ActiveDir.org

Considerations when using a domain-based service account with AD LDS

Tony Murray — Mon, 13 Apr 2009 20:39:00 GMT

When creating an AD LDS instance you are prompted to specify an account to use as the service account. At this point you can specify either the Network Service account or another account. Unless you have a particular need, you should choose the built-in Network Service account. If you opt for a domain-based service account you have to jump through a whole lot of hoops to get things working. Also, you typically end up giving your domain-based service account more permissions than are strictly necessary (as described later in this article). The Network Service account on the other hand provides an easy set up option and is a good choice from a security perspective given that the account has limited access to the local computer.

So why bother to use a domain-based service account at all? Well, if you have a number of services on your server all running under the context of the Network Service account there is potential for security compromise. In this scenario you may want to consider isolating the services from each other using dedicated service accounts.

What follows is a discussion of the steps required to configure AD LDS to use a domain-based service account.

Vbscript to determine domain and forest functional levels

Alexei Segundo — Wed, 08 Apr 2009 18:09:00 GMT

This script was created to help when raising domain and forest functional levels, especially in larger environments. The script uses an authoritative DC to enumerate all the DCs in the forest. Each DC is then contacted in turn to determine what it thinks is the current domain and forest functional level. The goal is to ensure that the information is consistent across DCs before raising the functional level, and to ensure that replication distributes the changes successfully after raising the functional level.

The (Almost) Definitive Active Directory Blogroll

Tony Murray — Sat, 01 Nov 2008 20:42:00 GMT

I subscribe to a number of Blogs with Active Directory content. As it took me a while to accumulate the list, I thought I would share it here.

Let me know if I have missed any out there that should be on this list.

LDAP tips #3: Searching for Computers

Tony Murray — Thu, 25 Sep 2008 21:57:00 GMT

This article is the third in a series providing tips for common LDAP searches.

Multiple Domain Forests: Still a Valid Design Model?

Tony Murray — Mon, 21 Jul 2008 13:52:00 GMT

On the ActiveDir.org list there has been some good discussion about whether the multi-domain forest is still considered a valid design option. This article attempts to crystallise the discussion for use as a reference for those involved with the design or review of forest models.

The general consensus is that single domain forests are now the preferred design option for all but the most marginal cases. Note that this does not preclude the use of multiple forests within a single organisation. For example, the use of the Exchange Resource forest in environments that have a distributed NOS architecture but a centralised messaging architecture is common in larger organisations.

Bulk Updates to Active Directory User Attributes

David Wiseman — Thu, 12 Jun 2008 14:52:00 GMT

Describes how to make bulk updates to Active Directory User Attributes using freeware tools (from WiseSoft.co.uk).

How to Enable, Disable and Maintain OCS 2007 (Office Communications Server) User Attributes using VBScript.

Matty Holland — Thu, 15 May 2008 15:51:00 GMT

This script will enable and configure Active Directory users for OCS 2007. This is an updated version of the re-written LCS reskit script published in article: How to Enable, Disable and Maintain LCS (Live Communications Server) User Attributes using VBScript.

How to delete corrupt mail items with MFCMAPI

Alexei Segundo — Mon, 21 Apr 2008 23:58:00 GMT

I recently encountered a situation where Outlook could not open two emails within a mailbox located within an Exchange mail store. Not only could I not open the items, I couldn’t move or delete them either. It was frustrating as it was causing some problems for an email archiving product.

I eventually managed to delete the two emails using the MFCMAPI tool. This article explains the method used and provides screenshots to guide you through the process.

Tracking LDAP Searches with Windows Server 2008 Reliability and Performance Monitor

Tony Murray — Tue, 26 Feb 2008 16:39:00 GMT

Windows Server 2008 ships with the Reliability and Performance Monitor (RPM) snap-in. On DCs, RPM incorporates an Active Directory Diagnostics feature that includes the abilility to track LDAP searches against a DC. The amount of information captured can be very useful when troubleshooting LDAP issues.

This article provides a step by step guide on how to use RPM to track LDAP searches.

Making bulk changes to Active Directory users with ADModify.NET

SuperUser Account — Tue, 18 Dec 2007 17:09:00 GMT

Provides a step-by-step tutorial of how to make bulk changes using the ADModify tool

ADMT v3 sets the "User must change password at next logon flag" on migrated user objects

SuperUser Account — Tue, 18 Dec 2007 17:03:00 GMT

This article describes an unexpected behaviour of ADMT v3 and how to work around it.

How to authenticate to Active Directory from Cisco IOS

SuperUser Account — Tue, 18 Dec 2007 17:00:00 GMT

This article describes the steps necessary to setup authentication and authorization to Active Directory from a Cisco device running IOS.

How to remove the Shared Folders feature of VMWare Tools

SuperUser Account — Tue, 18 Dec 2007 16:54:00 GMT

There are known problems with performing certain Active Directory tasks with DCs running on VMWare, such as DC promotion and trust establishment. This article provides instructions on how to remove the shared folder feature, which is part of VMWare Tools.

Logging LDAP searches: AD and ADAM

SuperUser Account — Tue, 18 Dec 2007 16:43:00 GMT

Have you ever wanted to log all LDAP searches against a Domain Controller or an ADAM instance? This article describes how to do this.

Enabling change notification for inter-site links

Tony Murray — Tue, 18 Dec 2007 16:37:00 GMT

If you have more than one AD site you may find that account lockouts and unlocks take some time to replicate to the remote site(s). This article explains why this can happen and shows how to enable change notification on inter-site links to allow the urgent replication of account lockout status.

Fun with Linked Attributes

SuperUser Account — Tue, 18 Dec 2007 11:04:00 GMT

Explains the concept of linked attributes, provides examples and shows where and how to find them in AD.

Moving FSMO roles from one DC to another DC

SuperUser Account — Tue, 18 Dec 2007 11:02:00 GMT

The article provides information about moving (transfering or seizing) FSMO roles from one DC to another DC

Creating a taskpad and delegating several admin tasks

SuperUser Account — Tue, 18 Dec 2007 11:01:00 GMT

This article provides some information on the delegation of certain tasks and on how to create a taskpad.

Increasing the "rIDAvailablePool" of the domain?

SuperUser Account — Tue, 18 Dec 2007 10:56:00 GMT

This articles describes how to increase the "rIDAvailablePool" of the domain

Failure to create trust relationship with virtual machines running VMWare

SuperUser Account — Tue, 18 Dec 2007 10:55:00 GMT

This article describes a general problem with VMWare when setting up a cross forest trust relationship.

Time synchronisation: the Type registry string value

SuperUser Account — Tue, 18 Dec 2007 10:52:00 GMT

This article describes the behaviour of one of the more important registry values relating to time synchronisation.

Active Directory FAQs

SuperUser Account — Tue, 18 Dec 2007 10:34:00 GMT

This FAQ attempts to answer some of the most common questions around the subject of Active Directory.

Automatically Bulk Add a Unique SMTP Email Address to Each NT User Account in a Domain

Wed, 28 Nov 2007 17:23:00 GMT

Problem: Your user accounts in Active Directory do not have an email address associated with them, you have a lot of user accounts, and you must get an SMTP address associated with the accounts immediately. This script will perform the AD Voodoo for you, automagically.

(Script + Tutorial) Fixing user accounts mistakenly created as system accounts - the UserAccountControl AD attribute

Wed, 28 Nov 2007 17:19:00 GMT

Managing and updating the UserAccountControl AD attribute to fix problem AD accounts through admin scripting

Non-scripting method for automated bulk-adding of AD users with SMTP mailbox address. Fast, simple

Wed, 28 Nov 2007 17:17:00 GMT

Fast, simple mass creation of domain user objects with SMTP mailbox addresses using DSADD.