In every AD domain it is possible to implement one or more password and account lockout policies. In W2K/W2K3 AD domains you can only define one password and account lockout policy and in W2K8 AD domains you can define multiple password and account lockout policies. For more info about that see: Windows Server 2008 - Fine-Grained Password ...

Always wanted to have all the information about designing, implementing, using and troubleshooting Group Policy in one place? Well, here it is then. Go and get the Group Policy Survival Guide (HTML) and (PDF)!   Cheers, Jorge -------------------------------------------------------------------------------------------------- * This ...

To audit stuff in Windows Server you first need to configure a main event category to be enabled for ''Successes'' and/or ''Failures''. This must be done through a local GPO on the server or through a GPO in AD which then is linked to an OU containing the servers that should inherit those settings. Which main event category is needed depends on ...

Have you ever wondered how many objects You can create in Your DIT (actually this was showed some time ago by ~Eric) ? Or how many DC is to many in a domain?  For some time now on one of MS internal distribution groups group of folks were discussing document which describes such limits related to AD (BTW - possibility to be a part of such ...

Handling time is somehow challenging task. It can;t be stopped so far so we have to live with schedules and clocks. But this won't be about time physics but more mundane thing. One of my friends has asked me question how to translate pwdLastSet attribute value to some more readable value. My first answer was - what a suprise - adfind.exe. Adfind ...

Last time we discussed how to transition your Active Directory to Windows Server 2008, which was something a lot of you were interested in. This time I'm talking in-place upgrading Windows Server 2003 and Windows Server 2003 R2 Domain Controllers to Windows Server 2008 Domain Controllers. While this might seem like simply feeding the DVD and ...

A while ago, I wrote about the new feature within Windows Server 2008 to reanimate and populate the attributes from a snapshot backup. That post can be found here. I thought it would be interesting to summarize the tools available that can help you recover deleted objects for free. Some of the tools are CLI based and some are GUI based. Again, ...

Both Windows Vista SP1 and Windows Server 2008 allow the configuration of ''Group Policy Prefences'' through the GPMC. With ''Grou Policy Preferences'' you can deploy and manage operating system and application settings. Previously this was not possible or you had to screw around with custom ADM files or scripts. Examples are: mapped drives, ...

A DC (for both RODCs/RWDCs) can be (un)assigned the GC role by just configuring a checkbox in Active Directory Sites And Services or using REPADMIN or some other tool that configures the feature. To switch between a RWDC and a RODC (or the other way around), you must always first demote, reboot and promote to whatever you want.   However, ...

Have you ever had the need to audit when members of specific groups logon to a computer? If yes, unfortunately this is only possible out-of-the-box in both Windows Vista and Windows Server 2008. The feature is called ''Auditing Special Groups'' and you can configure it through the GPMC in Windows Server 2008 and hopelly soon in Windows Vista SP1 ...