Windows by default has a mechanism to notify a user when the password is going to expire. By default Windows will start notifying the user 14 days before the password really expires and must be changed. The default value is affective when no other value has been configured in some GPO in AD. If you want to configure a value in a GPO, you can do so ...

A few days ago I was chatting with a colleague of mine in the UK about automated permissions assignment in AD through DSACLS. His reason to do this was because of CLM deployments where you had to use different kinds of Extended Rights that are defined in AD throughout the AD environment. Each AD deployment by default contains a set of Extended ...

In this post I explain what you can do with ADMTv3 and what you cannot do. Additionally I also define common migration steps and provide links to other information sources. ADMTv3.1 has been released a few days ago and it now supports Windows Server 2008 based servers. If you need to use ADMT on W2K3 use ADMTv3 and look at this post. Like ...

Nathan Muggli, a PM at Microsoft in the AD product group blogged about a cool way to deploy RODC using Hyper-V and PowerShell in an automated way.   Read it here.   Cheers, Jorge -------------------------------------------------------------------------------------------------- * This posting is provided ''AS IS'' with no ...

Microsoft released a KB article that describes issues/symptoms with legacy OSes and the Windows Server 2008 RODC including possible workarounds. You can find that KB article here (Description of the Windows Server 2008 read-only domain controller compatibility pack for Windows Server 2003 clients and for Windows XP clients)   Cheers, ...

To audit stuff in Windows Server you first need to configure a main event category to be enabled for ''Successes'' and/or ''Failures''. This must be done through a local GPO on the server or through a GPO in AD which then is linked to an OU containing the servers that should inherit those settings. Which main event category is needed depends on ...

Have you ever had the need to audit when members of specific groups logon to a computer? If yes, unfortunately this is only possible out-of-the-box in both Windows Vista and Windows Server 2008. The feature is called ''Auditing Special Groups'' and you can configure it through the GPMC in Windows Server 2008 and hopelly soon in Windows Vista SP1 ...

This post is an updated version of the following post and now contains RTM information: Windows Server Longhorn – Reanimating Objects and Restoring Additional Information   Reanimating Objects and Restoring Additional Information Basically when restoring deleted objects you have two choices. You either authoritatively restore the ...

In addition to a previous post a did, I would like to point you to a Microsoft blog about the Windows Time Service (W32TIME). That blog contains interesting information. My favorite posts on that blog are: Keeping the Domain On Time (Explaining how Windows Time Service works in an AD forest) Configuring the Time Service: NtpServer and ...

During one of the AD Q&A sessions at TechED IT Forum I was kind of surprised that people did not know about a simple ''save you're a$$ method'' when recovery of objects was needed and especially those objects that contain back-links. The recovery of objects is explained in MS-KBQ840001 Basically it is a PITA to recover deleted objects ...