I’m a Directory Services MVP. Have been for the last three years, too. This expertise is part of the Identity and Access area together with the ForeFront, ForeFront Identity Manager (FIM) and Enterprise Security MVPs. These latter guys and girl are really great. One of my favorite Enterprise Security MVPs is Paula Januszkiewicz. I’ve had the ...

In the past 11 years, Microsoft has released four versions of Windows Server on which you could install Active Directory. On all these platforms, Microsoft offered two ways to promote a server to a Domain Controller. In this blogpost I’ll reveal the differences between the advanced mode and normal mode for dcpromo.exe for the Windows Server 2003 ...

Whenever a worm utilizes the normal access and daily tools systems admins use, there is a significant problem. After all, shutting down the attack vector suddenly isn’t that easy. So, without making dramatic changes to your environment, how can you rest assured?     About Win32/Morto.A One of the latest threats to use ...

Those of you running Domain Controllers with full installations of Windows Server 2008 R2 or are managing Windows Server 2008 R2-based Domain Controllers using the Remote Server Administration Tools (RSAT) on Windows 7, might have seen the following configuration warning in the Active Directory Best Practice Analyzer (AD BPA): About the Protect ...

Since Windows Server 2008, Microsoft no longer offers the ability to restart a Domain Controller in Directory Services Restore Mode (DSRM) from the default F8 boot menu. About Directory Services Restore Mode For Windows Server-based Domain Controllers, a special startup mode exists, where the Active Directory database isn’t loaded. This startup ...

Microsoft has included numerous features in Active Directory the last couple of years. Also, more and more technologies in products like Exchange Server, SharePoint Server and the Windows client (Windows Vista, Windows 7) have an Active Directory opt-in to store information in Active Directory. All this bountiful integration, however, comes with ...

Yesterday, the Dutch Networking User Group (NGN) organized the day filled with sessions on Windows Server 2008 R2, I blogged about earlier. I delivered a  30-minute session on Active Directory features in Windows Server 2008 R2, followed by 30 minutes of Group Policy Goodness by Raymond Comvalius and rounding off the morning sessions ...

I’ve been working with Active Directory Administrative Center (ADAC) for a while now, but didn’t have time to look at Delegation of Control lately. Yesterday I finally came round to configuring it and was baffled by a serious issue: After delegating Account creation to a user, installing the Remote Server Administration Tools (RSAT) on the ...

Server Core installations were a new feature in Windows Server 2008. Now, in Windows Server 2008 R2, it has been given a major upgrade. It now includes the .Net Framework, Active Directory Certificate Services, etc. (for a full list, see this blogpost) Over three years ago I showed you how to install a Server Core Domain Controller in Windows ...

Active Directory relies on accurate time for a number of reasons. One of this reasons is Kerberos authentication, which by nature can only cope with a difference in time (time skew) of five minutes between the Kerberos server and client. Now, don’t get me wrong. I think the time skew limitation and the overall Kerberos implementation as we know ...