ActiveDir.org

Powershell script to measure DC LDAP query response times

Alexei Segundo — Mon, 01 Sep 2014 16:22:00 GMT

This Poweshell script uses a combination of the AD Powershell cmdlets, together with Powershell remoting to measure comparitive response times on each DC in the domain for the same LDAP query. The intention is that is useful for troubleshooting poor DC performance.

The LDAP query I use in the script is deliberately ineffecient and expensive. It assumes that the "description" attribute is not indexed (which it isn't by default). Feel free to modify the query to suit your AD environment.

Extract GPO Links from AD Snapshot

Alexei Segundo — Sat, 14 Apr 2012 16:20:00 GMT

Here's a short Powershell script that queries an AD snapshot to find the GPOs linked to an OU at a specific point in time.

Powershell 2.0 script to bulk create test user accounts

Tony Murray — Mon, 09 Nov 2009 09:35:00 GMT

This script uses Powershell 2.0 with the Windows Server 2008 R2 Active Directory service provider and CMDlets. Use the script to bulk create test user objects in AD.

How do I get to my external website when my AD domain internal name is the same as my external name? Or From inside the office, I can't get to http://domain.com, but can using http://www.domain.com after creating an "A" 'www' record.

Ace Fekay — Mon, 06 Jul 2009 10:51:00 GMT

Is your internal domain name and external domain name the same? If so, it's called a split zone.

This is a common dilemma resulting when the internal AD name and the external public names are the same. Users inside the office, including VPN users connected from an external location to the office, cannot get to their externally hosted website.

Considerations when using a domain-based service account with AD LDS

Tony Murray — Mon, 13 Apr 2009 09:39:00 GMT

When creating an AD LDS instance you are prompted to specify an account to use as the service account. At this point you can specify either the Network Service account or another account. Unless you have a particular need, you should choose the built-in Network Service account. If you opt for a domain-based service account you have to jump through a whole lot of hoops to get things working. Also, you typically end up giving your domain-based service account more permissions than are strictly necessary (as described later in this article). The Network Service account on the other hand provides an easy set up option and is a good choice from a security perspective given that the account has limited access to the local computer.

So why bother to use a domain-based service account at all? Well, if you have a number of services on your server all running under the context of the Network Service account there is potential for security compromise. In this scenario you may want to consider isolating the services from each other using dedicated service accounts.

What follows is a discussion of the steps required to configure AD LDS to use a domain-based service account.

Vbscript to determine domain and forest functional levels

Alexei Segundo — Wed, 08 Apr 2009 07:09:00 GMT

This script was created to help when raising domain and forest functional levels, especially in larger environments. The script uses an authoritative DC to enumerate all the DCs in the forest. Each DC is then contacted in turn to determine what it thinks is the current domain and forest functional level. The goal is to ensure that the information is consistent across DCs before raising the functional level, and to ensure that replication distributes the changes successfully after raising the functional level.

The (Almost) Definitive Active Directory Blogroll

Tony Murray — Sat, 01 Nov 2008 07:42:00 GMT

I subscribe to a number of Blogs with Active Directory content. As it took me a while to accumulate the list, I thought I would share it here.

Let me know if I have missed any out there that should be on this list.

LDAP tips #3: Searching for Computers

Tony Murray — Thu, 25 Sep 2008 10:57:00 GMT

This article is the third in a series providing tips for common LDAP searches.

Multiple Domain Forests: Still a Valid Design Model?

Tony Murray — Mon, 21 Jul 2008 02:52:00 GMT

On the ActiveDir.org list there has been some good discussion about whether the multi-domain forest is still considered a valid design option. This article attempts to crystallise the discussion for use as a reference for those involved with the design or review of forest models.

The general consensus is that single domain forests are now the preferred design option for all but the most marginal cases. Note that this does not preclude the use of multiple forests within a single organisation. For example, the use of the Exchange Resource forest in environments that have a distributed NOS architecture but a centralised messaging architecture is common in larger organisations.

Bulk Updates to Active Directory User Attributes

David Wiseman — Thu, 12 Jun 2008 03:52:00 GMT

Describes how to make bulk updates to Active Directory User Attributes using freeware tools (from WiseSoft.co.uk).

How to Enable, Disable and Maintain OCS 2007 (Office Communications Server) User Attributes using VBScript.

Matty Holland — Thu, 15 May 2008 04:51:00 GMT

This script will enable and configure Active Directory users for OCS 2007. This is an updated version of the re-written LCS reskit script published in article: How to Enable, Disable and Maintain LCS (Live Communications Server) User Attributes using VBScript.

How to delete corrupt mail items with MFCMAPI

Alexei Segundo — Mon, 21 Apr 2008 12:58:00 GMT

I recently encountered a situation where Outlook could not open two emails within a mailbox located within an Exchange mail store. Not only could I not open the items, I couldn’t move or delete them either. It was frustrating as it was causing some problems for an email archiving product.

I eventually managed to delete the two emails using the MFCMAPI tool. This article explains the method used and provides screenshots to guide you through the process.

Tracking LDAP Searches with Windows Server 2008 Reliability and Performance Monitor

Tony Murray — Tue, 26 Feb 2008 03:39:00 GMT

Windows Server 2008 ships with the Reliability and Performance Monitor (RPM) snap-in. On DCs, RPM incorporates an Active Directory Diagnostics feature that includes the abilility to track LDAP searches against a DC. The amount of information captured can be very useful when troubleshooting LDAP issues.

This article provides a step by step guide on how to use RPM to track LDAP searches.

Making bulk changes to Active Directory users with ADModify.NET

SuperUser Account — Tue, 18 Dec 2007 04:09:00 GMT

Provides a step-by-step tutorial of how to make bulk changes using the ADModify tool

ADMT v3 sets the "User must change password at next logon flag" on migrated user objects

SuperUser Account — Tue, 18 Dec 2007 04:03:00 GMT

This article describes an unexpected behaviour of ADMT v3 and how to work around it.

How to authenticate to Active Directory from Cisco IOS

SuperUser Account — Tue, 18 Dec 2007 04:00:00 GMT

This article describes the steps necessary to setup authentication and authorization to Active Directory from a Cisco device running IOS.

How to remove the Shared Folders feature of VMWare Tools

SuperUser Account — Tue, 18 Dec 2007 03:54:00 GMT

There are known problems with performing certain Active Directory tasks with DCs running on VMWare, such as DC promotion and trust establishment. This article provides instructions on how to remove the shared folder feature, which is part of VMWare Tools.

Logging LDAP searches: AD and ADAM

SuperUser Account — Tue, 18 Dec 2007 03:43:00 GMT

Have you ever wanted to log all LDAP searches against a Domain Controller or an ADAM instance? This article describes how to do this.

Enabling change notification for inter-site links

Tony Murray — Tue, 18 Dec 2007 03:37:00 GMT

If you have more than one AD site you may find that account lockouts and unlocks take some time to replicate to the remote site(s). This article explains why this can happen and shows how to enable change notification on inter-site links to allow the urgent replication of account lockout status.

Fun with Linked Attributes

SuperUser Account — Mon, 17 Dec 2007 22:04:00 GMT

Explains the concept of linked attributes, provides examples and shows where and how to find them in AD.

Moving FSMO roles from one DC to another DC

SuperUser Account — Mon, 17 Dec 2007 22:02:00 GMT

The article provides information about moving (transfering or seizing) FSMO roles from one DC to another DC

Creating a taskpad and delegating several admin tasks

SuperUser Account — Mon, 17 Dec 2007 22:01:00 GMT

This article provides some information on the delegation of certain tasks and on how to create a taskpad.

Increasing the "rIDAvailablePool" of the domain?

SuperUser Account — Mon, 17 Dec 2007 21:56:00 GMT

This articles describes how to increase the "rIDAvailablePool" of the domain

Failure to create trust relationship with virtual machines running VMWare

SuperUser Account — Mon, 17 Dec 2007 21:55:00 GMT

This article describes a general problem with VMWare when setting up a cross forest trust relationship.

Time synchronisation: the Type registry string value

SuperUser Account — Mon, 17 Dec 2007 21:52:00 GMT

This article describes the behaviour of one of the more important registry values relating to time synchronisation.