Active Directory Cookbook - Brossura

Allen, Robbie

Brossura

ISBN 10: 0596004648 ISBN 13: 9780596004644

Casa editrice: Oreilly & Associates Inc, 2003

Riassunto

Those of you who run networks on Windows 2000 know the benefits of using Active Directory for managing user information and permissions. You also know what a bear it can be. The newer version included with Windows Server 2003 has over 100 new and updated features to simplify deployment, but once it's in place many system administrators still find Active Directory challenging. If you're among those looking for practical hands-on support, help is here with our new Active Directory Cookbook for Windows Server 2003 & Windows 2000, a unique problem-solving guide that offers quick answers for both versions of the directory.The book contains hundreds of step-by-step solutions for both common and uncommon problems that you might encounter with Active Directory on a daily basis--including recipes to deal with the Lightweight Directory Access Protocol (LDAP), multi-master replication, Domain Name System (DNS), Group Policy, the Active Directory Schema, and many other features. Author Robbie Allen, a Senior Systems Architect at Cisco Systems and co-author of our Active Directory tutorial, based this collection of troubleshooting recipes on his own experience, along with input from Windows administrators throughout the industry. Each recipe includes a discussion to explain how and why the solution works, so you can adapt the problem-solving techniques to similar situations.If your company is considering an upgrade from Windows NT or 2000 to Windows Server 2003, the Active Directory Cookbook for Windows Server 2003 & Windows 2000 will help reduce the time and trouble it takes to configure and deploy Active Directory for your network.This Cookbook is also a perfect companion to Active Directory, the tutorial that experts hail as the best source for understanding Microsoft's network directory service. While Active Directory provides the big picture, Active Directory Cookbook for Windows Server 2003 & Windows 2000 gives you the quick solutions you need to cope with day-to-day dilemmas. Together, these books supply the knowledge and tools so you can get the most out of Active Directory to manage users, groups, computers, domains, organizational units, and security policies on your network.

Su questo libro

L'autore

Robbie Allen is a Senior Systems Architect in the Advanced Services Technology Group at Cisco Systems. He was instrumental in the deployment and automation of Active Directory, DNS, and DHCP at Cisco. Robbie enjoys working on the Unix and Windows platforms, especially when Perl is installed. He is a firm believer that all system administrators should be proficient in at least one scripting language and most of his writings preach the benefits of automation. Robbie has a web site at www.rallenhome.com.

Contenuti

Foreword; Preface; Who Should Read This Book?; What’s in This Book?; Conventions Used in This Book; We’d Like Your Feedback!; Acknowledgments; Chapter 1: Getting Started; 1.1 Approach to the Book; 1.2 Where to Find the Tools; 1.3 Getting Familiar with LDIF; 1.4 Programming Notes; 1.5 Replaceable Text; 1.6 Where to Find More Information; Chapter 2: Forests, Domains, and Trusts; 2.1 Introduction; 2.2 Creating a Forest; 2.3 Removing a Forest; 2.4 Creating a Domain; 2.5 Removing a Domain; 2.6 Removing an Orphaned Domain; 2.7 Finding the Domains in a Forest; 2.8 Finding the NetBIOS Name of a Domain; 2.9 Renaming a Domain; 2.10 Changing the Mode of a Domain; 2.11 Using ADPrep to Prepare a Domain or Forest for Windows Server 2003; 2.12 Determining if ADPrep Has Completed; 2.13 Checking Whether a Windows 2000 Domain Controller Can Be Upgraded to Windows Server 2003; 2.14 Raising the Functional Level of a Windows Server 2003 Domain; 2.15 Raising the Functional Level of a Windows Server 2003 Forest; 2.16 Creating a Trust Between a Windows NT Domain and an AD Domain; 2.17 Creating a Transitive Trust Between Two AD Forests; 2.18 Creating a Shortcut Trust Between Two AD Domains; 2.19 Creating a Trust to a Kerberos Realm; 2.20 Viewing the Trusts for a Domain; 2.21 Verifying a Trust; 2.22 Resetting a Trust; 2.23 Removing a Trust; 2.24 Enabling SID Filtering for a Trust; 2.25 Finding Duplicate SIDs in a Domain; Chapter 3: Domain Controllers, Global Catalogs, and FSMOs; 3.1 Introduction; 3.2 Promoting a Domain Controller; 3.3 Promoting a Domain Controller from Media; 3.4 Demoting a Domain Controller; 3.5 Automating the Promotion or Demotion of a Domain Controller; 3.6 Troubleshooting Domain Controller Promotion or Demotion Problems; 3.7 Removing an Unsuccessfully Demoted Domain Controller; 3.8 Renaming a Domain Controller; 3.9 Finding the Domain Controllers for a Domain; 3.10 Finding the Closest Domain Controller; 3.11 Finding a Domain Controller’s Site; 3.12 Moving a Domain Controller to a Different Site; 3.13 Finding the Services a Domain Controller Is Advertising; 3.14 Configuring a Domain Controller to Use an External Time Source; 3.15 Finding the Number of Logon Attempts Made Against a Domain Controller; 3.16 Enabling the /3GB Switch to Increase the LSASS Cache; 3.17 Cleaning Up Distributed Link Tracking Objects; 3.18 Enabling and Disabling the Global Catalog; 3.19 Determining if Global Catalog Promotion Is Complete; 3.20 Finding the Global Catalog Servers in a Forest; 3.21 Finding the Domain Controllers or Global Catalog Servers in a Site; 3.22 Finding Domain Controllers and Global Catalogs via DNS; 3.23 Changing the Preference for a Domain Controller; 3.24 Disabling the Global Catalog Requirement During a Windows 2000 Domain Login; 3.25 Disabling the Global Catalog Requirement During a Windows 2003 Domain Login; 3.26 Finding the FSMO Role Holders; 3.27 Transferring a FSMO Role; 3.28 Seizing a FSMO Role; 3.29 Finding the PDC Emulator FSMO Role Owner via DNS; Chapter 4: Searching and Manipulating Objects; 4.1 Introduction; 4.2 Viewing the RootDSE; 4.3 Viewing the Attributes of an Object; 4.4 Using LDAP Controls; 4.5 Using a Fast or Concurrent Bind; 4.6 Searching for Objects in a Domain; 4.7 Searching the Global Catalog; 4.8 Searching for a Large Number of Objects; 4.9 Searching with an Attribute-Scoped Query; 4.10 Searching with a Bitwise Filter; 4.11 Creating an Object; 4.12 Modifying an Object; 4.13 Modifying a Bit-Flag Attribute; 4.14 Dynamically Linking an Auxiliary Class; 4.15 Creating a Dynamic Object; 4.16 Refreshing a Dynamic Object; 4.17 Modifying the Default TTL Settings for Dynamic Objects; 4.18 Moving an Object to a Different OU or Container; 4.19 Moving an Object to a Different Domain; 4.20 Renaming an Object; 4.21 Deleting an Object; 4.22 Deleting a Container That Has Child Objects; 4.23 Viewing the Created and Last Modified Timestamp of an Object; 4.24 Modifying the Default LDAP Query Policy; 4.25 Exporting Objects to an LDIF File; 4.26 Importing Objects Using an LDIF File; 4.27 Exporting Objects to a CSV File; 4.28 Importing Objects Using a CSV File; Chapter 5: Organizational Units; 5.1 Introduction; 5.2 Creating an OU; 5.3 Enumerating the OUs in a Domain; 5.4 Enumerating the Objects in an OU; 5.5 Deleting the Objects in an OU; 5.6 Deleting an OU; 5.7 Moving the Objects in an OU to a Different OU; 5.8 Moving an OU; 5.9 Determining How Many Child Objects an OU Has; 5.10 Delegating Control of an OU; 5.11 Allowing OUs to Be Created Within Containers; 5.12 Linking a GPO to an OU; Chapter 6: Users; 6.1 Introduction; 6.2 Creating a User; 6.3 Creating a Large Number of Users; 6.4 Creating an inetOrgPerson User; 6.5 Modifying an Attribute for Several Users at Once; 6.6 Moving a User; 6.7 Renaming a User; 6.8 Copying a User; 6.9 Unlocking a User; 6.10 Finding Locked Out Users; 6.11 Troubleshooting Account Lockout Problems; 6.12 Viewing the Account Lockout and Password Policies; 6.13 Enabling and Disabling a User; 6.14 Finding Disabled Users; 6.15 Viewing a User’s Group Membership; 6.16 Changing a User’s Primary Group; 6.17 Transferring a User’s Group Membership to Another User; 6.18 Setting a User’s Password; 6.19 Setting a User’s Password via LDAP; 6.20 Setting a User’s Password via Kerberos; 6.21 Preventing a User from Changing His Password; 6.22 Requiring a User to Change Her Password at Next Logon; 6.23 Preventing a User’s Password from Expiring; 6.24 Finding Users Whose Passwords Are About to Expire; 6.25 Setting a User’s Account Options (userAccountControl); 6.26 Setting a User’s Account to Expire in the Future; 6.27 Finding Users Whose AccountsAre About to Expire; 6.28 Determining a User’s Last Logon Time; 6.29 Finding Users Who Have Not Logged On Recently; 6.30 Setting a User’s Profile Attributes; 6.31 Viewing a User’s Managed Objects; 6.32 Modifying the Default Display Name Used When Creating Users in ADUC; 6.33 Creating a UPN Suffix for a Forest; Chapter 7: Groups; 7.1 Introduction; 7.2 Creating a Group; 7.3 Viewing the Direct Members of a Group; 7.4 Viewing the Nested Members of a Group; 7.5 Adding and Removing Members of a Group; 7.6 Moving a Group; 7.7 Changing the Scope or Type of a Group; 7.8 Delegating Control for Managing Membership of a Group; 7.9 Resolving a Primary Group ID; 7.10 Enabling Universal Group Membership Caching; Chapter 8: Computers; 8.1 Introduction; 8.2 Creating a Computer; 8.3 Creating a Computer for a Specific User or Group; 8.4 Joining a Computer to a Domain; 8.5 Moving a Computer; 8.6 Renaming a Computer; 8.7 Testing the Secure Channel for a Computer; 8.8 Resetting a Computer; 8.9 Finding Inactive or Unused Computers; 8.10 Changing the Maximum Number of Computers a User Can Join to the Domain; 8.11 Finding Computers with a Particular OS; 8.12 Binding to the Default Container for Computers; 8.13 Changing the Default Container for Computers; Chapter 9: Group Policy Objects (GPOs); 9.1 Introduction; 9.2 Finding the GPOs in a Domain; 9.3 Creating a GPO; 9.4 Copying a GPO; 9.5 Deleting a GPO; 9.6 Viewing the Settings of a GPO; 9.7 Modifying the Settings of a GPO; 9.8 Importing Settings into a GPO; 9.9 Assigning Logon/Logoff and Startup/Shutdown Scripts in a GPO; 9.10 Installing Applications with a GPO; 9.11 Disabling the User or Computer Settings in a GPO; 9.12 Listing the Links for GPO; 9.13 Creating a GPO Link to an OU; 9.14 Blocking Inheritance of GPOs on an OU; 9.15 Applying a Security Filter to a GPO; 9.16 Creating a WMI Filter; 9.17 Applying a WMI Filter to a GPO; 9.18 Backing Up a GPO; 9.19 Restoring a GPO; 9.20 Simulating the RSoP; 9.21 Viewing the RSoP; 9.22 Refreshing GPO Settings on a Computer; 9.23 Restoring a Default GPO; Chapter 10: Schema; 10.1 Introduction; 10.2 Registering the Active Directory Schema MMC Snap-in; 10.3 Enabling Schema Updates; 10.4 Generating an OID to Use for a New Class or Attribute; 10.5 Generating a GUID to Use for a New Class or Attribute; 10.6 Extending the Schema; 10.7 Documenting Schema Extensions; 10.8 Adding a New Attribute; 10.9 Viewing an Attribute; 10.10 Adding a New Class; 10.11 Viewing a Class; 10.12 Indexing an Attribute; 10.13 Modifying the Attributes That Are Copied When Duplicating a User; 10.14 Modifying the Attributes Included with Ambiguous Name Resolution; 10.15 Adding or Removing an Attribute in the Global Catalog; 10.16 Finding the Nonreplicated and Constructed Attributes; 10.17 Finding the Linked Attributes; 10.18 Finding the Structural, Auxiliary, Abstract, and 88 Classes; 10.19 Finding the Mandatory and Optional Attributes of a Class; 10.20 Modifying the Default Security of a Class; 10.21 Deactivating Classes and Attributes; 10.22 Redefining Classes and Attributes; 10.23 Reloading the Schema Cache; Chapter 11: Site Topology; 11.1 Introduction; 11.2 Creating a Site; 11.3 Listing the Sites; 11.4 Deleting a Site; 11.5 Creating a Subnet; 11.6 Listing the Subnets; 11.7 Finding Missing Subnets; 11.8 Creating a Site Link; 11.9 Finding the Site Links for a Site; 11.10 Modifying the Sites That Are Part of a Site Link; 11.11 Modifying the Cost for a Site Link; 11.12 Disabling Site Link Transitivity or Site Link Schedules; 11.13 Creating a Site Link Bridge; 11.14 Finding the Bridgehead Servers for a Site; 11.15 Setting a Preferred Bridgehead Server for a Site; 11.16 Listing the Servers; 11.17 Moving a Domain Controller to a Different Site; 11.18 Configuring a Domain Controller to Cover Multiple Sites; 11.19 Viewing the Site Coverage for a Domain Controller; 11.20 Disabling Automatic Site Coverage for a Domain Controller; 11.21 Finding the Site for a Client; 11.22 Forcing a Host to a Particular Site; 11.23 Creating a Connection Object; 11.24 Listing the Connection Objects for a Server; 11.25 Load-Balancing Connection Objects; 11.26 Finding the ISTG for a Site; 11.27 Transferring the ISTG to Another Server; 11.28 Triggering the KCC; 11.29 Determining if the KCC Is Completing Successfully; 11.30 Disabling the KCC for a Site; 11.31 Changing the Interval at Which the KCC Runs; Chapter 12: Replication; 12.1 Introduction; 12.2 Determining if Two Domain Controllers Are in Sync; 12.3 Viewing the Replication Status of Several Domain Controllers; 12.4 Viewing Unreplicated Changes Between Two Domain Controllers; 12.5 Forcing Replication from One Domain Controller to Another; 12.6 Changing the Intra-Site Replication Interval; 12.7 Changing the Inter-Site Replication Interval; 12.8 Disabling Inter-Site Compression of Replication Traffic; 12.9 Checking for Potential Replication Problems; 12.10 Enabling Enhanced Logging of Replication Events; 12.11 Enabling Strict or Loose Replication Consistency; 12.12 Finding Conflict Objects; 12.13 Viewing Object Metadata; Chapter 13: Domain Name System (DNS); 13.1 Introduction; 13.2 Creating a Forward Lookup Zone; 13.3 Creating a Reverse Lookup Zone; 13.4 Viewing a Server’s Zones; 13.5 Converting a Zone to an AD-Integrated Zone; 13.6 Moving AD-Integrated Zones into an Application Partition; 13.7 Delegating Control of a Zone; 13.8 Creating and Deleting Resource Records; 13.9 Querying Resource Records; 13.10 Modifying the DNS Server Configuration; 13.11 Scavenging Old Resource Records; 13.12 Clearing the DNS Cache; 13.13 Verifying That a Domain Controller Can Register Its Resource Records; 13.14 Registering a Domain Controller’s Resource Records; 13.15 Preventing a Domain Controller from Dynamically Registering All Resource Records; 13.16 Preventing a Domain Controller from Dynamically Registering Certain Resource Records; 13.17 Deregistering a Domain Controller’s Resource Records; 13.18 Allowing Computers to Use a Different Domain Suffix from Their AD Domain; Chapter 14: Security and Authentication; 14.1 Introduction; 14.2 Enabling SSL/TLS; 14.3 Encrypting LDAP Traffic with SSL, TLS, or Signing; 14.4 Enabling Anonymous LDAP Access; 14.5 Restricting Hosts from Performing LDAP Queries; 14.6 Using the Delegation of Control Wizard; 14.7 Customizing the Delegation of Control Wizard; 14.8 Viewing the ACL for an Object; 14.9 Customizing the ACL Editor; 14.10 Viewing the Effective Permissions on an Object; 14.11 Changing the ACL of an Object; 14.12 Changing the Default ACL for an Object Class in the Schema; 14.13 Comparing the ACL of an Object to the Default Defined in the Schema; 14.14 Resetting an Object’s ACL to the Default Defined in the Schema; 14.15 Preventing the LM Hash of a Password from Being Stored; 14.16 Enabling List Object Access Mode; 14.17 Modifying the ACL on Administrator Accounts; 14.18 Viewing and Purging Your Kerberos Tickets; 14.19 Forcing Kerberos to Use TCP; 14.20 Modifying Kerberos Settings; Chapter 15: Logging, Monitoring, and Quotas; 15.1 Introduction; 15.2 Enabling Extended dcpromo Logging; 15.3 Enabling Diagnostics Logging; 15.4 Enabling NetLogon Logging; 15.5 Enabling GPO Client Logging; 15.6 Enabling Kerberos Logging; 15.7 Enabling DNS Server Debug Logging; 15.8 Viewing DNS Server Performance Statistics; 15.9 Enabling Inefficient and Expensive LDAP Query Logging; 15.10 Using the STATS Control to View LDAP Query Statistics; 15.11 Using Perfmon to Monitor AD; 15.12 Using Perfmon Trace Logs to Monitor AD; 15.13 Enabling Auditing of Directory Access; 15.14 Creating a Quota; 15.15 Finding the Quotas Assigned to a Security Principal; 15.16 Changing How Tombstone Objects Count Against Quota Usage; 15.17 Setting the Default Quota for All Security Principals in a Partition; 15.18 Finding the Quota Usage for a Security Principal; Chapter 16: Backup, Recovery, DIT Maintenance, and Deleted Objects; 16.1 Introduction; 16.2 Backing Up Active Directory; 16.3 Restarting a Domain Controller in Directory Services Restore Mode; 16.4 Resetting the Directory Service Restore Mode Administrator Password; 16.5 Performing a Nonauthoritative Restore; 16.6 Performing an Authoritative Restore of an Object or Subtree; 16.7 Performing a Complete Authoritative Restore; 16.8 Checking the DIT File’s Integrity; 16.9 Moving the DIT Files; 16.10 Repairing or Recovering the DIT; 16.11 Performing an Online Defrag Manually; 16.12 Determining How Much Whitespace Is in the DIT; 16.13 Performing an Offline Defrag to Reclaim Space; 16.14 Changing the Garbage Collection Interval; 16.15 Logging the Number of Expired Tombstone Objects; 16.16 Determining the Size of the Active Directory Database; 16.17 Searching for Deleted Objects; 16.18 Restoring a Deleted Object; 16.19 Modifying the Tombstone Lifetime for a Domain; Chapter 17: Application Partitions; 17.1 Introduction; 17.2 Creating and Deleting an Application Partition; 17.3 Finding the Application Partitions in a Forest; 17.4 Adding or Removing a Replica Server for an Application Partition; 17.5 Finding the Replica Servers for an Application Partition; 17.6 Finding the Application Partitions Hosted by a Server; 17.7 Verifying Application Partitions Are Instantiated on a Server Correctly; 17.8 Setting the Replication Notification Delay for an Application Partition; 17.9 Setting the Reference Domain for an Application Partition; 17.10 Delegating Control of Managing an Application Partition; Chapter 18: Interoperability and Integration; 18.1 Introduction; 18.2 Accessing AD from a Non-Windows Platform; 18.3 Programming with .NET; 18.4 Programming with DSML; 18.5 Programming with Perl; 18.6 Programming with Java; 18.7 Programming with Python; 18.8 Integrating with MIT Kerberos; 18.9 Integrating with Samba; 18.10 Integrating with Apache; 18.11 Replacing NIS; 18.12 Using BIND for DNS; 18.13 Authorizing a Microsoft DHCP Server; 18.14 Using VMWare for Testing AD; Tool List; Colophon;

Dettagli dell?edizione

• Editore: Oreilly & Associates Inc
• Data di pubblicazione: 2003
• ISBN 10: 0596004648
• ISBN 13: 9780596004644
• Rilegatura: Copertina flessibile
• Lingua: Inglese
• Numero di pagine: 600