Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

The three main tools for
administering Active Directory are the following MMC consoles, which
are also the names of the corresponding MMC snap-ins:

Active Directory Domains and Trusts (domain.msc)

Used to administer certain aspects of domains and trusts. This tool
is discussed under

DomainTools later in
this chapter.

Active Directory Sites and Services (dssite.msc)

Used to create sites and manage directory replication between them.
This tool is discussed under

SiteTools
later in this chapter.

Active Directory Users and Computers (dsa.msc)

Used to create and manage Active Directory objects such as users,
computers, groups, and printers. This tool is discussed later in this
section.

You can access these tools several ways:

• Start Programs Administrative Tools
  select the appropriate tool.

• Add the appropriate snap-in to a new or existing MMC console.

• Install the WS2003 Administrative Tools Pack on an XP or WS2003
  machine and use the Active Directory Management convenience console,
  which contains all three of these snap-ins plus DNS.

• Type the filename associated with the tool
  (domain.msc, dssite.msc, or
  dsa.msc) at the command prompt or use Start
  Run.

Other tools used to administer certain aspects of Active Directory
include:

Active Directory Migration Tool (ADMT)

An MMC snap-in used to simplify the migration of users, groups, and
computers in NT 4.0 domains to Active Directory domains

Active Directory Schema

An MMC snap-in used to add a new class or attribute to the Active
Directory schema

adprep

A command-line tool used to prepare an existing W2K forest or domain
for upgrading to WS2003

dsadd ,

dsget ,

dsmod ,

dsmove ,

dsquery , and

dsrm

New command-line tools that enable you to find and manage users,
groups, computers, and OUs

ldifde

A command-line tool that enables you to batch import/export
information to/from Active Directory using the LDAP Data Interchange
Format (LDIF) standard

Ldp

A GUI utility in

\SUPPORT\TOOLS on the product
CD that allows you to perform LDAP searches against Active Directory
to view and modify information not visible in the GUI tools for
managing Active Directory

ntdsutil

A command-line tool used to perform maintenance on certain aspects of
Active Directory, such as performing an offline defragmentation to
compact the datastore

In addition, a number of command-line tools in the
\SUPPORT\TOOLS folder on the
WS2003 product CD can be used to administer certain aspects of Active
Directory. These tools include DCDiag,
Dnscmd, DSAStat,
MoveTree, Netdom,
NETDiag, NLTest,
Repadmin, and several others that can be found
in the

SUPPORT.CAB cabinet file and can be
installed using the

SUPTOOLS.MSI Windows
Installer package file.

Active Directory Users and Computers

Active Directory
Users and Computers is one of the WS2003 tools you will use
frequently as an administrator. You can use this tool to create
Active Directory objects representing users, groups, computers,
printers, and shared folders. You can also use it to create OUs,
delegate authority over OUs to trusted users, link Group Policy
Objects (GPOs) to domains and OUs, and manage certain aspects of
domain controllers. The console tree of this tool displays the domain
you have selected and the hierarchy of OUs (if any) that make up the
logical structure of the domain. The console tree also includes a
number of default containers:

Builtin

Contains various domain local groups in the domain, such as
Administrators and Users.

Computers

Contains computer accounts for member servers and workstations in the
domain.

Domain Controllers

Contains domain controllers for the domain.

Foreign Security Principals

Contains SIDs associated with objects from external trusted domains.

Users

Contains built-in user accounts, global groups, and a few domain
local groups. This container is also the default container for
accounts upgraded from downlevel NT domains.

There are also some additional hidden containers that are rarely used
in day-to-day administration of Active Directorylater in this
section I describe how to make these containers visible.

New to this version is the

Saved Queries folder,
which lets administrators create and save LDAP queries that search
for specific types of Active Directory objects. For example, you can
create queries to find all disabled user accounts, all users with
nonexpiring passwords, and so on. When you execute a saved query, you
can simultaneously modify all the objects found. This new bulk-edit
feature of WS2003 is much easier than the W2K approach of creating
custom ADSI scripts for similar purposes.

Action Menu

Here is a brief summary of the kinds of tasks
you can perform using the Action menu once you select a node in the
console tree or an object in the details pane:

Active Directory Users and Computers

Select this node to connect to another domain or domain controller,
view or change the operations masters for the domain, or raise the
domain functional level.

Saved Queries

Select this node to create a new query and create subfolders for
organizing your queries. Select a query to edit it or export it as an
XML file, which can then be imported into the

Saved
Queries folder of a different domain.

Any domain

Select this node to delegate authority for the domain, apply Group
Policy to the domain, invoke the Resultant Set of Policy (RSoP)
Wizard, create OUs or other objects within the domain, and perform
other tasks listed under

Active Directory Users and
Computers earlier in this section.

Any OU

Select this node to delegate authority for the OU, move the OU within
the domain, apply Group Policy to the OU, or invoke the RSoP Wizard.

Any user, computer, group, or other object

The actions you can perform depend on the type of object you select.
For example, right-clicking on a computer object and selecting Manage
will open a Computer Management console with the selected computer
having the focus.

View Menu

The View menu includes a few interesting
options:

Users, Groups, and Computers as containers

This option allows User, Group, and Computer objects to be displayed
in the console tree as containers. You might think that selecting a
Group object in the console tree would display the
group's members in the details pane, but
unfortunately, this is not so, so the feature has little usefulness.

Advanced Features

This option toggles on or off various hidden containers, including
LostAndFound, System, NTDS Quotas, and Program Data. The one of most
interest here is System, which has subcontainers representing various
networking services you have installed, such as DFS, DNS, RAS, and so
on. Don't modify anything in these containers unless
you really know what you're doing!

Advanced Features also displays two hidden tabs on properties sheets
of objects:

Object tab

Displays the canonical name of the object or where it is logically
located within Active Directory, in case you're
interested.

Security tab

Lets you modify the permissions of objects in Active Directory.
Changing these without knowing what you're doing can
really cause problems!

Filter Options

This option lets you set up a filter to display one or more types of
published objectsfor example, to display user accounts only.
Filters provide a quick way of narrowing the focus when you are
looking for something and have thousands of objects to wade through.