Train Signal Training - Free Computer Training Videos » Active Directory Lightweight Directory Services

Active Directory Improvements in Windows Server 2008

Jason Ensinger — Wed, 02 Jul 2008 16:00:03 +0000

In the Beginning …

When Active Directory was first introduced in Windows Server 2000 it quickly became the most widely implemented Network resource management system in use.

By providing a single logon process from the Windows logon prompt on the client side for authenticated access to all resources locally and on the network as well as a single point of administration, it is hard to argue with results.

The first version of Active Directory used an access control list (ACL) to provide an object based method of managing access to network resources.

Still not every business’ needs were met with the initial release of Active Directory.

Certificate Services, Windows’ method of determining access to web based resources such as email, and Microsoft Metadirectory Services (MMS), Windows’ method for providing central access to multiple network directories, were both separate components from Active Directory.

Here and Now …

When Microsoft released Windows Server 2003 Active Directory’s prominence was secured by adhering to the demands of customers for better integration with other network security components.

Microsoft improved the way Active Directory and Certificate Services worked together. MMS was replaced with Microsoft Identity Integration Server (MIIS), which provided even better integration with other directory types.

Additional features were added in the first revision of Server 2003 such as the Authorization Manager and Windows Rights Management Services (RMS).

The Authorization Manager introduces role-based access control (RBAC) which provides the ability for Administrators to group permissions based on job roles allowing for users to be associated with multiple job roles.

RMS provides the administrator with the ability to associate usage polices that adhere to the new information protection laws to resources. RMS works together with Certificate Services and IIS to uphold its policies on the local network and the World Wide Web.

In Server 2003 Revision 2, Active Directory Federation Services (ADFS) and Active Directory Applications Mode (ADAM) were introduced.

ADFS extends the convenience of Active Directory’s single sign-on authentication to the web by creating a single user session that can be used across multiple web applications.

ADAM was introduced so directory-enabled applications could take advantage of Active Directory’s access control without requiring an actual domain or domain controller.

Windows Server 2008

In Windows Server 2008 Active Directory has continued on its path of integration with its latest family of components. Active Directory components are now available as server roles, which I have listed below:

Active Directory Domain Services (AD DS)

Active Directory Certificate Services (AD CS)

Active Directory Lightweight Directory Services (AD LDS)

Active Directory Federation Services (AD FS)

Active Directory Rights Management Services (AD RMS)

As you have probably noticed, the server roles listed above all contain Active Directory in the name. The new Active Directory roles provide the same functionality of the many identity access components from previous Windows Server versions, but with new names.

Active Directory Domain Services (AD DS)

Active Directory Domain Services is the new name for Active Directory Directory Services and remains the core Active Directory Component. Aside from the improvements to the user interface, there are four major improvements to AD DS which I will go over below.

Read-only domain controllers (RODC) – provide reliable security to insecure environments by replicating a writable domain controller.

Changes cannot be made to a RODC and only the user credentials used with the RODC are stored on the server. This makes it so the whole directory would not need to be rebuilt if security on the RODC were to be breeched.

Auditing enhancements – there are now four different auditing categories: Directory Service Access, Directory Service Changes, Directory Service Replication and Detailed Directory Service Replication.

This allows for better event searching and logging policy management.

Granular password and account lockout policies – domains are no longer limited to a single password or lockout policy. Multiple policy objects can now be saved to a domain and applied to groups or users.

Restartable AD DS – you can now perform maintenance on AD DS by simply stopping the Domain Controller Service.

Before you had to reboot the machine and start in Directory Services Restore Mode to perform maintenance which led to more down time.

Active Directory Certificate Services (AD CS)

Certificate Services is named Active Directory Certificate Services in Server 2008. There are several notable improvements to AD CS. I have listed the major changes below.

Certificate Web enrollment support improvements – the ActiveX control for Web enrollment, XEnroll.dll, has been replaced with the COM control, CertEnroll.dll. The new control is more secure and manageable.

Network device enrollment support – AD CS now provides built in support for issuing certificates to network devices to allow applications using the device to interact with other network entities.

Online certificate status protocol (OCSP) support – Server 2008 includes this as an optional role service.

OCSP checks a certificates status for revocation prevent clients from having to download the entire certificate revocation list, thus improving network performance.

Enterprise PKI (PKIView) – PKI Health has a new name and can now be used as an MMC snap-in. This tool is used for troubleshooting and monitoring the health of certificates and certificate authorities.

CAPI2 Diagnostics – a new PKI troubleshooting feature that performs highly detailed logging for several validation processes.

Active Directory Lightweight Directory Services (AD LDS)

Active Directory Lightweight Directory Services (AD LDS) is the new name for Active Directory Application Mode (ADAM).

AD LDS is essentially the same as ADAM except for it is now available as an in-box role in Server 2008 where it needed to be downloaded from the Microsoft Download Center in Server 2003.

As mentioned previously, but referring to ADAM, AD LS is a stripped down version of AD DS designed to be used in applications. Many CRM and HR applications use Active Directory for storing their data. AD LDS can be used instead of AD DS making it possible for these applications to be used without needing to configure access to network resources.

Active Directory Federation Services (AD FS)

The name for Active Directory Federation Services (AD FS) remains the same, save the addition of a space in the acronym.

AD FS allows for businesses to set up trust relationships with other directories, thus enabling the other directory’s user’s credentials to be used across directories. While there is little change to the name, a couple notable improvements have been made which I will go over below.

Federation trust import/export support – before the process of configuring federation trusts was a long manual process. The manual process is still long, however once set up; settings can be exported and then imported to other AD FS Servers.

AD FS deployment limiting – a group policy can be applied to disable deployment of AD FS servers on Windows Server 2008.

Active Directory Rights Management Services (AD RMS)

The follow-up to Windows RMS is Active Directory Rights Management Services (AD RMS).

The purpose of AD RMS remains the same as its predecessor. It is now integrated with Office 2007 and Internet Explorer 7 for securing sensitive information hosted on the server. For example, rights can be applied to emails to prevent recipients from forwarding messages.

AD RMS is available as a role in Server 2008 and now includes an MMC snap-in for administration as opposed to a Web-based interface.

Still More to Come …

The Preceding components are the five Active Directory components released in Windows Server 2008. This year, MIIS has been updated for Server 2003 under the title Identity Lifecycle Manager. An updated release for Server 2008 code-named Identity Lifecycle Manager 2 is currently in beta.

Notable new features available to this release include administration from a GUI and SharePoint Services as well as an approval request process for content available from Office 2007 applications. You can find out more about Identity Lifecycle Manager 2 here.

While it would be nice to have had the release of Identity Lifecycle Manager included with Server 2008, it goes to show you that Microsoft knows it’s work is never finished and will keep improvements to Active Directory coming.

Windows Server 2008 Active Directory Training — Now Available!

Get complete coverage for the new 70-640 exam and get started on your MCITP certification.

Master Active Directory terms, learn about creating, organizing, and managing Users and Groups, installing and upgrading Domain Controller and much more — all on Windows Server 2008.

Role Playing with Windows 2008 Server Core

Brian Nelson — Wed, 09 Apr 2008 15:00:16 +0000

Ok, you’ve installed Windows Server 2008 Core, and it is pretty awesome.

Those lower-level administrators that run to Ted whenever things get tough have stood before the daunting black command-line box and trembled in fear at the blinking white cursor. You sneered as you waited to see if they would break down and cry at the prospect of being without their precious mouse.

But, you’re getting tired of just showing off your GUI-less install. It’s time to take this server out for a spin and see what it can do.

If you aren’t sure what role you want to assign yet, you can just play around with it, "role playing," if you will. Hah! Ok, it isn’t that funny, but a no-GUI sever isn’t that great until it can do something either.

It needs to have a role installed.

Installing a role in a Server 2008 full install is so easy a 1st Level Magic-User Dwarf could do it (more role playing, heh).

Just open up Server Manager and a few clicks later you’ve got a role installed or uninstalled.

Obviously, on a server without a GUI, Server Manager is out … or is it?

Available Roles

On a Windows Server 2008 Core install, just eight roles are available. All other roles take too many dependent processes or are too complicated themselves to reside on a core install. The available roles are:

Active Directory
Active Directory LDS
DHCP Server
DNS Server
File Services
Print Services
Streaming Media Services
Windows Server Virtualization

Server Manager Command-Line Style

The beta testing phase for Server 2008 was much longer than usual. As a result, the engineers at Microsoft got some extra time to code in features. One of those features was a command line interface for Server Manager.

That command is servermanagercmd.exe and it is great for scripting all sorts of commands and even for installing and removing roles.

Since you are a hard-core administrator, you already know all about servermanagercmd and you don’t need no stinkin’ GUI. So, you start typing …

"What the–?" Although servermanagercmd is a command-line utility, it is still part of the very extensive Server Manager program. Unfortunately, Server Manager has too many dependencies on APIs and processes that are not installed on Server Core, so servermanagercmd is out.

Instead, Microsoft has supplied another lower-level command that does not have the dependencies of Server Manger. The command, ocsetup.exe, and its partner in crime, oclist.exe provide the functionality to install server roles.

Neither of these commands exists on a full install of Windows Server 2008, so you’ll have to stick with servermanagercmd for command-line execution on a full install.

Oclist.exe and Ocsetup.exe

Grab your trusty TechNet CD and punch in your query. Installing a role on a Server Core install takes a command called ocsetup.exe. Check out the syntax:

c:\Windows\System32\>start /w ocsetup DNS-Server-Core-Role

The /w switch makes sure that control doesn’t come back to the command prompt until ocsetup has finished executing. This is a good thing because it can take a few minutes to complete installing the role and this way things won’t get messed up by moving on to the next step before the install is complete.

I know what you are thinking, "Yea, though I walk through the Valley of the Shadow of No-GUI, I shall fear no administration task, for I am the meanest administrator in the Valley." You figure you’ll memorize "DNS-Server-Core-Role" so that you never again need to go back into your TechNet to install a role. Ted would want it that way.

Think again, Super-Admin. For some inexplicable reason the ocsetup command is CaSe SensaTive! Not only that, but there is no logic to the naming of the roles. You’re thinking that if DNS Server is DNS-Server-Core-Role then DHCP Server must be DHCP-Server-Core-Role, right? Bzzzz! Wrongo! Hey, where did Ted get that buzzer from anyway?

Installing the DHCP Server role actually takes the parameter DHCPServerCore – no hyphens, no "Role." With eight different roles available on Server Core, you could memorize them all, but then again, there is Super-Admin and then there is Computer Nerd With No Life. You don’t want to go there.

Instead, we turn to the oclist.exe command. Oclist covers much of the role played by servermanagercmd -query over in the full installation world. Type oclist.exe and after a brief delay all the roles and features available are listed along with whether or not they are installed. The way they are displayed, is the way they have to be typed in. No need to memorize.

The Active Directory Role

With ocsetup and oclist you can install all of the roles available on Server Core except for the Active Directory role. The Active Directory role requires more than just copying new files and starting a service. The server must also be promoted.

So, the command necessary for installing the Active Directory role is dcpromo.exe. But, there is a catch (of course there is). Typing dcpromo launches the GUI for promoting and demoting servers. This is Server Core, so there is no GUI.

The trick is to run dcpromo in unattended mode. That way it doesn’t bother trying to launch the GUI. The unattended mode is triggered by the /unattend switch and takes an input parameter of a text file. That text file must contain the input normally provided by clicking around the GUI. So, assuming our input text file is named inputfile.txt then the syntax is:

dcpromo /unattend:inputfile.txt

The format of the text file is fairly simple. It starts with "[DCInstall]" and then each parameter with an equals sign, followed by the value you with to set. So, something like this:

[DCInstall]
UserName=Ted
Password=*
SiteName=TheSite
NewDomain=DomainName
NewDomainDNSName=ourcompany.com

… and so on. Depending on the structure of your enterprise, your inputfile.txt file can be very long (or very short).

Microsoft provides a full list of parameters, their function, and use with the "Appendix of Unattended Installation Parameters" under "Windows Server 2008 Technical Library > Active Directory Domain Services > Getting Started: AD DS > Step-by-Step Guide for Windows Server 2008 Active Directory Domain Services Installation and Removal" either online or on TechNet. (You may have to use the Table of Contents Panel to navigate there online.)

With a server role installed, your Windows Server Core install is ready for the big-time, just like your 11th Level Paladin. Now if we can just find out where Ted keeps that buzzer…

Windows Server 2008 Active Directory Training — Now Available!

Get complete coverage for the new 70-640 exam and get started on your MCITP certification.

Master Active Directory terms, learn about creating, organizing, and managing Users and Groups, installing and upgrading Domain Controller and much more — all on Windows Server 2008.

Installing Remote Server Administration Tools for Windows Vista

Dave Lawlor — Thu, 03 Apr 2008 15:00:57 +0000

Remote Server Administration Tools was released by Microsoft for Windows Vista SP1 users to be able to manage both Windows 2003 and Windows 2008 Servers.

If you had upgraded to Vista in the past and wanted to manage Windows servers with your Vista client, you were able to with some hacks. But all in all it was a very painful process and a lot of administrators had to run a Windows XP machine virtually or have a second box to do server administrative tasks.

Now that the RSAT is released for general consumption what can it do?

Remote Server Administration Tools for Roles

Active Directory Certificate Services Tools – includes the Certification Authority snap-in, the Certificate Templates snap-in, the Enterprise PKI snap-in, and the Online Responder Management snap-in.

Active Directory Certification Authority Tools includes the Certification Authority, Certificate Templates, and Enterprise PKI snap-ins.

Online Responder Tools includes the Online Responder Management snap-in.

Active Directory Domain Services (AD DS) Tools – includes snap-ins and command-line tools for remotely managing Active Directory Domain Services.

Active Directory Domain Controller Tools includes Active Directory Users and Computers, Active Directory Domains and Trusts, Active Directory Sites and Services, and other snap-ins and command-line tools for remotely managing AD DS.

Server for Network Information Service (NIS) Tools includes an extension to the Active Directory Users and Computers snap-in, and the ypclear.exe command-line tool.

Active Directory Lightweight Directory Services (AD LDS) Tools – includes Active Directory Sites and Services, Active Directory Service Interfaces (ADSI) Edit, Schema Manager, and other snap-ins and command-line tools for managing AD LDS.

DHCP Server Tools – includes the DHCP snap-in.

DNS Server Tools – includes the DNS Manager snap-in and dnscmd.exe command-line tool.

File Services Tools – includes the following, along with the storagemgmt.msc snap-in:

Distributed File System Tools includes the DFS Management snap-in, and the dfsradmin.exe, dfscmd.exe, dfsdiag.exe, and dfsutil.exe command-line tools.

File Server Resource Manager Tools includes the File Server Resource Manager snap-in, and the filescrn.exe and storrept.exe command-line tools.

Share and Storage Management Tools includes the Share and Storage Management snap-in.

Terminal Services Tools – includes the Remote Desktops and Terminal Services Manager snap-ins.

Universal Description, Discovery, and Integration (UDDI) Services Tools - includes the UDDI Services snap-in.

Microsoft Remote Server Administration Tools for Features

BitLocker Drive Encryption Tools – includes the manage-bde.wsf script.

Failover Clustering Tools – includes the Failover Cluster Manager snap-in and the cluster.exe command-line tool.

Group Policy Management Tools – includes Group Policy Management Console, Group Policy Management Editor, and Group Policy Starter GPO Editor.

Network Load Balancing Tools – includes the Network Load Balancing Manager snap-in, the nlb.exe and wlbs.exe command-line tools, and wlbsctrl.dll.

SMTP Server Tools – includes the Simple Mail Transfer Protocol (SMTP) snap-in.

Storage Manager for SANs Tools – Tools includes the Storage Manager for SANs snap-in, and the provisionstorage.exe command-line tool.

Windows System Resource Manager Tools – includes the Windows System Resource Manager snap-in and the wsrmc.exe command-line tool.

Installing Remote Server Administration Tools for Vista

There are two versions of the RSAT tool, one for 32-bit machines and one for 64-bit machines. You can download the version you need at their respective download locations:

Download: Remote Server Administration Tools (x86)
Download: Remote Server Administration Tools (x64)

Once you download the file go ahead and give it a left click … c’mon … you know you want to! After clicking the file you will see it preparing the installation and doing a search to make sure your copy of Vista is prepared for the remote server admin tools.

After a bit you will get a prompt to install Update for Windows (KB941314)

After clicking Ok, you will now get prompted to read the license terms, in this case it is a simple paragraph that I actually read, that said if you are using an illegal copy you can’t use this software.

Since I am lucky enough to be using a legal copy I let off a sigh of relief and plunged ahead by clicking I Accept

Now it will begin Initializing installation and applying updates

After it is done installing you will see the Installation Complete screen:

Now when you go to Start->Administrative Tools you will see the following help file: Remote Server Administration Tool

When you click on it you will be able to read all about using Remote Server Administration Tool goodness. But instead of wasting your time reading that, I went through some of it above and will show some examples below here so you don’t have to!

The one thing you don’t see is any of the additional tools for administrating your Windows Servers, but that’s because you still have to enable them.

Now let’s go in and enable Remote Server Administration Tools in the control panel so you can use them: Start->Control Panel

Next you will see the control panel, go ahead and click on Programs

Click on Program & Features

On the left pane click on Turn Windows features on or off

Note: If you are prompted by UAC go ahead and click Ok

In the Windows Features window you can scroll down until you see Remote Server Administration Tool.

At this point you can install all the features, by checking the box, or you can expand out both the Feature Administration Tools & Role Administration Tools and only install the tools you wish to use. For our example I am going install them all!

Once you hit OK, you will see a window that shows it is configuring Vista with the features selected.

Now that it is enabled lets go back in to the Administrative Tools to see if anything is different?

Seems like everything was loaded correctly! Let’s take this baby for a test drive …

RSAT Terminal Services Manager in Vista

This section of the article will walk you through starting Terminal Services Manager and connecting to a remote Windows 2008 Server.

Go to your Administrative tools and go Terminal Services->Terminal Services Manager

You will see the following MMC open.

Note: You may be prompted by UAC, go ahead and click Ok

When you run Terminal Services Manager the first time (and every time if you don’t disable it) you get prompted by a warning that certain features are disabled when run from the console session.

If you wish to disable this, go ahead and check In the future, do not show this message and click Ok

As you can see this MMC is in the new Server 2008 layout. Let’s go ahead and click Connect to Computer in the right Actions pane

In the next window you can either connect to the local computer, or another computer. In this case I am going to enter an IP address to the test Windows Server 2008 I am running and click Ok

It connects successfully as you can see and I can tell that I already have a session on the test server through RDP.

There is a lot more to see in the MMC but I just wanted to demonstrate the functionality of administrating from Vista, and will have to cover actual usage in a future article.

As you can see RSAT brings a much overdue set of tools for System Administrators that will cut down on having to keep separate machines running just to do simple administrator tasks.

Learn Vista Administration and Support with Windows Vista Training — Available Now!

Master Windows Vista and prepare for your 70-620 Configuring Windows Vista Exam.

Learn how to make administration easier, how to secure and backup your system, maximize performance and more!