Preface |
|
xix | |
About this book |
|
xx | |
About the author |
|
xxii | |
Acknowledgments |
|
xxiii | |
|
PART 1 MANAGING ACTIVE DIRECTORY DATA |
|
|
1 | (90) |
|
|
3 | (8) |
|
|
4 | (3) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
1.2 Is this book for you? |
|
|
7 | (1) |
|
|
8 | (1) |
|
1.4 Creating your lab environment |
|
|
9 | (1) |
|
1.5 Being immediately effective |
|
|
10 | (1) |
|
|
11 | (15) |
|
2.1 Creating new user accounts |
|
|
13 | (6) |
|
Creating a new user with ADAC |
|
|
15 | (1) |
|
Creating a new user with ADUC |
|
|
16 | (2) |
|
Creating a new user with PowerShell |
|
|
18 | (1) |
|
2.2 User creation from a template |
|
|
19 | (2) |
|
2.3 User creation in bulk |
|
|
21 | (2) |
|
2.4 Creating managed service accounts |
|
|
23 | (1) |
|
|
24 | (1) |
|
Complete the Try It Now sections |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
25 | (1) |
|
2.6 Ideas for on your own |
|
|
25 | (1) |
|
|
26 | (11) |
|
3.1 Modifying user account properties |
|
|
27 | (5) |
|
Using GUI tools to modify user accounts |
|
|
28 | (2) |
|
Using PowerShell to modify user accounts |
|
|
30 | (1) |
|
Copying attributes from another account |
|
|
31 | (1) |
|
3.2 Enabling or disabling user accounts |
|
|
32 | (1) |
|
3.3 Deleting user accounts |
|
|
32 | (2) |
|
|
34 | (2) |
|
Complete the Try It Now sections |
|
|
34 | (1) |
|
Modify one value out of a multivalue attribute? |
|
|
35 | (1) |
|
Bulk modification of user accounts |
|
|
35 | (1) |
|
|
36 | (1) |
|
3.5 Ideas for on your own |
|
|
36 | (1) |
|
|
37 | (16) |
|
|
38 | (2) |
|
|
40 | (6) |
|
|
40 | (4) |
|
|
44 | (2) |
|
|
46 | (1) |
|
4.3 Managing group membership |
|
|
46 | (3) |
|
Using GUI tools to manage group membership |
|
|
46 | (2) |
|
Using PowerShell to manage group membership |
|
|
48 | (1) |
|
|
49 | (3) |
|
Complete the Try It Now sections |
|
|
49 | (1) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
51 | (1) |
|
|
52 | (1) |
|
Add computer account to group |
|
|
52 | (1) |
|
4.5 Ideas for on your own |
|
|
52 | (1) |
|
5 Troubleshooting users and groups |
|
|
53 | (11) |
|
5.1 Troubleshooting first steps |
|
|
54 | (3) |
|
Step 1 Is the account disabled? |
|
|
55 | (1) |
|
Step 2 Check account status |
|
|
55 | (1) |
|
Step 3 Has the account expired? |
|
|
56 | (1) |
|
|
57 | (1) |
|
|
58 | (1) |
|
5.4 Unlocking a user account |
|
|
59 | (2) |
|
|
61 | (1) |
|
|
62 | (1) |
|
Complete any Try It Now sections |
|
|
62 | (1) |
|
|
63 | (1) |
|
|
63 | (1) |
|
|
63 | (1) |
|
5.7 Ideas for on your own |
|
|
63 | (1) |
|
6 Managing computer accounts |
|
|
64 | (12) |
|
6.1 Creating an AD computer account |
|
|
65 | (4) |
|
Creating a computer account using AD AC |
|
|
65 | (1) |
|
Creating a computer account using ADUC |
|
|
66 | (2) |
|
Creating a computer account using PowerShell |
|
|
68 | (1) |
|
6.2 Joining a computer to the domain |
|
|
69 | (1) |
|
Using GUI tools to join a machine to the domain |
|
|
69 | (1) |
|
Using PowerShell to join a machine to the domain |
|
|
70 | (1) |
|
6.3 Managing the secure channel |
|
|
70 | (2) |
|
6.4 Deleting a computer account |
|
|
72 | (1) |
|
|
73 | (2) |
|
|
73 | (1) |
|
Create computer accounts in bulk |
|
|
73 | (1) |
|
Searching for computer accounts |
|
|
74 | (1) |
|
Managing the secure channel |
|
|
75 | (1) |
|
Deleting computer accounts |
|
|
75 | (1) |
|
6.6 Ideas for on your own |
|
|
75 | (1) |
|
7 Managing organizational units |
|
|
76 | (15) |
|
|
77 | (1) |
|
7.2 Creating an OU with the GUI tools |
|
|
78 | (2) |
|
|
78 | (1) |
|
|
79 | (1) |
|
7.3 Creating an OU with PowerShell |
|
|
80 | (2) |
|
7.4 Protecting OUs from accidental deletion |
|
|
82 | (2) |
|
|
84 | (3) |
|
|
84 | (1) |
|
Adding a description to the OU |
|
|
84 | (1) |
|
Changing the Managed By setting |
|
|
85 | (1) |
|
|
86 | (1) |
|
7.6 Moving objects between OUs |
|
|
87 | (1) |
|
|
88 | (2) |
|
|
88 | (1) |
|
|
88 | (1) |
|
Setting descriptions and Managed By |
|
|
89 | (1) |
|
Moving objects between OUs |
|
|
89 | (1) |
|
|
90 | (1) |
|
7.8 Ideas for on your own |
|
|
90 | (1) |
|
PART 2 MANAGING GROUP POLICY |
|
|
91 | (48) |
|
8 Creating Group Policies |
|
|
93 | (14) |
|
8.1 Group Policy basic concepts |
|
|
93 | (1) |
|
8.2 Creating a Group Policy |
|
|
94 | (5) |
|
Creating a GPO with the GPMC |
|
|
95 | (1) |
|
Creating a GPO with PowerShell |
|
|
96 | (1) |
|
|
97 | (2) |
|
|
99 | (4) |
|
Computer versus user configuration |
|
|
100 | (1) |
|
Designating a GPO for users or computers |
|
|
101 | (1) |
|
|
101 | (2) |
|
8.4 Setting Group Policy preferences |
|
|
103 | (2) |
|
|
105 | (1) |
|
Complete the Try It Now sections |
|
|
105 | (1) |
|
Configuring a Starter GPO |
|
|
105 | (1) |
|
Creating a GPO from a Starter GPO |
|
|
106 | (1) |
|
8.6 Ideas for on your own |
|
|
106 | (1) |
|
9 Managing Group Policies |
|
|
107 | (18) |
|
9.1 Applying or removing a GPO |
|
|
108 | (6) |
|
|
108 | (2) |
|
|
110 | (3) |
|
|
113 | (1) |
|
9.2 Modifying GPO application |
|
|
114 | (6) |
|
|
114 | (2) |
|
|
116 | (2) |
|
|
118 | (2) |
|
|
120 | (1) |
|
9.4 Customizing GPO Refresh settings |
|
|
121 | (1) |
|
|
122 | (2) |
|
Complete the Try It Now sections |
|
|
122 | (1) |
|
Create additional OUs and GPOs |
|
|
123 | (1) |
|
Resultant set of policies |
|
|
123 | (1) |
|
9.6 Ideas for on your own |
|
|
124 | (1) |
|
10 Fine-grained password policies |
|
|
125 | (14) |
|
10.1 Fine-grained password policy concepts |
|
|
125 | (2) |
|
10.2 Creating fine-grained password policies |
|
|
127 | (3) |
|
Creating a PSO using ADAC |
|
|
128 | (1) |
|
Creating a PSO using PowerShell |
|
|
129 | (1) |
|
10.3 Determining policies that exist in the domain |
|
|
130 | (2) |
|
Determining policies using ADAC |
|
|
130 | (1) |
|
Determining policies using PowerShell |
|
|
131 | (1) |
|
10.4 Applying PSOs to users and groups |
|
|
132 | (2) |
|
Applying a PSO using ADAC |
|
|
132 | (1) |
|
Applying a PSO using PowerShell |
|
|
133 | (1) |
|
|
134 | (1) |
|
10.5 Testing the results of a policy applied to a user using PowerShell |
|
|
134 | (1) |
|
|
135 | (2) |
|
Complete the Try It Now sections |
|
|
135 | (1) |
|
|
136 | (1) |
|
Apply fine-grained password policies |
|
|
136 | (1) |
|
Determine a resultant policy |
|
|
136 | (1) |
|
|
137 | (1) |
|
10.7 Ideas for on your own |
|
|
137 | (2) |
|
PART 3 MANAGING THE ACTIVE DIRECTORY SERVICE |
|
|
139 | (134) |
|
11 Creating domain controllers |
|
|
141 | (14) |
|
11.1 Creating writable domain controllers |
|
|
142 | (7) |
|
Installing AD Domain Services role |
|
|
143 | (2) |
|
Performing the domain controller promotion |
|
|
145 | (4) |
|
11.2 Read-Only Domain Controllers |
|
|
149 | (5) |
|
|
149 | (2) |
|
|
151 | (1) |
|
Managing the RODC password policy with PowerShell |
|
|
152 | (2) |
|
|
154 | (1) |
|
Complete the Try It Now sections |
|
|
154 | (1) |
|
Create a domain controller |
|
|
154 | (1) |
|
|
154 | (1) |
|
11.4 Ideas for on your own |
|
|
154 | (1) |
|
12 Managing domain controllers |
|
|
155 | (16) |
|
12.1 Discovering domain controllers |
|
|
155 | (4) |
|
Finding domain controllers |
|
|
156 | (1) |
|
Testing the availability of a domain controller |
|
|
157 | (1) |
|
|
158 | (1) |
|
|
159 | (4) |
|
|
159 | (1) |
|
Creation of a global catalog |
|
|
160 | (2) |
|
|
162 | (1) |
|
|
163 | (6) |
|
Discovering FSMO role holders |
|
|
164 | (2) |
|
|
166 | (2) |
|
|
168 | (1) |
|
|
169 | (1) |
|
Complete the Try It Now sections |
|
|
169 | (1) |
|
|
170 | (1) |
|
|
170 | (1) |
|
12.5 Ideas for on your own |
|
|
170 | (1) |
|
|
171 | (18) |
|
13.1 Protection from accidental deletion |
|
|
172 | (2) |
|
|
172 | (1) |
|
|
173 | (1) |
|
|
174 | (5) |
|
|
174 | (1) |
|
Viewing existing snapshots |
|
|
175 | (1) |
|
|
176 | (1) |
|
Accessing the data from a snapshot |
|
|
177 | (2) |
|
|
179 | (1) |
|
|
179 | (3) |
|
Installing the AD Recycle Bin |
|
|
179 | (1) |
|
Searching for and restoring a user account |
|
|
180 | (1) |
|
|
181 | (1) |
|
Searching for and restoring an OU |
|
|
182 | (1) |
|
|
182 | (5) |
|
Backing up a domain controller |
|
|
183 | (1) |
|
Restoring the AD database |
|
|
184 | (3) |
|
|
187 | (1) |
|
Complete the Try It Now sections |
|
|
187 | (1) |
|
Practice adding and removing protection from accidental deletion |
|
|
187 | (1) |
|
Compare an object in live Active Directory and a snapshot |
|
|
187 | (1) |
|
Restore an OU full of accounts from the AD Recycle Bin |
|
|
188 | (1) |
|
|
188 | (1) |
|
13.6 Ideas for on your own |
|
|
188 | (1) |
|
14 Security: Default groups and delegation |
|
|
189 | (16) |
|
|
190 | (10) |
|
|
191 | (4) |
|
|
195 | (5) |
|
|
200 | (3) |
|
|
203 | (1) |
|
Complete the Try It Now sections |
|
|
203 | (1) |
|
|
204 | (1) |
|
Add an account to a default group |
|
|
204 | (1) |
|
Use the Delegation of Control wizard |
|
|
204 | (1) |
|
14.4 Ideas for on your own |
|
|
204 | (1) |
|
|
205 | (18) |
|
15.1 Overview of DNS and Active Directory |
|
|
205 | (2) |
|
|
206 | (1) |
|
|
207 | (1) |
|
15.2 DNS server administration |
|
|
207 | (7) |
|
Viewing DNS server settings |
|
|
207 | (1) |
|
|
208 | (3) |
|
|
211 | (3) |
|
|
214 | (4) |
|
|
214 | (1) |
|
|
215 | (3) |
|
|
218 | (1) |
|
|
218 | (3) |
|
Testing systems can find a DNS server |
|
|
219 | (1) |
|
|
220 | (1) |
|
|
221 | (1) |
|
Complete the Try It Now sections |
|
|
221 | (1) |
|
|
222 | (1) |
|
|
222 | (1) |
|
15.6 Ideas for on your own |
|
|
222 | (1) |
|
16 Managing sites and subnets |
|
|
223 | (21) |
|
16.1 AD site and subnet concepts |
|
|
223 | (2) |
|
Best practices for managing AD topology |
|
|
225 | (1) |
|
|
225 | (5) |
|
|
226 | (1) |
|
|
227 | (3) |
|
|
230 | (3) |
|
|
230 | (1) |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
233 | (8) |
|
|
233 | (3) |
|
|
236 | (1) |
|
Removing sites from site links |
|
|
237 | (1) |
|
|
237 | (3) |
|
|
240 | (1) |
|
|
241 | (2) |
|
Complete the Try It Now exercises |
|
|
241 | (1) |
|
|
242 | (1) |
|
Bring a new location into your environment |
|
|
242 | (1) |
|
16.6 Ideas for on your own |
|
|
243 | (1) |
|
|
244 | (16) |
|
17.1 How replication works |
|
|
245 | (7) |
|
|
245 | (3) |
|
|
248 | (2) |
|
|
250 | (1) |
|
Global catalog replication |
|
|
251 | (1) |
|
17.2 Configuring replication |
|
|
252 | (1) |
|
17.3 Testing and forcing replication |
|
|
253 | (5) |
|
Testing replication using Repadmin |
|
|
253 | (1) |
|
Testing replication using PowerShell |
|
|
254 | (3) |
|
Forcing replication using Repadmin |
|
|
257 | (1) |
|
Forcing replication with AD Sites and Services |
|
|
257 | (1) |
|
|
258 | (1) |
|
Complete the Try It Now sections |
|
|
258 | (1) |
|
Paper replication exercise |
|
|
258 | (1) |
|
|
258 | (1) |
|
|
259 | (1) |
|
|
259 | (1) |
|
|
259 | (1) |
|
17.5 Ideas for on your own |
|
|
259 | (1) |
|
|
260 | (13) |
|
|
261 | (5) |
|
|
261 | (1) |
|
|
262 | (1) |
|
|
263 | (1) |
|
|
264 | (1) |
|
|
265 | (1) |
|
|
266 | (4) |
|
Create a trust in your domain |
|
|
266 | (3) |
|
Create a trust in a remote domain |
|
|
269 | (1) |
|
|
270 | (2) |
|
|
270 | (1) |
|
|
270 | (1) |
|
|
271 | (1) |
|
|
272 | (1) |
|
Complete the Try It Now exercises |
|
|
272 | (1) |
|
|
272 | (1) |
|
18.5 Ideas for on your own |
|
|
272 | (1) |
|
PART 4 MAINTENANCE AND TROUBLESHOOTING |
|
|
273 | (64) |
|
19 Troubleshooting your AD |
|
|
275 | (20) |
|
|
276 | (7) |
|
Logon problems: Many users |
|
|
276 | (2) |
|
|
278 | (1) |
|
|
279 | (2) |
|
|
281 | (2) |
|
19.2 Computer-related problems |
|
|
283 | (3) |
|
Logon workstation restrictions |
|
|
284 | (1) |
|
Failure to discover a domain controller |
|
|
285 | (1) |
|
|
286 | (6) |
|
|
287 | (2) |
|
|
289 | (3) |
|
|
292 | (1) |
|
Complete the Try It Now exercises |
|
|
292 | (1) |
|
|
293 | (1) |
|
19.5 Ideas for on your own |
|
|
293 | (2) |
|
20 Maintaining and monitoring Active Directory |
|
|
295 | (16) |
|
20.1 Microsoft Operations Framework reliability workbooks |
|
|
296 | (1) |
|
|
297 | (7) |
|
|
298 | (2) |
|
|
300 | (1) |
|
|
301 | (1) |
|
|
302 | (2) |
|
|
304 | (5) |
|
|
304 | (3) |
|
|
307 | (1) |
|
Test domain time synchronization |
|
|
308 | (1) |
|
|
309 | (1) |
|
Complete the Try It Now sections |
|
|
309 | (1) |
|
|
310 | (1) |
|
|
310 | (1) |
|
20.5 Ideas for on your own |
|
|
310 | (1) |
|
21 Future work and final exam |
|
|
311 | (12) |
|
|
312 | (6) |
|
|
312 | (2) |
|
AD Rights Management Service |
|
|
314 | (1) |
|
|
315 | (2) |
|
|
317 | (1) |
|
|
318 | (3) |
|
|
318 | (1) |
|
|
319 | (2) |
|
21.3 Ideas for on your own |
|
|
321 | (2) |
|
|
323 | (14) |
|
|
324 | (2) |
|
|
324 | (1) |
|
|
325 | (1) |
|
22.2 Active Directory in the cloud |
|
|
326 | (3) |
|
All infrastructure in the cloud |
|
|
326 | (1) |
|
Infrastructure on multiple clouds |
|
|
327 | (1) |
|
Infrastructure in data center and cloud |
|
|
328 | (1) |
|
22.3 Windows Azure Active Directory |
|
|
329 | (2) |
|
|
329 | (1) |
|
|
330 | (1) |
|
WAAD compared to Active Directory |
|
|
331 | (1) |
|
|
331 | (4) |
|
|
331 | (2) |
|
|
333 | (2) |
|
|
335 | (2) |
Appendix A Searching Active Directory |
|
337 | (14) |
Appendix B Migrations and upgrades |
|
351 | (12) |
index |
|
363 | |