Another quick one to finish the year off. Here’s a script that runs an LDAP query against all of the DCs in the forest and reports back the time it has taken for each. The intention is to identify any DCs that are responding slowly for some reason. In the example below, I’ve chosen to… Read More »
I came across a weird error the other day while running Exchange Server 2013 CU6 setup with the /PrepareAD switch. The error (from the Exchange setup logs) was this: [12/02/2014 01:14:16.0727] [2] [ERROR] Could not find the Exchange Mailbox Administrators Universal Security Group through its well-known GUID 29a962c2-91d6-4ab7-9e06-8728f8f842ea. Please make sure that Setup /prepareAD has… Read More »
A question came up in the forums today about how to use the AD Powershell cmdlets to find objects with attribute values that contain a single space. It’s a good question and relevant because often your results can be skewed by such values when searching for attributes that are not NULL (a space character is… Read More »
It’s sometimes interesting to know how old your AD forest is and when the various domains were created. I recently came across a really useful TechNet Blog with a Powershell snippet to do just this. My version shown below just has some slightly different formatting. # How old is the forest? Get-ADObject -SearchBase (Get-ADForest).PartitionsContainer `… Read More »
If you haven’t heard that extended support for Windows XP ended earlier this year you’ve clearly been in a coma. There are a number of well-publicised methods for finding out whether you still have XP machines in your environment. Here is my own humble (and spectacularly over engineered) Powershell offering. ######################################################### # # Name:… Read More »
There was in interesting discussion the other day on the ActiveDir.org mailing list. Someone asked how many values can be stored within the proxyAddresses mutlivalued attribute in Active Directory. The responses were reasonably consistent, with most people indicating that in Windows 2000 the number was in the range of approximately 800 to 850 and from… Read More »
When you install a new version of Exchange or apply a Cumulative Update certain AD attributes are updated to reflect the change. The updates are made in three different directory partitions (also known as naming contexts): Schema, Configuration and Domain. The following Microsoft TechNet article is a good reference for the different versions and the… Read More »
I had an interesting one recently when submitting a certificate request to a Windows Certificate Authority using certreq.exe. The error that came back was: The disposition message is “Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439)” I found several links to possible solutions but, as it turns out, the problem in… Read More »
Despite Active Directory having been around for more than 10 years, I still find new implementations proceeding without directory service access auditing enabled. For me, auditing of who does what, where and when in your directory is crucial information. I can’t fully fathom why Microsoft doesn’t have it enabled with some sensible defaults out of the… Read More »
I fell foul of this one the other day and it took a while to figure out what to do about it. Here’s the scenario: You deploy a new Group Policy Preferences (GPP) setting to create a folder on a workstation and specify the “Apply once and do not reapply” option. Unsurprisingly, this implies the… Read More »