I’m sometimes asked what the best practice is surrounding the Default Domain Policy and Default Domain Controllers Policy. Microsoft has some good guidance on this topic, but it’s not always clearly and consistently stated. Here’s a quick Q&A that might help. Q. Is it ok to make changes to the DDP and DDCP GPOs,… Read More »
Despite Active Directory having been around for more than 10 years, I still find new implementations proceeding without directory service access auditing enabled. For me, auditing of who does what, where and when in your directory is crucial information. I can’t fully fathom why Microsoft doesn’t have it enabled with some sensible defaults out of the… Read More »
I fell foul of this one the other day and it took a while to figure out what to do about it. Here’s the scenario: You deploy a new Group Policy Preferences (GPP) setting to create a folder on a workstation and specify the “Apply once and do not reapply” option. Unsurprisingly, this implies the… Read More »
I’ve recently been looking at Microsoft’s Security Compliance Manager 3.0. SCM allows provides a rich set of server-role-based security baselines for deployment using either GPO or SCCM. This latest version includes baselines for Windows Server 2012. After deploying the “WS2012 Domain Controller Security Compliance 1.0” baseline settings via GPO into my lab environment I found RDP sessions to… Read More »
You probably know this, but for some reason I only found out about it when someone showed it to me the other day. Anyway, in the interests of sharing…. A really quick way to find the domain password and account lockout policy is to run the following from a CMD prompt: net accounts The output… Read More »
I was recently involved in a task to consolidate an OU structure. Part of this involved moving user objects from one OU to another and re-linking GPOs that were linked to the old OU to the new OU. There were a large number of links and I didn’t fancy adding them manually, so I spent… Read More »
A little while back I posted a Powershell 1.0 script to backup all the GPOs in a domain. Now that Powershell 2.0 is available together with the Group Policy module it is much easier to script Group Policy tasks. The attached script is basically a re-write of my previous script, but now using the… Read More »
I’m finding there is a huge gulf between playing with Windows Server 2008 in a lab and working with it in a production environment. The biggest difference for me is that I typically use a built-in Administrator account in the lab environment, but work with an account with delegated permissions in production. This means I… Read More »
The other day I had a need to configure scheduled backups of GPOs to file on a Windows Server 2008 Domain Controller. Aha (I thought), I’ve done this before using the BackupAllGPOs.wsf script that is included along with a whole bunch of other handy scripts when you install the Group Policy Management Console (GPMC). … Read More »
I encounter a fair number of AD implementations as part of my work. Some are good, some bad and some just plain ugly. Here’s a more or less random collection of bad habits that I see quite regularly and some tips on how to avoid and/or kick them. 1. Poor or missing Active Directory… Read More »