Active Directory 2008 : Proactive Directory Maintenance and Data Store Protection (part 1) - Twelve Categories of AD DS Administration

In a web service, you must divide responsibilities based on data and service management. IT is responsible for service management, whereas the users are responsible for data or content management. The same applies to the directory service. AD DS is a distributed database that contains information about the users, computers, servers, services, and more that run in your network, hence its categorization as a network operating system (NOS) as well as a Lightweight Directory Access Protocol (LDAP) directory service. Because of this, administration activities are shared among several members of your organization:

• Users can update their own records. If a user uses the Search Active Directory feature to locate his or her own account record, he or she can change information such as phone number, location, and so on.

  
  

  

  
  

• Security and distribution group managers, when assigned the role in AD DS, can automatically manage group content if you assign this user right to them. This is a good approach for reducing the workload system administrators face when managing a NOS directory service. How would you know whether a user should be a member of a group? In every case, when you change group ownership, you respond to a request that was initiated by someone else. Why not cut out the middle person and make group managers directly responsible?

  
  

  

  
  

• The help desk manages password resets. Each time a password must be reset, the help desk is involved.

• System administrators should focus most of their efforts on directory and DNS service availability. After all, system administrators are there to manage the availability of services and the data the directory contains, not to manage the data itself.

When you plan your proactive management strategy, focus on the service aspect of operations management and delegate data management as much as possible. AD DS delegation capabilities further enhance this model by allowing you to assign object control to others in your organization discretely.

1. Twelve Categories of AD DS Administration

When you consider it, Active Directory administration or management covers 12 major activities. These activities and their breadth of coverage are described in Table 1, which also outlines which tasks focus on data or content management and which are concentrated on service administration.

Depending on the size of your network, each of the activities included in Table 1 can be a job by itself. This is why you need to make sure you delegate as much of the work as you can so that you can enlist as much help as possible to ensure that the directory service is highly available at all times. A couple of tools can help in particular situations.

1.1. Using Specops Gpupdate

When you work with computer objects in the directory with Active Directory Users And Computers, you can right-click the object and click Manage to launch the Computer Management console with the computer as the focus for the console, but this does not give you access to simpler functions such as remote update of GPOs or the more common Start, Shut down, or Restart commands. However, you can obtain a simple and free add-on from Special Operations Software called Specops Gpupdate. Specops Gpupdate is used here only as an example and is by no means an endorsement. This tool automatically adds functionality to the Active Directory Users And Computers console and gives you control over the following activities:

• Remotely updating GPOs on an object in the directory

• Starting computers remotely, using Wake-on-LAN if enabled locally

• Remotely restarting or shutting down the selected computer

• Graphically reporting the results of an operation

In addition, Gpupdate allows you to perform these tasks on single computer objects or on a collection of objects by applying them to an entire OU. This is a good tool for administrators who must manage computers and servers remotely.

Note:

OBTAINING SPECOPS GPUPDATE

To obtain Specops Gpupdate, go to http://www.specopssoft.com/products/specops-gpupdate. A one-time registration is required.

When you need to work with computer objects, you can simply use the shortcut menu to access the new administration features on either a computer object or an organizational unit containing computer objects. (See Figure 1.) This tool is free and a good addition to any directory service.

1.2. Using AD DS Administration Tools

To perform the activities related to service administration in AD DS and DNS, you can use a series of tools. You’ve already seen many of these tools as you read through the previous lessons, but it is a good idea to review them here. Table 2 outlines which tools you can use for which task and where you can locate them. In this table, the focus is on service, not data administration. Many of these tools also work with Active Directory Lightweight Directory Services (AD LDS) because it is based on the same core code as AD DS.

Note:

MORE INFO FINDING AND DOWNLOADING TOOLS

To locate the Movetree.exe command, go to http://www.microsoft.com/downloads/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&DisplayLang=en. Obtain the .cab file and extract all files named movetree.* from the file. Note that not all tools contained within this file work with Windows Server 2008 R2; Windows Server 2003 support tools are not supported on Windows Server 2008 R2. For example, the ReplMon.exe tool simply will not launch.

To obtain Ultrasound, go to http://www.microsoft.com/Downloads/details.aspx?FamilyID=61acb9b9-c354-4f98-a823-24cc0da73b50&displaylang=en.

2. Performing Offline Maintenance

One significant change in AD DS from previous versions is the transformation of the DC role into a controllable service. In previous versions of Windows Server, the DC role was monolithic: to stop the service, you needed to stop the DC as a whole. This meant that when you needed to perform maintenance on the Ntds.dit database—the database that contains the directory store—you had to shut down a DC and restart it in Directory Services Repair Mode. Because of this, there was no way to automate the database maintenance operations. Consequently, most domain administrators never performed any database maintenance at all. Performing no maintenance is not a valid approach to systems management.

Every database works the same way: As new records are added, the database allocates additional space to store information associated with the record. However, when the record is deleted, the allocated space is not recovered. You need to perform database compaction activities to recover this space. The AD DS service does perform some automatic database compaction, but this compaction does not recover lost space within the database; it only rearranges data to make it easier to access. To recover lost space, you must take the database offline and run a compaction and defragmentation sequence against it.

However, with AD DS and Windows Server 2008 R2, the AD DS service is now a manageable service that can be started and stopped like all Windows Server services. This means that to perform database maintenance activities, you no longer need to shut down the DC to restart it in Directory Services Repair Mode. It also means that because the service behaves natively, you can script the defragmentation and compaction operations through basic command-line tools.

Note that to stop the AD DS service, the DC must be able to communicate with another DC that is running the service. If it cannot, you will not be able to stop the service. AD DS includes automatic checks and verifications that ensure that at least one DC is available at all times; otherwise, no one will be able to log on to the network.