Check the server IP address from multiple servers

Check the DC IP address from multiple DC's


Some time we have to check one server DNS IP address from many domain controllers, we can use this command, please enter the list of server in list.txt

 

for /f %a in (list.txt) do nslookup server name %a

exg:

for /f %a in (list.txt) do nslookup test0001 %a


This command will check the server IP adress from the list of DNS servers, some DNS server or DC have the wrong IP adress due to replication issue or DNS island issue, To resolve DNS island issue

I have used this command while the DNS island issue, to check the current registered DNS entry for the affected domain controller from other domain controllers, through this way you can confirm the correct DNS registration for that server, if you want to check the current registered server IP address from multiple servers than this command is very useful, for one or two servers you can check manually one by one.

Account lockout

Account lockout

Account lockout is the most common issue in windows environment, I will discuss about the frequent account lock out issues and how to troubleshoot frequent account lockout issue


In a windows 2000/2003 domain environment if the password and account lockout policy enabled, then according to the lock out policy if the user wrongly type the password for more then 3 or 5 times, account will be lockout

It should be unlocked automatically another 30 min (depending on account lockout policy) for the frequent account lockout issue, follow the below account lockout troubleshoot steps

Use the below procedure for troubleshoot frequent account lockout issue

Login to any of member server and using DSQUERY command to find the complete DN of the lockout Account

Syntex:

dsquery user –name username

Example:

dsquery user -name testuser

"CN=testuser,OU=Test,DC=test,DC=com"

Login to any one of Domain controller and using replmon utility and using the Full CN name, find the B server which has finally authenticated the Lockout of the User Account.

In replmon right click the server and select the “Show attribute meta-data for active directory object” copy the DN of the user then click OK


Or


Login to any one of Domain controller and use the below command to find the “lockout time” attribute change

Syntex:

Repadmin /showmeta “user DN”

Example:


Repadmin /showmeta "CN=testuser,OU=Test,DC=test,DC=com"


This will show the Meta data of the users, you can find the “lockout time” attribute change, from which Domain controller this attribute is changed, note the Domain controller name.

Or use the below command with find

Repadmin /showmeta "CN=testuser,OU=Test,DC=test,DC=com"  | find /i "lockout time"

Login to the Domain controller and use the dumpel command to extract the latest events, or check event viewer manually on the DC


Dumpel -f c:\lockoutevents.txt -s test001 -l security -m security -e 6
44 642 529 539
Dump successfully completed.


Check the lockoutevents.txt file for the affected user; you will be able to find the account lockout event, you able to find the system from which the account has been lockout

Causes:

• Check if your user ID is being used to start/stop some services on affected system
• Check your user ID is being logging on to multiple computers
• Check any application using your old password on affected system
• Check Any Persistent drive mappings using your old password
• Check for TS session with old password

You can also use Microsoft ALTools to troubleshoot account lockouts


ALTools

Command to troubleshoot DNS issues (Nslookup Advance Usage)

Command to troubleshoot DNS issues (Nslookup Advance Usage)

Nslookup is a command-line tool used to test and troubleshoot the DNS issues

Find the advance help for Nslookup



C:\>nslookup
Default Server: ns1chn.vsnl.com
Address: 202.54.6.60

> ?
Commands: (identifiers are shown in uppercase, [] means optional)
NAME - print info about the host/domain NAME using default server
NAME1 NAME2 - as above, but use NAME2 as server
help or ? - print info on common commands
set OPTION - set an option
all - print options, current server and host
[no]debug - print debugging information
[no]d2 - print exhaustive debugging information
[no]defname - append domain name to each query
[no]recurse - ask for recursive answer to query
[no]search - use domain search list
[no]vc - always use a virtual circuit
domain=NAME - set default domain name to NAME
srchlist=N1[/N2/.../N6] - set domain to N1 and search list to N1,N2, etc.
root=NAME - set root server to NAME
retry=X - set number of retries to X
timeout=X - set initial time-out interval to X seconds
type=X - set query type (ex. A,ANY,CNAME,MX,NS,PTR,SOA,SRV)
querytype=X - same as type
class=X - set query class (ex. IN (Internet), ANY)
[no]msxfr - use MS fast zone transfer
ixfrver=X - current version to use in IXFR transfer request
server NAME - set default server to NAME, using current default server
lserver NAME - set default server to NAME, using initial server
finger [USER] - finger the optional NAME at the current default host
root - set current default server to the root
ls [opt] DOMAIN [> FILE] - list addresses in DOMAIN (optional: output to FILE)
-a - list canonical names and aliases
-d - list all records
-t TYPE - list records of the given type (e.g. A,CNAME,MX,NS,PTR etc.)
view FILE - sort an 'ls' output file and view it with pg
exit - exit the program

Set All

command will display the current configuration settings; you can always change the settings using the same set command, but this setting only for the current session, this will change to default settings while to exit the command

> set all
Default Server: ns1chn.vsnl.com
Address: 202.54.6.60

Set options:
nodebug
defname
search
recurse
nod2
novc
noignoretc
port=53
type=A
class=IN
timeout=2
retry=1
root=A.ROOT-SERVERS.NET.
domain=
MSxfr
IXFRversion=1
srchlist=

Set type

To change the query type user the below command, by default type=A, this will only query the host record (A record) to query for the mail exchanger data, type the following:

> set type=mx
> google.com
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Non-authoritative answer:
google.com MX preference = 10, mail exchanger = smtp4.google.com
google.com MX preference = 10, mail exchanger = smtp1.google.com
google.com MX preference = 10, mail exchanger = smtp2.google.com
google.com MX preference = 10, mail exchanger = smtp3.google.com

In this way you can use the different query type (A, ANY, CNAME, MX, NS, PTR, SOA, SRV).

any - displays all the records for that domain.
cname - CName (Canonical Name) is used for nicknames or aliases, it is used to redirect web address to another
mx - Mail eXchange (MX). Used to define which domain handles the email
ns - Look up the Name servers for this record
ptr - A record that points an IP address to a single name, unlike a name which can be associated with many IP addresses
soa - Start Of Authority
srv - Resource records

The first time a query is made for a remote name, the answer is authoritative, but subsequent queries are nonauthoritative. The first time a remote host is queried, the local DNS server contacts the DNS server that is authoritative for that domain. The local DNS server will then cache that information, so that subsequent queries are answered nonauthoritatively out of the local server's cache.


Set debug

Using this option you can turn on or off the debug display, nothing but the detailed lookup result, by default this option disabled (set nodebug) you can use the below command turn on the debug mode

> set debug
> google.com
Server: ns1chn.vsnl.com
Address: 202.54.6.60

------------
Got answer:
HEADER:
opcode = QUERY, id = 2, rcode = NOERROR
header flags: response, want recursion, recursion avail.
questions = 1, answers = 3, authority records = 4, additional = 4

QUESTIONS:
google.com, type = A, class = IN
ANSWERS:
-> google.com
internet address = 74.125.67.100
ttl = 235 (3 mins 55 secs)

AUTHORITY RECORDS:
-> google.com
nameserver = ns1.google.com
ttl = 170814 (1 day 23 hours 26 mins 54 secs)

ADDITIONAL RECORDS:
-> ns1.google.com
internet address = 216.239.32.10
ttl = 302197 (3 days 11 hours 56 mins 37 secs)
------------
Non-authoritative answer:
Name: google.com
Addresses: 74.125.67.100, 74.125.127.100, 74.125.45.100



We have querying “google.com, type = A, class = IN”

Normal query Nslookup will return only the IP address of google.com, in debug mode it will provide corresponding name server records and authority records which resolve to the IP addresses (Additional records)

So we came to know from where the host (google.com) getting resolved, able to find the corresponding IP address as well as holding DNS server (ns1.google.com)

Set d2

Using this Option you can turn on or off the EXHAUSTIVE debug display. Retrieves the complete dump of what is sent and received via the DNS requests


Set norecurse

Before this you should know about Iterative(norecurse) and Recursive(recurse) Queries.
Please check the below link for more info:

DNS Query Types


This will display other domain name servers to query, if the default name server does not have the information.

Turn off recursion and then try to look up a name that is not cached locally. since our default name server does not have the entry, this will display other name servers that might know the answer


> set norecurse
> iit.co.in
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Name: iit.co.in
Served by:
- b0.cctld.afilias-nst.org
199.254.60.1
co.in
- a0.cctld.afilias-nst.info
199.254.59.1
co.in
- a2.in.afilias-nst.info
199.249.117.1
co.in
- b2.in.afilias-nst.org
199.249.125.1
co.in
- d0.cctld.afilias-nst.org
199.254.62.1
co.in
- c0.cctld.afilias-nst.info
199.254.61.1
co.in
- a1.in.afilias-nst.in
203.119.49.201
co.in
- b1.in.afilias-nst.in
220.226.205.253
co.in


> iit.co.in b0.cctld.afilias-nst.org
Server: b0.cctld.afilias-nst.org
Address: 199.254.60.1

Name: iit.co.in
Served by:
- ns409.websitewelcome.com

iit.co.in
- ns410.websitewelcome.com

iit.co.in


> iit.co.in ns409.websitewelcome.com
Server: ns409.websitewelcome.com
Address: 74.54.42.226

Name: iit.co.in
Address: 74.54.189.219



In the above example I have using iit.co.in, if you query iit.co.in with set norecurse this will display other name servers that might know the answer, since our default name server does not. I have used b0.cctld.afilias-nst.org name server to look for the answer, this will lists the ns server that has the authoritive answer. Then have the Name server for one more time, iit.co.in ns409.websitewelcome.com and we will get the A record 74.54.189.219

This will help to troubleshoot the DNS related issues, able to find the problematic name servers and able to find trace the DNS issue.


> set recurse
> iit.com
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Non-authoritative answer:
Name: iit.com
Address: 74.54.82.185

With set recurse we will get the direct answer


Set srchlis

Command to change search list and default Domain Name System (DNS) domain name

Set srchlist=N1[N2/../N6]


Specifies one or up to six domain names to be appended to unqualified host names when attempting to resolve the host name. Each domain name specified is tried in turn until a match is found.
This option also directs the default domain to be set to the first domain name specified in the search list. The minimum abbreviation for this option is srchl.

While querying the host name no need to provide the FQDN, only host name enough, domain from the Srchlist added to the given host name to make the FQDN

Examples

To set the DNS domain to test.com
set srchlist=test.com/test1.com
> set srchlist=test.com
> test0001
Server: ns1chn.vsnl.com
Address: 202.54.6.60

Non-authoritative answer:
Name: test0001.test.com
Address: 205.178.152.103

In the above example I have only provide the host name (test0001) but Nslookup able to query the FQDN (test0001.test.com) using the set srchlist=test.com command.


DOMAIN SERVER
Look up a given domain name (NAME1) using this name server (NAME2). See example below

> iit.co.in ns409.websitewelcome.com
Server: ns409.websitewelcome.com
Address: 74.54.42.226

Name: iit.co.in
Address: 74.54.189.219


set root

Changes the name of the root server to the name specified by the HOST parameter, The root server by default is defined to be "A.ROOT-SERVERS.NET"

set root=A.ROOT-SERVERS.NET

set retry

Changes the number of times to retry quering a name server, Default retries is 1.

set retry=2


Set timeout

Sets the initial time out value in seconds, Default timeout value is 2 seconds.

>set timeout=4


LS

Rerieve the zone list of this domain. Note: On almost all Name Servers this operation is restricted or turned off

Most of the time, when using this command you would get a query refused output.Options:-a - list canonical names and aliases-d - list all records-t TYPE - list records of the given type (i.e. cname, mx, ns etc.)

Lingering objects

Lingering objects

When an object is deleted, Active Directory replicates the deletion as a tombstone object, which consists of a small subset of the attributes of the deleted object. By inbound-replicating this object, other domain controllers in the domain and forest become aware of the deletion. The tombstone is retained in Active Directory for a specified period called the tombstone lifetime. At the end of the tombstone lifetime, the tombstone is deleted from the directory permanently.
After the tombstone is removed permanently, the object deletion can no longer be replicated. Therefore, the tombstone lifetime defines how long domain controllers in the forest retain knowledge of a deleted object and thus the time during which a unique deletion must be received by all direct and transitive replication partners of the originating domain controller.

The default value of the tombstone lifetime depends on the version of the operating system that is running on the first domain controller that is installed in a forest, as follows:
Windows 2000 Server or Windows Server 2003: The default value is 60 days.
Windows Server 2003 with Service Pack 1 (SP1): The default value is 180 days

How Lingering Objects Occur

When conditions beyond your control cause a domain controller to be disconnected for a period that is longer than the tombstone lifetime, one or more objects that are deleted from Active Directory on all other domain controllers might remain on the disconnected domain controller. Such objects are called lingering objects. Because the domain controller is offline during the entire time that the tombstone is alive, the domain controller never receives replication of the tombstone.
When it is reconnected to the replication topology, this domain controller acts as a source replication partner that has an object that its destination partner does not have.
Replication problems occur when the object on the source domain controller is updated. In this case, when the destination attempts to inbound-replicate the update, the destination domain
controller responds in one of two ways:

If the destination domain controller has strict replication consistency enabled, it recognizes that it cannot update the object and locally halts inbound replication of the directory partition from that source domain controller.

If the destination domain controller has strict replication consistency enabled, it recognizes that it cannot update the object and locally halts inbound replication of the directory partition from that source domain controller.

Lingering objects can reside in writable or read-only partitions that are potentially replicated between domain controllers in the same or different domains in the same forest.

Causes of Long Disconnections

Indications That a Domain Controller Has Lingering Objects


• A domain controller is left in a storage room and forgotten, or shipment of a prestaged domain controller to its remote location takes longer than a tombstone lifetime.

• Replication fails and monitoring is not in place. Failures can occur as follows:

• A domain controller is started and connected to the corporate intranet but experiences inbound replication failure as a result of an underlying network connectivity failure, name resolution failure, or authentication failure that prevents replication from occurring.

• A bridgehead server is overloaded, and replication becomes backlogged. Excessively high replication load on a global catalog server, in combination with a short intersite replication interval, can result in updates not being replicated.

• Global catalog servers replicate read-only replicas of all domain directory partitions in the forest. The replication of read-only replicas has a lower priority than the replication of writable replicas. In addition, global catalog servers are often bridgehead servers, which adds to the replication load. If the replication load on global catalog servers acting as bridgehead servers is too high as a result of an extremely short replication interval, excessive numbers of concurrent outbound replication partners, or a combination of both, the replication queue can become backlogged. If the condition persists, read-only replicas can remain in the queue indefinitely. These conditions can result in lingering objects on a global catalog server.

• Wide area network (WAN) connections are unavailable for long periods. For example, a domain controller onboard a cruise ship might be unable to replicate because the ship is at sea for longer than the tombstone lifetime.

• The reported event is a false positive because an administrator shortened the tombstone lifetime to force tombstone deletion (garbage collection).

• The reported event is a false positive because the system clock on the source or destination domain controller is improperly rolled forward or back in time. Clock skews are most common following a system reboot and can have the following causes:

• System clock battery or motherboard problems.

• The time source for a computer is improperly configured, including a time source server configured with Windows Time service (W32time), third-party time servers, and network routers.

• The system clock is advanced or rolled back by an administrator attempting to extend the useful life of a system state backup or accelerate the garbage collection of deleted objects. Make sure that the system clock reflects the actual time and that event logs do not contain events from the future or invalid past.


Indications That a Domain Controller Has Lingering Objects
An outdated domain controller can store lingering objects with no noticeable effect as long as an administrator, application, or service does not update the lingering object or attempt to create an object with the same name in the domain or with the same user principal name (UPN) in the forest. However, the existence of lingering objects can cause problems, especially if the object is a security principal.
Symptoms Associated with Lingering Objects
The following symptoms indicate that a domain controller has lingering objects:

• A deleted user or group account remains in the global address list (GAL) on Exchange servers. Therefore, although the account name appears in the GAL, attempts to send e-mail messages result in errors.
• Multiple copies of an object appear in the object picker or GAL for an object that should be unique in the forest. Duplicate objects sometimes appear with altered names, causing confusion on directory searches. For example, if the relative distinguished name of two objects cannot be resolved, conflict resolution appends "*CNF:GUID" to the name, where * represents a reserved character, CNF is a constant that indicates a conflict resolution, and GUID represents the objectGUID attribute value.
• E-mail messages are not delivered to a user whose Active Directory account appears to be current. After an outdated domain controller or global catalog server becomes reconnected, both instances of the user object appear in the global catalog. Because both objects have the same e-mail address, e-mail messages cannot be delivered.
• A universal group that no longer exists continues to appear in a user’s access token. Although the group no longer exists, if a user account still has the group in its security token, the user might have access to a resource that you intended to be unavailable to that user.
• A new object or Exchange mailbox cannot be created, but you do not see the object in Active Directory. An error message reports that the object already exists.
• Searches that use attributes of an existing object incorrectly find multiple copies of an object of the same name. One object has been deleted from the domain, but it remains in an isolated global catalog server.


If an attempt is made to update a lingering object that resides in a writable directory partition, events are logged on the destination domain controller. However, if the only version of a lingering object exists in a read-only directory partition on a global catalog server, the object cannot be updated and this type of event will never be triggered.

Events that indicate that lingering objects are present in the forest

If a destination domain controller logs event ID 1388 or event ID 1988, a lingering object has been detected and one of two conditions exists on the destination domain controller:

• Event ID 1388: Inbound replication of the lingering object has occurred on the destination domain controller.

• Event ID 1988: Inbound replication of the directory partition of the lingering object has been blocked on the destination domain controller.

Event ID 1388

This event indicates that a destination domain controller that does not have strict replication consistency enabled has received a request to update an object that does not reside in the local copy of the Active Directory database. In response, the destination domain controller has requested the full object from the source replication partner. In this way, a lingering object has been replicated ("reanimated") to the destination domain controller.

Event ID 1988
This event indicates that a destination domain controller that has strict replication consistency enabled has received a request to update an object that does not exist in its local copy of the Active Directory database. In response, the destination domain controller has blocked replication of the directory partition containing that object from that source domain controller. The event text identifies the source domain controller and the outdated (lingering) object. An example version of the event text is as follows:

Event ID 2042

If a domain controller has not replicated with its partner for longer than a tombstone lifetime, it is possible that a lingering object problem exists on one or both domain controllers. When this condition occurs, inbound replication with the source partner is stopped on the destination domain controller and event ID 2042 is logged in the Directory Services event log. The event identifies the source domain controller and the appropriate steps to take to either remove the outdated domain controller or remove lingering objects and restore replication from the source domain controller.

How to find the domain controller that contains the lingering object

If we enable Strict Replication Consistency

Lingering objects are not present on domain controllers that log Event ID 1988. The source domain controller contains the lingering object

If we doesn’t enable Strict Replication Consistency

Lingering objects are not present on domain controllers that log Event ID 1388. Domain controller that doesn’t log Event ID 1388 and that domain controller contain the lingering object

You have a 100 Domain controllers which doesn’t enable Strict Replication Consistency, then you will get the Event ID 1388 on all the 99 Domain controllers except the one that contain the lingering object

Need to Remove Lingering Objects from the affected domain controller or decommission the domain controller

You can use Event Comb tool (Eventcombmt.exe) is a multi-threaded tool that can be used to gather specific events from the Event Viewer logs of different computers at the same time.

You can download these tools from the following location:
http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

Windows 2008 installation types

Windows 2008 gives you two installation options or installation types

Windows 2008 can be installed in two types,

1. Full installation
2. Server Core installation

Full installation

This option install the complete installation in windows server, this installation includes the entire user interface and support all the server roles, it’s a normal server installation like the windows 2003 server

Server Core installation

This is a new feature in the windows 2008 server, in the Server Core installation, which is a cut-down version of Windows without the Windows Explorer GUI. Because you don’t have the Windows Explorer to provide the GUI interface that you are used to,

You configure everything through the command line interface or remotely using a Microsoft Management Console (MMC). The Server Core can be used for dedicated machines with basic roles such as Domain controller/Active Directory Domain Services, DNS Server, DHCP Server, file server, print server, Windows Media Server, IIS 7 web server and Windows Server Virtualization virtual server.




We able to open some of the GUI application in the in the Server Core installation of windows 2008, notepad, task manager, Data and Time console, Regional Settings console and all other are managed through remote management

Windows 2008 DNS features

Compare to windows 2003, Windows 2008 have more features and improvement, I will discuss the improvement related to DNS in this article, Microsoft done the improvement that really required for the IT environment, Windows 2008 DNS features are listed below

Background zone loading: If you are an administrator for an large environment you would have seen this issue, after the DNS server restart it take some time to load the DNS zones, till that time server will not respond to an DNS query from client (even server will not respond to the nslookup) you have to wait for the server to load the zones, this issue has been rectified in Windows 2008 DNS server, since zone data loaded in the background while the time of DNS server restart and DNS server respond to the client query very quickly.

IP version 6 support: The Windows 2008 DNS Server fully supports the longer addresses of the IPv6 specification.

Support for read-only domain controllers (RODCs): We able to modify the Primary DNS zone, what about the primary zone in read only domain controller, we can’t modify or update the primary zone on read only domain controller, yes Windows 2008 server provides primary read-only zones on RODCs.

Global single names: Not required to add DNS suffixes for the name resolution for the various domain names, GlobalNames zone provides single-label name resolution for large enterprise networks, if your environment doesn’t have WINS or planning on deploying IPv6-only in your environment then you Need to Deploy the GlobalNames Zone, it’s useful when using DNS name suffixes to provide single-label name resolution is not practical.

Global query block list: Clients of such protocols as the Web Proxy Auto-Discovery Protocol (WPAD) and the Intra-site Automatic Tunnel Addressing Protocol (ISATAP) that rely on DNS name resolution to resolve well-known host names are vulnerable to malicious users who use dynamic update to register host computers that pose as legitimate servers. The DNS Server role in Windows Server 2008 provides a global query block list that can help reduce this vulnerability.

DNS Security Extensions (DNSSEC): DNSSEC works by digitally signing these records for DNS lookup using public-key cryptography. The correct DNSKEY record is authenticated via a chain of trust, starting with a set of verified public keys for the DNS root zone which is the trusted third party.

The following DNSSEC related features are introduced in Windows Server 2008 R2:

• The ability to sign a zone (that is, to provide the zone a digital signature)
• The ability to host signed zones
• New support for the DNSSEC protocol
• New support for DNSKEY, RRSIG, NSEC, and DS resource records.

A key feature of DNSSEC is that it enables you to sign a DNS zone – which means that all the records for that zone are also signed.The DNS client can take advantage of the digital signature added to the resource records to confirm that they are valid. This is typical of what you see in other areas where you have deployed services that depend on PKI. The DNS client can validate that the response hasn’t been changed using the public/private key pair. In order to do this, the DNS client has to be configured to trust the signer of the signed zone.

The new Windows Server 2008 R2 DNSSEC support enables you to sign file-based and Active Directory integrated zones through an offline zone signing tool. I know it would have been easier to have a GUI interface for this. When configured with a trust anchor, a DNS server is able to validate DNSSEC responses received on behalf of the client. However, in order to prove that a DNS answer is correct, you need to know at least one key or DS record that is correct from sources other than the DNS. These starting points are called trust anchors.

Another change in the Windows 7 and Windows Server 2008 R2 DNS client is that it acts as a security-aware stub resolver. This means that the DNS client will let the DNS server handle the security validation tasks, but it will consume the results of the security validation efforts performed by the DNS server. The DNS clients take advantage of the NRPT to determine when they should check for validation results. After the client confirms that the response is valid, it will return the results of the DNS query to the application that triggered the initial DNS query.

DNS Cache Locking: Using the DNS Cache locking in Windows Server 2008 R2 enables you to control the ability to overwrite information contained in the DNS cache. If you turned on the DNS cache locking then DNS server will not allow cached records to be overwritten for the duration of the time to live (TTL) value. This helps protect your DNS server from cache poisoning.

Difference between Windows Server 2008 and Windows Server 2008 R2

Windows Server 2008 and Windows Server 2008 SP2 are the same operating system, just at a different service pack level (Windows Server 2008 started at the SP1 level because it was released quite a bit after Windows Vista and SP1 was already out). As for as the windows 2008 and windows 2008 SP2 concern it’s uses the same OS kernel of windows vista, and in windows Server 2008 R2 has the same OS kernel of Windows7
Windows Server 2008 R2 is the server release of Windows 7, so it's version 6.1 of the OS. It introduces quite a lot of new features, because it's actually a new release of the system.

Windows Server 2008 is based on the 6.0 kernel, the same of Windows Vista, Windows Server 2008 R2 is based on the 6.1 one, the same of Windows 7, while versioning it as 6.1 to indicate its similar build to Vista and increase compatibility with applications that only check major version numbers, similar to Windows 2000 and Windows XP both having 5.x version numbers

There are also differences at the GUI level, because Windows Server 2008 R2 uses the same new GUI introduced with Windows 7

The single most important point: Windows Server 2008 R2 exists only for 64-bit platforms, there's no x86 version anymore.

Windows Server 2008 R2 has many features that are designed specifically to work with client computers running Windows 7. Windows 7 is the next version of the Windows operating system from Microsoft

Some of the features that only available when running Windows 7 client computers with server computers running Windows Server 2008 R2, compare to windows 2008 SP2 and windows 2008 R2, windows 2008 R2 have more Features, I will cover this in my upcoming article.

Active Directory 2008 features

Whats new in windows 2008 Active Directory

As an Active Directory administrator very curies about the windows 2008 features compare to the earlier version like windows 2003, Windows 2008 comes with the whole bunch of features, and am going to discuss specific about the features of Active Directory server roles in Windows 2008

First I will list the features of windows 2008 Active directory and will discuss in detail of each in my upcoming article

Auditing

Now you can know the previous and present values for the changed attributes of the active directory object using the new auditing feature in windows 2008, as per the windows 2003 auditing you will only know the present values of the changed attribute

This is very useful features in windows 2008 since you can revert back the changes using the previous value of the attribute

Fine-Grained Passwords

By default in windows 2003 all the user account in the domain should use the same password policy configured in domain level, thats why we called domain is a security boundary, if you require a different password policy then you have to create new domain

In windows 2008 password policy can be configured for specific group of peoples with in the domain

Read-Only Domain Controller

Every one know about the BDC (backup domain controller) and it’s a same as the BDC but it only take the advantages from the BDC and it’s specifically designed for the today’s requirements like branch office setup and to managing the branch office

We all know how difficult to design and manage the domain controller from the branch office, some time it lead to the lingering object, but using the Read-Only Domain Controller
In the branch office where the physical security of the domain controller is in question, or domain controllers that host additional roles, requiring other users to log on and maintain the server

In any Active Directory environment if one Domain Controller not replicated with the partner Domain Controller more then one month, then it’s a very critical issue you have to rectify the replication problem as soon as possible or the Domain Controller needs to be decommissioned with in the tombstone lifetime, since its read-only domain controller no worries about the tombstone time.

Restartable Active Directory Domain Services

Hey good new, now no need to restart the domain controller for every time for the active directory maintenance.

In windows 2008 active directory is a services, you can stop or restart the services for maintenance without restarting the domain controller and restarting it in Directory Services Restore Mode is not required for most maintenance functions, however still some maintenance function require Directory Services Restore Mode

Database Mounting Tool

Active Directory Database mounting tool in Windows Server 2008 to create and view snapshots of data that is stored in Active Directory Domain Services, and no need to restart the domain controller. A snapshot is a shadow copy created by the Volume Shadow Copy Service, at different times so that you can better choose which data to restore after object deletion. This reduces the administrator time and no need to restore multiple backups to compare the Active Directory data.

Active Directory Database mounting tool can be called Snapshot Viewer, Snapshot Browser, and Active Directory data mining tool.

Active Directory Recycle Bin

You can restore the accidentally deleted Active Directory object, without Active Directory authoritative restore, this can be used for single object restore like a accidental deletion of user or OU and you can reduce the domain controller downtime

Active Directory module for Windows PowerShell

PowerShell available on windows 2003 itself, however it’s not fully supported for Active Directory, you can’t manage the Active Directive using the PowerShell in windows 2003

In windows 2008 Windows PowerShell provides command-line scripting for administrative, configuration, and diagnostic tasks

You can manage the Active Directory with Exchange Server, Group Policy, and other services and it’s very easy to use like a windows commands, you can easily pipe cmdlets to build complex operations

Active Directory Administrative Center

It’s new tool in windows 2008 R2 to manage active directory, we already have active directory users and computer to manage the active directory, using this new tool you can manage active directory in a new way

As an administrator you perform most of the task commonly that is daily, some how it’s hard to open an active directory user and computer and find the object and do the task, in this new tool Active Directory Administrative Center it’s very easy to do a common task like password reset and search the Active Directory object and others

Active Directory Best Practices Analyzer


This can be helped to identify and implement the best practices in the configuration of your active directory environment, this will scan your network and find the best practice violations,
Then you can correct that, to get the best out of Active Directory services in windows 2008.

Active Directory Web Services

Active Directory Web Services is give you the Web service interface to Active Directory domains and AD LDS instances (Active Directory Lightweight Directory Services)

Active Directory Database Mounting Tool uses the Active Directory Web Services as a front end, like that Windows PowerShell and Active Directory Administrative Center is used the Active Directory Web Services to access the directory service instances.

Offline domain join

Offline domain join makes to join a member server to the domain even the domain controller not reachable from the member server

And this can be very useful for bulk deployment, when the system starts, it will automatically joined to the domain, this will reduce the administrative effort

Managed Service Accounts

Normally applications and services uses the Local Service and Network Service and Local System accounts, it’s easy to configure and shared among multiple applications and services and cannot be managed on a domain level

You can use the domain account for the application (services), this can isolate the privileges for the application, but it’s very hard to manage these domain accounts like password management

We have two new types of accounts, Managed service accounts and virtual accounts in windows 2008, now you can easily manage the service principal names (SPNs), it will provide Automatic password management

Active Directory Management Pack

You can monitor the Active Directory service on windows 2008 using the Active Directory Management Pack (MOM, SCOM)

Designed specifically to monitor the performance and availability of Active Directory Domain Services (AD DS), also monitors the overall health of AD DS and alerts you to critical performance issues.

Am sure you also amused about the features of windows 2008 and I would like to explain in details of each of this features in my up-coming article and your feedbacks are welcome

September 03, 2009 12:00 AM

New Active Directory Features in Windows Server 2008 R2

AD capabilities will turn any admin into SuperAdmin

John Savill

Windows IT Pro

InstantDoc ID #102483

Rating: (1)

Tweet

inShare

Windows Server 2008 R2 is known for its new Hyper-V implementation with zero down-time migration capabilities; however, changes to Active Directory (AD) in Server 2008 R2 are almost as compelling and hint at this important infrastructure’s future developments. The new AD features can be separated into two areas—manageability enhancements and "everything else," which includes some very useful capabilities.
Domain and Forest Functional Level Changes
Server 2008 R2 offers a new domain functional level, which you can enable after you have all Windows Server 2008 R2 domain controllers (DCs) in the domain. It adds support for the new authentication mechanism assurance features we will discuss shortly.

Server 2008 R2 also offers a new forest functional level. It requires all DCs in the entire forest to be running Server 2008 R2 and adds support for the new Recycle Bin feature. Unlike previous Windows Server domain and forest functional level changes, this operation isn’t one-way and can be reversed providing you haven’t activated any feature that requires the domain or forest level.

For example, if you’ve moved to the Server 2008 R2 forest functional level and haven’t enabled the Recycle Bin, you could drop the forest functional level back down to the Server 2008 functional level. After you move to a Server 2008 R2 functional level, you aren’t able to add Windows Server 2003 or Server 2008 DCs to the domain or forest. Before you can introduce a Windows Server 2008 R2 DC into a domain, you must perform a schema update as well as other tasks to be able to use certain new features in Server 2008 R2.

If you’re coming from a Windows 2003 domain as opposed to a domain already prepared for Server 2008, you’ll also need to update Group Policy objects (GPOs). In terms of co-existence, Windows 2000 SP4, Windows 2003 and Server 2008 DCs can exist in a domain with Server 2008 R2 DCs. Windows NT 4.0 BDCs aren’t supported in a domain with Server 2008 R2. Obviously as we start changing domain/forest functional modes we are restricted to the OS level of DCs to match our domain/forest level.
Managebility Features
Server 2008 started the big push for Windows PowerShell-based management across the OS and services, but not all components had PowerShell support (many, in fact, did not). Server Core’s new minimal installation mode with reduced footprint and attack surface didn't even support PowerShell because of the .NET dependency, which wasn’t available on Server Core.

Server 2008 R2 remedies many of these PowerShell omissions. Server Core now supports many components of .NET, which means PowerShell is supported on Server 2008 R2 Server Core installations, and many roles and features that previously didn't support PowerShell now do, including AD.

The AD PowerShell implementation includes 75 PowerShell cmdlets and a PowerShell provider with an additional 14 cmdlets. Microsoft estimates that around 70 percent of AD functions can be performed with direct AD cmdlets written specifically to address the actions. The other 30 percent of these actions can be accomplished with PowerShell but not with dedicated cmdlets; instead, combinations of cmdlets are used.
Active Directory Web Service
A new Active Directory Web Service (AD WS) is installed on Server 2008 R2 DCs; it operates over port 9389. The required firewall exception is enabled automatically as part of the role installation (including server core DCs); however, if you control firewall exceptions via Group Policy, you need to ensure you open this new port. Currently most tools connect using LDAP and remote procedure calls (RPCs).

However, offering a web service for AD access enables a superior developer experience and forms the first stage of a bigger objective, which is the enablement of AD for cloud and distributed service scenarios. AD PowerShell cmdlets use the interface provided by AD Web Service (ADWS). If a DC can’t be found offering the ADWS, then the AD PowerShell cmdlets won’t work.

It’s therefore very important you have a sufficient number of R2 DCs running ADWS across all domains that a PowerShell cmdlet might query. Although you can disable ADWS, it’s discouraged. Note that when Server 2008 R2 is released, an out-of-band update for Windows 2003 and Server 2008 will be released to add ADWS to these AD implementations.
Active Directory Administrative Center
Active Directory Administrative Center (ADAC) (see Figure 1) is a new interface designed to replace Active Directory Users and Computers. In future server versions, ADAC will also replace AD Domains and Trusts and AD Sites and Services, offering a single administrative interface for all AD management along with support for features that currently don't have any graphical interface, such as Recycle Bin and fine-grained password policies (FGPPs).

ADAC lets you manage users, groups, computers, and organizational units (OUs) and offers powerful and intuitive search and filter options. Within a single instance, it lets you manage multiple domains and even connect to multiple DCs simultaneously.

ADAC is built on PowerShell but currently doesn’t display the PowerShell commands that would be used to complete actions; this may be an option for a future version. ADAC consists of many layers; for example, it uses PowerShell, and PowerShell uses ADWS. ADAC’s many new components and dependencies on the new 2008 R2 capabilities actually give us a very rich platform for AD management.
Even More Great Management Features
In addition to the key features above, you’ll also find more components related to management. Each is extremely useful in its own right.

Active Directory Health Model. This is a single authoritative source for diagnostic information, which is used by the management packs and best practice analyzers. This health model can also be accessed by other third-party applications if necessary.
Best Practices Analyzer (BPA) for Active Directory. This is available through Server Manager and allows the installation of the selected DC to be validated against all the AD best practices. It’s a useful “quick access” check point to confirm configuration.
Management Pack for Server 2008 and Server 2008 R2. Although not an AD feature, a new System Center Operations Manager 2007 management pack monitors all features related to Server 2008 and Server 2008 R2 Active Directory implementations. See the Microsoft download page.
The Really Good Stuff
Server 2008 R2’s new management features give you many more options. However, the two most-sought after functions of Server 2008 R2 actually lie outside of management: Managed Service Accounts (MSAs) and the AD Recycle Bin.

Managed Service Accounts. Service accounts—dedicated AD accounts that run a server service—are the longest-standing security vulnerability in AD. Because services such as SQL Server and Exchange depend on these accounts, changing their passwords will interrupt the service.

To combat this problem, many installations opt to use built-in accounts such as the local system and network service accounts, which are then shared by many services. However, if one service is compromised, all the services using the same built-in account could be compromised. This has finally been fixed in R2 with MSAs.

Active Directory features

New Active Directory features in Windows Server 2003 with Service Pack 1 (SP1)

The following list summarizes the Active Directory features that are new since the original release of Windows Server 2003.

• Directory service backup reminders. A new event message, event ID 2089, provides the backup status of each directory partition that a domain controller stores, including application directory partitions and Active Directory Application Mode (ADAM) partitions. If halfway through the tombstone lifetime a partition has not been backed up, this event is logged in the Directory Service event log and continues daily until the partition is backed up.
  
• Added replication security and fewer replication errors. Replication metadata for domain controllers from which Active Directory has been removed is no longer retained by default, although a waiting period can be configured. This change improves replication security and eliminates replication error messages that are caused by failed attempts to replicate with decommissioned domain controllers. For more information about preserving replication metadata, see How the Active Directory Replication Model Works.
  
• Install from Media improvement for installing DNS servers. Install from Media improvements make it easier to create a new domain controller that is a Domain Name System (DNS) server by providing a new option to include application directory partitions in the backup media that is used to install the new domain controller. This option eliminates the requirement for replication of the DomainDNSZones and ForestDNSZones application directory partitions before the DNS server is operational.
  
• Enhancements for replication and DNS testing. The Dcdiag.exe command-line tool, which is available in Windows Support Tools, provides new reporting on the overall health of replication with respect to Active Directory security. This test provides a summary of results, along with detailed information for each domain controller that is tested and a diagnosis of any security errors. Dcdiag.exe also has new DNS tests for connectivity, service availability, forwarders and root hints, delegation, dynamic update, locator record registrations, external name resolution, and enterprise infrastructure. These tests can be performed on one domain controller or on all domain controllers in a forest. For more information about using Dcdiag.exe, see Windows Support Tools Help.
  
• Support for running domain controllers in virtual machines. On a single physical server that is running Windows Server 2003 and Microsoft Virtual Server 2005, you can install multiple Windows Server 2003 or Windows 2000 Server domain controllers in separate virtual machines. This platform is well suited for test environments. By using virtual machines, you can effectively host multiple domains, multiple domain controllers for the same domain, or even multiple forests on one physical server that is running a single operating system. Windows Server 2003 SP1 also provides protection against directory corruption that can result from improper backup and restore of domain controller images. For more information about running domain controllers in virtual machines, see Running Domain Controllers in Virtual Server 2005.
  
• Operations master health and status reporting. If an operation that requires a domain controller that holds an operations master role (also known as flexible single-master operations (FSMO)) cannot be performed, events are now logged in the Directory Service event log. Events identify role holders that do not exist, exist but are not available, or are available but have not replicated recently with the contacting domain controller. For more information about operations masters, see How Operations Masters Work.
  
• Extended storage of deleted objects. The default period that a copy of a deleted object is retained in Active Directory, called the tombstone lifetime, is extended from 60 days to 180 days. Longer tombstone lifetime decreases the chance that a deleted object remains in the local directory of a disconnected domain controller beyond the time when the object is permanently deleted from online domain controllers. The tombstone lifetime is not changed automatically when you upgrade to Windows Server 2003 with SP1, but you can change the tombstone lifetime manually after the upgrade. New forests that are installed with Windows Server 2003 with SP1 have a default tombstone lifetime of 180 days. For more information about tombstone lifetime, see How the Data Store Works.
  
• Improved domain controller name resolution. In response to DNS name resolution failures that may be encountered during location of replication partners and global catalog servers, domain controllers running Windows Server 2003 with SP1 request other variations of the server name that might be registered, which results in fewer failures due to DNS delays and misconfiguration. For more information about DNS name resolution, see How DNS Support for Active Directory Works.
  
• Improved server metadata removal. The Ntdsutil.exe command-line tool for managing the Active Directory database has new functionality that makes it easier to remove domain controller metadata. Preliminary steps, such as connecting to a server, domain, and site, are no longer required. You simply specify the server to remove. You can also specify the server on which to perform the deletion. Metadata removal is now more comprehensive: in addition to Active Directory replication metadata, the tool now removes File replication service (FRS) metadata and operations master metadata. If an operations master role is assigned to the server that is being removed, the tool attempts to transfer the role to an appropriate domain controller. For more information, see Delete extinct server metadata.
  
• Improved security to protect confidential attributes. To prevent Read access to confidential attributes, such as a Social Security number, while allowing Read access to other object attributes, you can designate specific attributes as confidential by setting a search flag on the respective attributeSchema object. By default, only domain administrators have Read access to confidential attributes, but this access can be delegated. For more information about access to attributes, see How Security Descriptors and Access Control Lists Work.
  
• Retention of SID history on tombstones. The sIDHistory attribute has been added to the set of attributes that are retained on an object tombstone when the object is deleted. If a tombstoned object is reactivated (undeleted), the sIDHistory attribute is now restored with the object. For more information about tombstones, see How the Data Store Works.
  
• Adprep.exe improvements for Windows 2000 Server upgrades. The Adprep tool has been improved to reduce the impact of FRS synchronization that results from updating SYSVOL files during upgrade. Adprep is used to upgrade the Windows 2000 Server schema to the Windows Server 2003 schema and to update some forest- and domain-specific configuration, including SYSVOL, that is required for a Windows Server 2003 domain controller to be operational. The tool now allows performing SYSVOL operations in a separate step when the domain is prepared for upgrade. A new switch, /gpprep, has been added to accommodate the SYSVOL updates, which can be performed at a convenient time following the upgrade. The adprep /domainprep command, which formerly performed both directory and SYSVOL updates, now updates only the directory. Adprep also now detects third-party schema extensions that block an upgrade, identifies the blocking extensions, and recommends fixes. Microsoft Exchange schema objects are also detected so that the Exchange schema can be prepared appropriately to accommodate inetOrgPerson naming. For more information about Adprep.exe, see Adprep.
  
• Improved authoritative restore. The authoritative restore option in Ntdsutil now locates backlinks for all objects that are authoritatively restored, including links that were created before implementation of the Windows Server 2003 or Windows Server 2003 interim forest functional level, in which linked-value replication (LVR) functionality was introduced. For example, suppose that a user object is restored and the user belongs to group G1, which was created before the forest functional level was raised, and the user also belongs to group G2, which was created after the forest functional level was raised. During authoritative restore of the user object, the member attribute of G2 is updated, but not the member attribute of G1. Ntdsutil now creates a text file that identifies the authoritatively restored objects and uses this file to create an LDAP Data Interchange Format (LDIF) file that can be used to restore all backlinks for pre-LVR groups in this domain. In the example, when this LDIF file is run after authoritative restore, the restored user is added to group G1. A new option in authoritative restore also allows you to generate an LDIF file that you can use to restore links in other domains in which a restored object has backlinks.
  

New Active Directory features in Windows Server 2003

With the new Active Directory features available in Microsoft® Windows Server® 2003, Standard Edition; Windows Server 2003, Enterprise Edition; and Windows Server 2003, Datacenter Edition, more efficient administration of Active Directory is available to you.
The following list summarizes the Active Directory features that are available by default on any domain controller running Windows Server 2003.

• Multiple selection of user objects. Modify common attributes of multiple user objects at one time.
  
• Drag-and-drop functionality. Move Active Directory objects from container to container by dragging one or more objects to a desired location in the domain hierarchy. You can also add objects to group membership lists by dragging one or more objects (including other group objects) to the target group.
  
• Efficient search capabilities. Search functionality is object-oriented and provides an efficient search that minimizes network traffic associated with browsing objects. For more information, see Finding directory information.
  
• Saved queries. Save commonly used search parameters for reuse in Active Directory Users and Computers. For more information, see Using saved queries.
  
• Active Directory command-line tools. Run new directory service commands for administration scenarios. For more information, see Managing Active Directory from the command line.
  
• InetOrgPerson class. The inetOrgPerson class has been added to the base schema as a security principal and can be used in the same manner as the user class. The userPassword attribute can also be used to set the account password. For more information, see User and computer accounts.
  
• Application directory partitions. Configure the replication scope for application-specific data among domain controllers. For example, you can control the replication scope of Domain Name System (DNS) zone data stored in Active Directory so that only specific domain controllers in the forest participate in DNS zone replication. For more information, see Application directory partitions.
  
• Ability to add additional domain controllers using backup media. Reduce the time it takes to add an additional domain controller in an existing domain by using backup media. For more information, see Using the Active Directory Installation Wizard.
  
• Universal group membership caching. Prevent the need to locate a global catalog across a wide area network (WAN) when logging on by storing universal group membership information on an authenticating domain controller. For more information, see Global catalogs and sites.
  
• Secure LDAP traffic. Active Directory administrative tools sign and encrypt all Lightweight Directory Access Protocol (LDAP) traffic by default. Signing LDAP traffic guarantees that the packaged data comes from a known source and that it has not been tampered with. For more information, see Connecting to domain controllers running Windows 2000.
  
• Active Directory quotas. Quotas can be specified in Active Directory to control the number of objects a user, group, or computer can own in a given directory partition. Domain Administrators and Enterprise Administrators are exempt from quotas.
  

New domain- and forest-wide Active Directory features

New domain- or forest-wide Active Directory features can be enabled only when all domain controllers in a domain or forest are running Windows Server 2003 and the domain functionality or forest functionality has been set to Windows Server 2003. For more information about domain and forest functionality settings, see Domain and forest functionality.
The following list summarizes the domain- and forest-wide Active Directory features that can be enabled when either a domain or forest functional level has been raised to Windows Server 2003.

• Domain controller rename tool. Rename domain controllers without first demoting them. For more information, see Renaming domain controllers.
  
• Domain rename. Rename any Windows Server 2003 domain. You can change the NetBIOS name or DNS name of any child, parent, tree, or forest root domain. For more information, see Renaming domains.
  
• Different location option for user and computer accounts. You can now redirect the default location for user accounts and computer accounts that are created by the following application programming interfaces (APIs): NetUserAdd, NetGroupAdd, and NetJoinDomain. You can redirect the location of the accounts from the Users and Computers containers to organizational units (OUs) where Group Policy settings can be applied. For more information, see Redirect the Users and Computers Containers.
  
• Forest trusts. Create a forest trust to extend two-way transitivity beyond the scope of a single forest to a second forest. For more information, see Forest trusts.
  
• Forest restructuring. Move existing domains to other locations in the domain hierarchy. For more information, see Renaming domains.
  
• Defunct schema objects. Deactivate unnecessary classes or attributes from the schema. For more information, see Deactivating a class or attribute.
  
• Dynamic auxiliary classes. Provides support for dynamically linking auxiliary classes to individual objects, and not just to entire classes of objects. In addition, auxiliary classes that have been attached to an object instance can subsequently be removed from the instance.
  
• Global catalog replication improvements. Preserves the synchronization state of the global catalog when an administrative action results in an extension of the partial attribute set. This minimizes the replication traffic as a result of a partial attribute set extension by only transmitting attributes that were added. For more information, see Global catalog replication.
  
• Replication enhancements. Linked-value replication allows individual group members to be replicated across the network instead of treating the entire group membership as a single unit of replication. For more information about linked-value replication, see How replication works. In addition, new spanning tree algorithms make replication more efficient, as well as more scalable across a larger number of domains and sites in both Windows 2000 and Windows Server 2003 forests. For more information, see Replication overview.
  
• User access control to resources between domains or forests. Block users in a domain or forest from accessing resources in another domain or forest, and then allow selective access by setting the Allow to authenticate access control entry (ACE) on a local resource for the user or group object. For more information, see Accessing resources across domains or Accessing resources across forests.

New and updated features since Windows Server 2003 (without SP1)

Windows Server 2003 operating systems with Service Pack 1 (SP1) offer the following improvements (compared to Windows Server 2003 without SP1) that help provide increased levels of support for Active Directory:

Improved replication and DNS diagnostic testing capabilities

Active Directory® has been updated to provide automatic directory service backup reminders, improved protection against replication errors, improvements to Install from Media (to facilitate adding new domain controllers that are DNS servers), improved DNS diagnostic testing capabilities, and access to a new platform for running domain controllers in virtual machines under Microsoft® Virtual Server 2005. For more information about these and other new Active Directory features and enhancements, see New features for Active Directory.

New and updated features since Windows NT 4.0

The Windows Server 2003 family offers the following improvements (in comparison to Windows NT 4.0) that help provide increased levels of support for Active Directory:

Simplified user and network-resource management

Using Active Directory, you can build hierarchical information structures that make it easier for you to control administrative credentials and other security settings and that make it easier for your users to locate network resources, such as files and printers.

Flexible, secure authentication and authorization

Flexible and secure authentication and authorization services provide protection for data while minimizing barriers to doing business over the Internet. Active Directory supports multiple authentication protocols, such as the Kerberos V5 protocol, Secure Sockets Layer (SSL) v3, and Transport Layer Security (TLS) using X.509 v3 certificates, and security groups that span domains efficiently.

Directory consolidation

You can organize and simplify the management of users, computers, applications, and devices, and make it easier for users to find the information they need. You can take advantage of synchronization support through Lightweight Directory Access Protocol (LDAP)-based interfaces, and you can work with directory consolidation requirements specific to your applications.

Directory-enabled applications and infrastructure

Active Directory features make it easier for you to configure and manage applications and other directory-enabled network components.

Scalability without complexity

Active Directory scales to millions of objects per domain and uses indexing technology and advanced replication techniques to speed performance.

Use of Internet standards

Active Directory provides access through LDAP and uses a Domain Name System (DNS)-based namespace.

A powerful development environment

Active Directory provides a powerful development environment through Active Directory Service Interfaces (ADSI), which provides an object-oriented interface to Active Directory. ADSI makes it easy for programmers and administrators to create directory programs by using high-level tools such as Microsoft Visual Basic, Java, C, or Visual C++, without having to worry about the underlying differences between the different namespaces. For more information, see Programming interfaces.

Replication and trust monitoring

Active Directory provides Windows Management Instrumentation (WMI) classes to monitor whether domain controllers are successfully replicating Active Directory information and whether trusts are functioning properly.

Message Queuing distribution lists

Message Queuing (also known as MSMQ) enables you to send messages to distribution lists that are hosted in Active Directory.

New and updated features since Windows 2000

The Windows Server 2003 family offers several improvements (in comparison to Windows 2000) that help provide increased levels of support for and better management of Active Directory. For a list of the Active Directory features that are new in this release, see New features for Active Directory.

2008 R2 Features

1. Active Directory Administrative Center

Windows Server 2008 R2 includes an enhanced Active Directory data management experience through the new Active Directory Administrative Center. The Active Directory Administrative Center, which is built on Windows PowerShell, uses a task-based administration model for managing users, groups, computers, organizational units and containers.
The key new features that the Active Directory Administrative Center provides are:

• A customizable overview page that includes tiles featuring frequently performed administrative tasks
• The ability to manage Active Directory objects across multiple domains
• A more flexible navigation pane, which can be browsed using the tree view or the new list view
• A breadcrumb bar you can use to navigate directly to the container you want to view
• A redesigned object property page, which can be customized to your liking
• The ability to perform query-building searches

2. Active Directory Module for Windows PowerShell

The Active Directory Module for Windows PowerShell, included in Windows Server 2008 R2, facilitates Active Directory administrative through Windows PowerShell. The Active Directory Module for Windows PowerShell is a collection of more than 75 Windows PowerShell cmdlets you can use to manage Active Directory Domain Services domains, Active Directory Lightweight Directory Services instances, and Active Directory Database Mounting Tool instances.

3. Active Directory Recycle Bin

Windows Server 2008 R2 provides the ability to undo accidental deletions of Active Directory objects through the new Active Directory Recycle Bin. The Active Directory Recycle Bin, which requires a forest functional level of Windows Server 2008 R2, must be enabled.
The Active Directory object life cycle is changed after the Active Directory Recycle Bin feature is enabled. One of the major differences is what happens when an object is deleted. In short, all of the object's link-valued and non-link-valued attributes are preserved, and the object is placed into a "logically deleted" state for a period of time. While an object is in this logically deleted state, it can be recovered using the Active Directory Recycle Bin feature.

4. Active Directory Best Practices Analyzer

Windows Server 2008 R2 includes a new Active Directory Best Practices Analyzer, which can be run using Server Manager and Windows PowerShell. The Active Directory Best Practices Analyzer can be used to scan one or more servers against a set of predefined best practices. Active Directory Best Practices Analyzer will report back whether each server is compliant or noncompliant with each best practice.
The Active Directory Best Practices Analyzer is installed automatically when the Active Directory Domain Services server role is installed. The Active Directory Best Practices Analyzer can be used to collect Active Directory Domain Services configuration information from Windows 2000, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 domain controllers.

5. Active Directory Web Services

Windows Server 2008 R2 includes a new Windows service called Active Directory Web Services. Active Directory Web Services provides a web services interface to Active Directory Domain Services domains, Active Directory Lightweight Directory Services instances, and Active Directory Mounting Tool instances running on the same Windows Server 2008 R2 server as Active Directory Web Services.
Active Directory Web Services is automatically installed when the Active Directory Domain Services or Active Directory Lightweight Directory services are installed on a Windows Server 2008 R2 server. Active Directory Web Services is a prerequisite for a number of new client applications, such as the Active Directory Administrative Center and the Active Directory module for Windows PowerShell. If the Active Directory Web Services Windows service is stopped or disabled, these client applications will not be able to communicate with Active Directory.

6. Managed Service Accounts

Managed service accounts in Windows Server 2008 R2 facilitate the management of Active Directory Domain Services accounts. To leverage managed service accounts, you must prepare your current Active Directory schema for Windows Server 2008 R2. In addition, the functionality for managed service accounts varies depending on the operating system on your domain controllers.
If your domain controllers are running Windows Server 2008 R2, then you can use managed service accounts for both automatic password management and SPN management. If your domain controllers are running Windows Server 2008 or Windows Server 2003, then managed service accounts can be used for automatic password management but not for SPN management.

7. Offline Domain Join

Windows Server 2008 R2 includes a new process, called offline domain join, which allows you to join Windows 7 and Windows Server 2008 R2 computers to an Active Directory Domain Services domain without network connectivity.
With the new offline domain join feature, computers can be joined to the domain without contacting a domain controller over the network. Offline domain join reduces the time and effort required to complete a large-scale computer deployments.

Server Clusters: Security Best Practices

Server Clusters: Security Best Practices, Windows 2000 and Windows Server 2003, General Assumptions

This topic has not yet been rated - Rate this topic

Updated: January 1, 2003
Applies To: Windows Server 2003 with SP1
Published: January 1, 2003

Also In This White Paper

Server Clusters: Security Best Practices, Windows 2000 and Windows Server 2003, Deployment and Operations

General Assumptions

There are a number of general assumptions and operational best practices that should be in place for the infrastructure to ensure a secure environment in which to run server clusters.

1. Servers and storage are in physically secure locations.
   
2. Practical security implementations to detect irregular traffic, such as firewalls, network probes and management tools, are in place.
   
3. Best practices/common sense in terms of security are adhered to in areas like administration, storage of logs, backup and restore etc.
   
4. Platform level security best practices are adhered to in terms of assigning administrative permissions, ACLing resources, and other housekeeping roles.
   
5. The network infrastructure services such as Active Directory, DNS, DHCP, WINS etc. must be secure. Any compromise of these infrastructure services can lead to a compromise of the cluster service itself.
   
6. The cluster administrator must ensure that applications that call the cluster APIs (ClusAPI) are run from trusted computers. Any compromise on the computers on which the applications are executing (that the cluster administrator runs) can compromise the cluster. For example, if there are untrusted users with elevated privileges on the workstation from where the administration tools are run, untrusted or malicious code can be run against the cluster by the cluster administrator without the cluster administrator realizing.
   
7. Access to the set of objects created and maintained by the cluster service must not be compromised by adjusting the default settings placed on these objects to a less restrictive setting. The cluster service utilizes a set of objects in the operating system such as files, devices, registry keys etc. These objects have a default security setting that ensures non-privileged users cannot impact the cluster configuration or the applications running on the cluster. Changing these security settings to less restrictive security settings can lead to the cluster being compromised and the application data being corrupted.