I have published a 5 part blog series on the Norwegian Microsoft TechNet Blog, with step by step instructions for setting up integration between your on-premise Window Server Active Directory Directory Service and Windows Azure Active Directory. It covers concepts, single-sign on with ADFS, Directory Synchronization with the DirSync Tool and troubleshooting. So if you …
Category Archives: Active Directory
Official Active Directory blogs
I though I would just remind everyone about Microsoft’s official Active Directory (and related) blogs. These are great places to get good technical info about AD directly from the source. Check them out! Active Directory Blog Ask the Directory Services Team Blog Group Policy Blog Windows PKI blog Happy reading!
Enabling notify-driven replication across Active Directory sites
Introduction Active Directory sites, site links and site link bridges exist to be able to tell the directory service about the network’s physical topology. Specifically to identiy which parts of it are well connected and where there are slow WAN links. The rule of thumb here is that all systems that are connected with at …
Continue reading “Enabling notify-driven replication across Active Directory sites”
Letting go of Windows NT 4.0…
Windows Server 2008 R2 Domain Controllers have left Windows NT 4.0 behind. Windows Server 2008 would still let the old guy play along, but no more. This fact is not apparant until you start to look closer: DCPromo in Windows Server 2008 R2 will not let you select Windows 2000 mixed mode for your domain functional level. …
Poor-man’s Active Directory backups (export really)
Sometimes I need a “copy” of an Active Directory domain, partition or LDS instance. Usually this is when I remove decomissioned domains in a multi-domain forest and want to keep a record of what was left when I deleted it. You can do this With LDIFDE.EXE. Here is an example command to make a full …
Continue reading “Poor-man’s Active Directory backups (export really)”
Script to find outdated computer objects in Active Directory
Computers have accounts in Active Directory and log on just as user accounts do. The “user name” of a computer is its name with a dollar sign appended, e.g: MYPC1$. The password is set by the machine when it is joined to the domain and changed every 30 days by the machine. Just as with …
Continue reading “Script to find outdated computer objects in Active Directory”
Exploring the Global Catalog and examining the “universalness” of Universal Groups
Universal groups (UG) are stored in the Global Catalog (GC). But what exactly is the Global Catalog, and how does it store objects? Does it store anything at all! And how do Universal Groups work anyway? Active Directory Domain Controllers (DC) have exactly one database. It is stored in %windir%NTDS and is called NTDS.DIT. DIT …
Some Active Directory Migration Tool (ADMT) Notes
The good old Active Directory Migration Tool (ADMT) has reached version 3.2 making it compatible with Windows 7/Server 2008 R2 and x64. ADMT started it’s Microsoft life as licensed software from One point. I’ve been using this baby since version 2.0. It offers what you need to perform intra or inter-forest Active Directory migrations/restructures, but …
Continue reading “Some Active Directory Migration Tool (ADMT) Notes”
Some SID Filtering Notes
SID Filtering is also known as Quarantine, Domain Quarantine, or SID Filtering Quarantine. SID Filtering only applies to trusts, it cannot be enabled within a domain. SID Filtering, by default, is not active on automatically created trusts within a forest. You can enable it, but not if the forest functional level is below Windows Server …
AdminSDHolder, Protected Groups, SDProp and moving mailboxes in Exchange
When you move a mailbox in Exchange 2000 or newer, you sometimes encounter an error saying that you have insufficient permissions to move the mailbox. Although that may be the case, usually this error is caused by the user object associated with the mailbox you are trying to move not having inheritable permissions enabled in …
Continue reading “AdminSDHolder, Protected Groups, SDProp and moving mailboxes in Exchange”