Changes in Functionality from Windows Server 2003 with sp1 to Windows Server 2008
What settings have been added or changed?
Download 1.83 Mb.
|
- Navigate this page:
- How should I prepare to deploy this feature
- AD DS: Restartable Active Directory Domain Services
- Who will be interested in this feature
- What new functionality does this feature provide
- What existing functionality is changing
- AD DS: Database Mounting Tool
- What does the Active Directory database mounting tool do
- Are there any special considerations
- AD DS: User Interface Improvements
- What do AD DS user interface improvements do
What settings have been added or changed?To support the RODC Password Replication Policy, Windows Server 2008 AD DS includes new attributes. The Password Replication Policy is the mechanism for determining whether a user's credentials or a computer's credentials are allowed to replicate from a writable domain controller to an RODC. The Password Replication Policy is always set on a writable domain controller running Windows Server 2008. AD DS attributes that are added in the Windows Server 2008 Active Directory schema to support RODCs include the following: msDS-Reveal-OnDemandGroup msDS-NeverRevealGroup msDS-RevealedList msDS-AuthenticatedToAccountList For more information about these attributes, see the Step-by-Step Guide for Planning, Deploying, and Using a Windows Server 2008 Read-Only Domain Controller (http://go.microsoft.com/fwlink/?LinkId=87001).
The RODC must forward authentication requests to a writable domain controller running Windows Server 2008. The Password Replication Policy is set on this domain controller to determine if credentials are replicated to the branch location for a forwarded request from the RODC. The domain functional level must be Windows Server 2003 or higher so that Kerberos constrained delegation is available. Constrained delegation is used for security calls that must be impersonated under the context of the caller. The forest functional level must be Windows Server 2003 or higher so that linked-value replication is available. This provides a higher level of replication consistency. You must run adprep /rodcprep once in the forest to update the permissions on all the DNS application directory partitions in the forest. This way, all RODCs that are also DNS servers can replicate the permissions successfully.
What does restartable AD DS do?Restartable AD DS reduces the time that is required to perform certain operations. AD DS can be stopped so that updates can be applied to a domain controller; also, administrators can stop AD DS to perform tasks such as offline defragmentation of the Active Directory database, without restarting the domain controller. Other services that are running on the server and that do not depend on AD DS to function, such as Dynamic Host Configuration Protocol (DHCP), remain available to satisfy client requests while AD DS is stopped. Who will be interested in this feature?Restartable AD DS provides benefits for: Security update planners and administrators AD DS management teams AD DS administrators Are there any special considerations?Restartable AD DS is available by default on all domain controllers that run Windows Server 2008. There are no functional-level requirements or any other prerequisites for using this feature. What new functionality does this feature provide?In Active Directory in the Microsoft® Windows® 2000 Server operating system and Windows Server® 2003 operating system, offline defragmentation of the database required a restart of the domain controller in Directory Services Restore Mode. Applying security updates also often required a restart of the domain controller. In Windows Server 2008, however, administrators can stop and restart AD DS. This makes it possible to perform offline AD DS operations more quickly. Restartable AD DS adds minor changes to existing MMC snap-ins. A domain controller running Windows Server 2008 AD DS displays Domain Controller in the Services (Local) node of the Component Services snap-in and the Computer Management snap-in. By using either snap-in, an administrator can easily stop and restart AD DS the same way as any other service that is running locally on the server.
The three possible states for a domain controller running Windows Server 2008 are as follows: AD DS Started. In this state, AD DS is started. For clients and other services running on the server, a Windows Server 2008 domain controller running in this state is the same as a domain controller running Windows 2000 Server or Windows Server 2003. AD DS Stopped. In this state, AD DS is stopped. Although this mode is unique, the server has some characteristics of both a domain controller in Directory Services Restore Mode and a domain-joined member server. As with Directory Services Restore Mode (DSRM), the Active Directory database (Ntds.dit) on the local domain controller is offline. Another domain controller can be contacted for logon if one is available. If no other domain controller can be contacted, you can use the DSRM password to log on to the local domain controller in DSRM. As with a member server, the server is joined to the domain. This means that Group Policy and other settings are still applied to the computer. However, a domain controller should not remain in this state for an extended period of time because in this state it cannot service logon requests or replicate with other domain controllers. Directory Services Restore Mode. This mode (or state) is unchanged from Windows Server 2003. The following flowchart shows how a domain controller running Windows Server 2008 can transition between these three possible states. 
AD DS: Database Mounting ToolThe Active Directory® database mounting tool (Dsamain.exe) can improve recovery processes for your organization by providing a means to compare data as it exists in snapshots or backups that are taken at different times so that you can better decide which data to restore after data loss. This eliminates the need to restore multiple backups to compare the Active Directory data that they contain.  Note
During product development, this feature has also been known by previous code names, including Snapshot Viewer and Active Directory data mining tool. By using the Active Directory database mounting tool, you can examine any changes that are made to data that is stored in Active Directory Domain Services (AD DS). For example, if an object is accidentally modified, you can use the Active Directory database mounting tool to examine the changes and help you better decide how to correct them if necessary.
Active Directory had to be restarted in Directory Services Restore Mode to perform an authoritative restore. An administrator could not compare data in backups that were taken at different points in time (unless the backups were restored to various domain controllers, a process which is not feasible). The purpose of the Active Directory database mounting tool is to expose AD DS data that is stored in snapshots or backups online. Administrators can then compare data in snapshots or backups that are taken at different points in time, which in turn helps them to make better decisions about which data to restore, without incurring service downtime. Who will be interested in this feature?The following individuals should review this information about the Active Directory database mounting tool: Information technology (IT) planners and analysts who are technically evaluating the product Enterprise IT planners and designers for organizations Administrators, operators, and managers who are responsible for IT operations, including recovery of deleted AD DS data Are there any special considerations?There are two aspects to the problem of recovering deleted data: Preserving deleted data so that it can be recovered Actually recovering deleted data when it is required The Active Directory database mounting tool makes it possible for deleted AD DS or Active Directory Lightweight Directory Services (AD LDS) data to be preserved in the form of snapshots of AD DS that are taken by the Volume Shadow Copy Service (VSS). The tool does not actually recover the deleted objects and containers. The administrator must perform data recovery as a subsequent step. You can use a Lightweight Directory Access Protocol (LDAP) tool such as Ldp.exe, which is a tool that is built into Windows Server 2008, to view the data that is exposed in the snapshots. This data is read-only data. By default, only members of the Domain Admins and Enterprise Admins groups are allowed to view the snapshots because they contain sensitive AD DS data. Safeguard the AD DS snapshots from unauthorized access just as you protect backups of AD DS. A malicious user who has access to the snapshots can use them to reveal sensitive data that might be stored in AD DS. For example, a malicious user might copy AD DS snapshots from forest A to forest B, and then use Domain Admin or Enterprise Admin credentials from forest B to examine the data. Use encryption or other data security precautions with AD DS snapshots to help mitigate the chance of unauthorized access to AD DS snapshots. How should I prepare to deploy this feature?The process for using the Active Directory database mounting tool includes the following steps: 1. Although it is not a requirement, you can schedule a task that regularly runs Ntdsutil.exe to take snapshots of the volume that contains the AD DS database. 2. Run Ntdsutil.exe to list the snapshots that are available, and mount the snapshot that you want to view. 3. Run Dsamain.exe to expose the snapshot volume as an LDAP server. Dsamain.exe takes the following arguments: AD DS database (Ntds.dit) path. By default this path is opened as read-only, but it must be ASCII. Log path. This can be a temporary path, but you must have write access. Four port numbers for LDAP, LDAP-SSL, Global Catalog, and Global Catalog–SSL. Only the LDAP port is required. If the other ports are not specified, they use LDAP+1, LDAP+2, and LDAP+3, respectively. For example, if you specify LDAP port 41389 without specifying other port values, the LDAP-SSL port uses port 41390 by default, and so on. To stop Dsamain, press CTRL+C in the Command Prompt window or, if you are running the command remotely, set the stopservice attribute on the rootDSE object. 4. Run and attach Ldp.exe to the snapshot’s LDAP port that you specified when you exposed the snapshot as an LDAP server in the previous step. 5. Browse the snapshot just as you would with any live domain controller. If you have some idea which OU or objects were deleted, you can look up the deleted objects in the snapshots and record the attributes and back-links that belonged to the deleted objects. Reanimate these objects by using the tombstone reanimation feature. Then, manually repopulate these objects with the stripped attributes and back-links as identified in the snapshots. Although you must manually recreate the stripped attributes and back links, the Active Directory database mounting tool makes it possible for you to recreate deleted objects and their back-links without restarting the domain controller in Directory Services Restore Mode. You can also use the tool to look up aspects of previous configurations of AD DS as well, such as permissions that were in effect.
AD DS UI improvements also provide new management options for AD DS features such as read-only domain controllers (RODCs). Additional changes to the management tools improve the ability to find domain controllers throughout the enterprise. They also provide important controls for new features such as the Password Replication Policy for RODCs. Directory: uploads uploads -> 587 Return function, r i(X) r i(0) r i(1) r i(2) r i(3) 1 0 2 4 6 Thermal Station, I 2 0 1 5 6 3 0 3 5 6 10 uploads -> Department of science and humanities department of mathematics part-a questions and answers uploads -> The Case Against the nypd’s Quota-Driven ‘Broken Windows’ Policing What Is It? uploads -> For want of a nail uploads -> Ownership Models There are two different types of ownership models uploads -> Police Militarization uploads -> City of rising star regular meting thursday, july 14, 2016 uploads -> Township of winfield uploads -> Stop Militarizing Law Enforcement Act of 2014 uploads -> The Black Panther Party’s Ten-Point Program What We Want Now! Download 1.83 Mb. Share with your friends:
|