other Microsoft and industry certifications. Brian authored Microsoft Official Curriculum (MOC) course 6426C - Configuring and Troubleshooting Identity and Access Solutions with Windows Server 2008 Active Directory. He has also worked on Microsoft certification exam development and related training content for several years. When he isn't working on technology projects, he enjoys family time, basketball, and gaming.

Robbie Allen is a technical leader at Cisco Systems, where he has been involved in the deployment of Active Directory, DNS, DHCP, and several network management solutions. Robbie was named a Windows Server MVP in 2004 and 2005 for his contributions to the Windows community and the publication of several popular O'Reilly books. Robbie is currently studying at MIT in its system design and management program. For more information, see Robbie's web site at www.rallenhome.com.

Inhalt

Preface; Who Should Read This Book?; What's in This Book?; Conventions Used in This Book; Using Code Examples; Safari® Books Online; How to Contact Us; Acknowledgments; Chapter 1: Getting Started; 1.1 Approach to the Book; 1.2 Where to Find the Tools; 1.3 Getting Familiar with LDIF; 1.4 Replaceable Text; 1.5 Where to Find More Information; Chapter 2: Forests, Domains, and Trusts; 2.1 Introduction; 2.2 Creating a Forest; 2.3 Removing a Forest; 2.4 Creating a Domain; 2.5 Removing a Domain; 2.6 Removing an Orphaned Domain; 2.7 Finding the Domains in a Forest; 2.8 Finding the NetBIOS Name of a Domain; 2.9 Renaming a Domain; 2.10 Raising the Domain Functional Level to Windows Server 2012; 2.11 Raising the Functional Level of a Windows Server 2008 or 2008 R2 Forest; 2.12 Using AdPrep to Prepare a Domain or Forest for Windows Server 2012; 2.13 Determining Whether AdPrep Has Completed; 2.14 Checking Whether a Windows Domain Controller Can Be Upgraded to Windows Server 2003 or 2008; 2.15 Creating an External Trust; 2.16 Creating a Transitive Trust Between Two AD Forests; 2.17 Creating a Shortcut Trust Between Two AD Domains; 2.18 Creating a Trust to a Kerberos Realm; 2.19 Viewing the Trusts for a Domain; 2.20 Verifying a Trust; 2.21 Resetting a Trust; 2.22 Removing a Trust; 2.23 Enabling SID Filtering for a Trust; 2.24 Enabling Quarantine for a Trust; 2.25 Managing Selective Authentication for a Trust; 2.26 Finding Duplicate SIDs in a Domain; 2.27 Adding Additional Fields to Active Directory Users and Computers; Chapter 3: Domain Controllers, Global Catalogs, and FSMOs; 3.1 Introduction; 3.2 Promoting a Server to a Domain Controller; 3.3 Promoting a Server to a Read-Only Domain Controller; 3.4 Performing a Two-Stage RODC Installation; 3.5 Modifying the Password Replication Policy; 3.6 Promoting a Server to a Windows Server 2012 Domain Controller from Media; 3.7 Demoting a Domain Controller; 3.8 Automating the Promotion or Demotion of a Domain Controller; 3.9 Troubleshooting Domain Controller Promotion or Demotion Problems; 3.10 Verifying the Promotion of a Domain Controller; 3.11 Removing an Unsuccessfully Demoted Domain Controller; 3.12 Renaming a Domain Controller; 3.13 Finding the Domain Controllers for a Domain; 3.14 Finding the Closest Domain Controller; 3.15 Finding a Domain Controller's Site; 3.16 Moving a Domain Controller to a Different Site; 3.17 Finding the Services a Domain Controller Is Advertising; 3.18 Restoring a Deleted Domain Controller in Windows Server 2012; 3.19 Resetting the TCP/IP Stack on a Domain Controller; 3.20 Configuring a Domain Controller to Use an External Time Source; 3.21 Finding the Number of Logon Attempts Made Against a Domain Controller; 3.22 Enabling the /3GB Switch to Increase the LSASS Cache; 3.23 Enabling and Disabling the Global Catalog; 3.24 Determining Whether Global Catalog Promotion Is Complete; 3.25 Finding the Global Catalog Servers in a Forest; 3.26 Finding the Domain Controllers or Global Catalog Servers in a Site; 3.27 Finding Domain Controllers and Global Catalogs via DNS; 3.28 Changing the Preference for a Domain Controller; 3.29 Disabling the Global Catalog Requirement for User Logon; 3.30 Finding the FSMO Role Holders; 3.31 Transferring a FSMO Role; 3.32 Seizing a FSMO Role; 3.33 Finding the PDC Emulator FSMO Role Owner via DNS; Chapter 4: Searching and Manipulating Objects; 4.1 Introduction; 4.2 Viewing the RootDSE; 4.3 Viewing the Attributes of an Object; 4.4 Counting Objects in Active Directory; 4.5 Using LDAP Controls; 4.6 Using a Fast or Concurrent Bind; 4.7 Connecting to an Object GUID; 4.8 Connecting to a Well-Known GUID; 4.9 Searching for Objects in a Domain; 4.10 Searching the Global Catalog; 4.11 Searching for a Large Number of Objects; 4.12 Searching with an Attribute-Scoped Query; 4.13 Searching with a Bitwise Filter; 4.14 Creating an Object; 4.15 Modifying an Object; 4.16 Modifying a Bit-Flag Attribute; 4.17 Dynamically Linking an Auxiliary Class; 4.18 Creating a Dynamic Object; 4.19 Refreshing a Dynamic Object; 4.20 Modifying the Default TTL Settings for Dynamic Objects; 4.21 Moving an Object to a Different OU or Container; 4.22 Moving an Object to a Different Domain; 4.23 Referencing an External Domain; 4.24 Renaming an Object; 4.25 Deleting an Object; 4.26 Deleting a Container That Has Child Objects; 4.27 Viewing the Created and Last-Modified Timestamp of an Object; 4.28 Modifying the Default LDAP Query Policy; 4.29 Exporting Objects to an LDIF File; 4.30 Importing Objects Using an LDIF File; 4.31 Exporting Objects to a CSV File; 4.32 Importing Objects Using PowerShell and a CSV File; Chapter 5: Organizational Units; 5.1 Introduction; 5.2 Creating an OU; 5.3 Enumerating the OUs in a Domain; 5.4 Finding an OU; 5.5 Enumerating the Objects in an OU; 5.6 Deleting the Objects in an OU; 5.7 Deleting an OU; 5.8 Moving the Objects in an OU to a Different OU; 5.9 Moving an OU; 5.10 Renaming an OU; 5.11 Modifying an OU; 5.12 Determining Approximately How Many Child Objects an OU Has; 5.13 Delegating Control of an OU; 5.14 Assigning or Removing a Manager for an OU; 5.15 Linking a GPO to an OU; 5.16 Protecting an OU Against Accidental Deletion; Chapter 6: Users; 6.1 Introduction; 6.2 Modifying the Default Display Name Used When Creating Users in ADUC or ADAC; 6.3 Creating a User; 6.4 Creating a Large Number of Users; 6.5 Creating an inetOrgPerson User; 6.6 Converting a user Object to an inetOrgPerson Object (or Vice Versa); 6.…