Category Archives: Active Directory

ADMT 3.1 is Available for Download

The long awaited new version of Microsoft’s Active Directory Migration Tool is now available for download from: http://www.microsoft.com/downloads/details.aspx?FamilyID=ae279d01-7dca-413c-a9d2-b42dfb746059&displaylang=en The most important feature of the new version is is the ability to migrate to Windows Server 2008 Functional Level domains. This was not possible with version 3.0. If you need to copy passwords as part… Read More: ADMT 3.1 is Available for Download »

New look for GPOGUY.COM

Those of you familiar with Darren Mar-Elia’s excellent resource site GPOGUY.COM will notice the site has had a complete face-lift. This comes as part of a recent collaboration with the ActiveDir.org AD resource site. I’d like to say it was all my own work, but Matty Holland deserves the kudos for developing the shared… Read More: New look for GPOGUY.COM »

Protection from Accidental Deletion

One of the improvements to Active Directory Users and Computers (DSA.MSC) in Windows Server 2008 is the "protection from accidental deletion" feature. This blog article explains what the feature is and how it works under the hood. Probably the most common cause of restore operations in AD is accidental deletion of objects. Administrators with fat… Read More: Protection from Accidental Deletion »

Administrator Role Separation in Windows Server 2008

Those of you already familiar with Windows Server 2008 will know that one of the key Active Directory-related improvements is the introduction of the Read-Only Domain Controller (RODC). With the RODC comes the ability to separate administrative roles. This removes the restriction of having to use a Domain Administrators account when carrying out administrative tasks… Read More: Administrator Role Separation in Windows Server 2008 »

My failed attempt to break aDDS using oWNER RIGHTS

Windows Server 2008 introduces a new security principal called OWNER RIGHTS. It was introduced to fill a security and delegation loophole in previous versions of Windows whereby creators of objects potentially inherit more permissions than are intended. For detailed information on how the new feature works in the context of AD, see Jorge’s blog entry… Read More: My failed attempt to break aDDS using oWNER RIGHTS »