List of Figures

Chapter 1: LDAP Basics

Figure 1.1: Search scopes for a domain object (which is the search base)

Chapter 4: Windows .NET DNS Server

Fig. 4.1: The DNS snap-in's main window containing a few authoritative zones

Fig. 4.2: An example of manually created zones

Fig. 4.3: Properties of a DNS zone on a Windows .NET DNS Server

Fig. 4.4: Zone types

Fig. 4.5: Zone replication scopes

Fig. 4.6: Creating dynamically updatable authoritative zones on a Windows .NET DNS server

Fig. 4.7: Authoritative DNS server for domain net.dom and the zones delegated to the dynamic DNS server NETDC1

Fig. 4.8: The name structure of all needed SRV records, shown on a dynamic DNS server

Fig. 4.9: Setting the DNS suffix of the computer

Chapter 5: Installing Active Directory

Fig. 5.1: Four scenarios for creating a new domain controller

Fig. 5.2: This window displays warnings about potential problems with the preferred DNS server

Fig. 5.3: At this point, you must decide whether or not to install the DNS server

Fig. 5.4: DNS diagnostics reveal name resolution problems for a future domain controller

Fig. 5.5: Failed DNS diagnostics for a server promoted to be an additional domain controller

Fig. 5.6: An example of a successful DNS test

Fig. 5.7: Restoring the System State to an alternate location

Fig. 5.8: Do not delete the last Global Catalog server without creating another GC server

Fig. 5.9: Deleting application directory partitions

Fig. 5.10: A sample domain structure that illustrates various trust types

Fig. 5.11: Various types of trusts existing in Active Directory forests

Fig. 5.12: The shortcut trust between two domains within the same forest

Fig. 5.13: Selecting the direction of the trust

Fig. 5.14: You can create a trust in either the local domain only or both domains at the same time

Fig. 5.15: You can delete a trust from either local domain only or from both domains at the same time

Fig. 5.16: This page allows you to create a transitive forest trust

Fig. 5.17: On this page, you will select the authentication scope for users from the target forest

Fig. 5.18: This window displays all external forests

Chapter 6: Configuring and Troubleshooting Active Directory Domains

Fig. 6.1: Default placement of FSMO role owners in a forest

Fig. 6.2: Some of the performance counters important for monitoring replication

Chapter 7: Domain Manipulation Tools

Fig. 7.1: Choosing necessary object attributes to be displayed

Fig. 7.2: Selecting the source of the commands for the new taskpad

Fig. 7.3: An example of a taskpad

Fig. 7.4: You may choose any domain in the forest to administer

Fig. 7.5: Selecting a controller within a domain

Fig. 7.6: A sample structure of saved queries

Fig. 7.7: An example of a new saved query

Fig. 7.8: The advanced view of a domain objects tree

Fig. 7.9: Browsing the entire domain tree may be tiresome or undesirable

Fig. 7.10: You can restrict browsing of both parent and child domains for clients and "hide" unnecessary objects from viewing

Fig. 7.11: The default view of a domain controller

Fig. 7.12: Using the Users, Groups, and Computers as containers mode for locating a published printer connected to the selected domain controller

Fig. 7.13: An example of a custom filter

Fig. 7.14: Finding objects in Active Directory

Fig. 7.15: Filtering the search results: among all administrators, we have selected those that belong to the ADMINs OU

Fig. 7.16: Appointing a profile and logon script to a number of users

Fig. 7.17: An example of a simple network with two sites

Fig. 7.18: Enabling universal group caching

Fig. 7.19: Selecting a domain for management in the enterprise (domain forest)

Fig. 7.20: Selecting functional level of a domain

Fig. 7.21: Raising forest functional level

Fig. 7.22: Adding an alternative UPN suffix

Fig. 7.23: Choosing UPN suffixes during new user creation

Fig. 7.24: A shortcut trust between two "remote" domains

Fig. 7.25: Connecting to a namespace

Fig. 7.26: Finding and editing an attribute of an Active Directory object

Fig. 7.27: This window contains the parameters necessary for creating a custom query

Fig. 7.28: The query that allows you to work with all published folders in the whole domain forest

Fig. 7.29: This message will appear if the DLL-file is registered successfully

Fig. 7.31: Properties of an attribute

Fig. 7.30: An example of creating a new string attribute

Fig. 7.32: The first step in creating a new object class

Fig. 7.33: In this window, you can add mandatory and optional attributes

Fig. 7.34: This window allows you to add auxiliary classes to a class and to define containers (possible superiors), in which objects of that class can be created

Fig. 7.35: A sample list of GPOs linked to a domain container

Fig. 7.36: In this window, you can see the entire structure of OUs in a domain as well as the GPOs linked to them

Fig. 7.37: Use this tab to quickly find a GPO that you want to link to the current container

Fig. 7.38: You can quickly verify whether the selected GPO is linked to other containers besides the current one

Fig. 7.39: This tab allows you to select a WMI filter and link it to the GPO selected

Fig. 7.40: Managing WMI filters

Fig. 7.41: These options determine which DC the Group Policy Object Editor snap-in selects at its startup

Fig. 7.42: The main window of new version of the Group Policy Object Editor snap in

Fig. 7.43: Filtering group policies in Windows .NET (default settings)

Chapter 8: Common Administrative Tasks

Fig. 8.1: By entering proper credentials in this window, you can start a program on behalf of another user

Fig. 8.2: Search for all printers in the enterprise (forest)

Fig. 8.3: Viewing all operation masters (the owners of FSMO roles) for a domain

Fig. 8.4: Triggering replication from a direct partner

Fig. 8.5: The result of using the Delegation of Control Wizard: the highlighted permission allows the Admins group to join computers to the domain and manage users in the Staff OU

Fig. 8.6: "Fine tuning" of permissions on the selected directory object

Fig. 8.7: Enabling auditing events related to access to Active Directory objects

Fig. 8.8: The default audit settings for the Users container

Fig. 8.9: Components of a domain controller's System State

Fig. 8.10: Configuring a backup operation

Fig. 8.11: Defining additional backup parameters

Fig. 8.12: Restoring the System State from a backup media

Fig. 8.13: This checkbox is only set for a primary restore

Fig. 8.14: Click No if you perform an authoritative restore

Fig. 8.15: Selecting an alternative location for a restore operation

Fig. 8.16: Structure of the SYSVOL folder in alternative location (for domain net.dom)

Chapter 11: Verifying Network and Distributed Services

Figure 11.1: This window informs you that the secure channel between two DCs in related domains is broken, but you can reset it

Figure 11.2: This window contains the result of a few successful pings

Figure 11.3: The main window of ReplMon, where you can browse the domain tree and see log files for selected domain partition and replication partner

Figure 11.4: Configuring counters that will comprise current performance data

Chapter 12: Manipulating Active Directory Objects

Fig. 12.1: Browsing the flat directory object namespace of a Windows NT 4.0 domain

Fig. 12.2: Browsing the object tree of a AD-based domain

Fig. 12.5: A sample query

Fig. 12.3: Basic information for a new browsing session

Fig. 12.4: Preparing a sample query: finding all OUs in the domain

Fig. 12.6: Connecting and binding to a LDAP server

Fig. 12.7: Connecting to an Active Directory server (Windows 2000- or Windows .NET-based domain controller) and viewing the object tree of the domain

Fig. 12.8: Default general options

Fig. 12.9: An example view of the Virtual List View window

Fig. 12.12: Configuring the search options for deleted objects

Fig. 12.10: In this window, you can see the entire domain structure (the forest) and the state of all DCs

Fig. 12.11: Primary search parameters

Fig. 12.13: Sorting search results on the name attribute

Fig. 12.14: The information necessary to change the UPN of a user

Fig. 12.15: Deleting a non-empty container (an OU in this case)

Fig. 12.16: A fragment of a security descriptor shown by using Ldp.exe

Fig. 12.17: Viewing the replication metadata for a directory object

Chapter 13: Migration and Directory Reorganization Tools

Fig. 13.1: The sIDHistory attribute allows a new object to retain the access permissions granted to the source object

Fig. 13.2: The cloned (or moved) object inherits the access rights of the source object

Fig. 13.3: Setting audit on the Windows 2000-based domain controllers

Fig. 13.4: Setting audit on a Windows NT 4.0-based domain controller

Fig. 13.5: The main window of ADMT

Fig. 13.6: Select the source and target domains

Fig. 13.7: In this window, you can easily select necessary user objects in a source container or in the entire domain

Fig. 13.8: With ADMT, you can either create new passwords for user accounts or migrate the existing passwords

Fig. 13.9: Selecting state of accounts and enabling SID migration

Fig. 13.10: Defining options for migrating accounts

Fig. 13.11: You can exclude some object properties from migration process

Fig. 13.12: Define ADMT's behavior in the case of name conflicts

Fig. 13.13: In this window, you can monitor events occurred during migration as well as view the operation results

Fig. 13.14: In this window, you can monitor the activity of all agents dispatched to remote computers

Fig. 13.15: Migrating domain trusts

Chapter 14: Security Tools

Fig. 14.1: The Kerberos Tray tool displays the time left on the initial TGT before it expires (left); the tool's context menu (right) allows you to select an operation

Fig. 14.2: In this window, you can see the information about all cached tickets and their properties

Chapter 15: Group Policy Tools

Fig. 15.1: An RSoP query will be executed for the selected user and computer

Fig. 15.2: The main window of the Resultant Set of Policy snap-in

Fig. 15.3: Viewing policy settings defined in different GPOs affecting the selected computer or user

Fig. 15.4: Precedence of GPOs

Fig. 15.5: Selecting user and computer objects for which policy settings will be simulated

Fig. 15.6: This page initially displays existing paths to the selected user and/or computer objects; you can change these paths

Fig. 15.7: Current group membership of the selected user

Chapter 16: Active Directory Service Interfaces (ADSI)

Fig. 16.1: Code Completion Assistant will help you to correctly select a method according to the object's definition

Fig. 16.2: Viewing the current values of variables in a script debugging session

Chapter 17: Scripting Administrative Tasks

Fig. 17.1: Performing interactive WMI queries using the Windows Management Instrumentation Tester

Fig. 17.2: Enumerating all WMI classes

Fig. 17.3: In this window, you can view mandatory and view/add optional attributes of an object class

Fig. 17.4: You can create objects of any class listed in this window