MVP Award - Year Four

I woke up yesterday to great news that I've been awarded the MVP award in Directory Services for the fourth year.  I have previously written blogs with long thank you lists so I won't do that again.  Just a continued huge thanks to everyone I mentioned in those two blog entries.  I've learned from a lot of people and glad to help others.

My favorite part about being an MVP is the MVP summit and I'm really looking forward to going to Seattle again in the late winter.

This is an exciting time for Active Directory.  Windows 2012 is being released later this year.  Windows Azure Active Directory is coming online.  We will have a lot to learn but that is the fun part for me.

Outstanding Cloud & Identity Talk

I generally don't post videos or presentations as blog entries but this is one I haven't seen posted by a lot of folks and is a must watch for anyone in the Identity, Active Directory, Directory Services field.

The main reason I love this talk is because the presenter.  Microsoft's Kim Cameron     Kim is the Chief Architect of Identity in the Identity and Access Division at Microsoft.  In other words when it comes to anything Active Directory/DS.  Kim is "the man"

Vittorio had an excellent blog about Kim   (Kim was retiring when that blog was written but has come back and he talked about that in this presentation)

This is a twenty minute Kim's keynote from the European Identity & Cloud Conference 2012.

Some things I liked

• Use the efficiencies of the cloud to enable efficiencies in identity
• The Cloud Motor Runs on Identity
• Identity Management as a service is an inevitability
• There ae other vendors who have similar directories...not as good of course :)

There are a lot of people that talk about the cloud and give talks.  This is one from a guy who truly knows his stuff.   Kim also has an excellent blog entry that goes with this video.

I'm personally excited that AD and Directory Services types can evolve our skills and have work for years to come.

New MCSE - Personal FAQs

As most blog readers know Microsoft has brought back the MCSE & MCSA certifications and titles.  For those newer to the field the MCSE was one of Microsoft's most popular certifications and tracks.  I'm on the AD/Server side of the house so for me this goes back to an MCSE in Windows NT, 2000, & 2003.

With the 2008 tracks Microsoft did away with the MCSE & MCSA and introduced the MCITP an MCTS tracks and certifications.

The MCSE and MCSA are back again but this time they stand for

Microsoft Certified Solutions Expert
Microsoft Certified Solutions Associate

The Microsoft Learning team has put together a nice page with a lot of information.

MSCE: Reinvented for the Cloud

There are also some good videos on the site and the Microsoft Learning YouTube Channel

There was a lot of great information on the site, but I still had questions and after asking around I noticed others had the same questions.  MSLearning has a Twitter Account and that is where I learned a lot more about the new certs and the future. I compiled some of my FAQs here:

MK FAQ 1 : What happens if I have the MCITP:SA do I need to start from scratch?

So that was good news, as you can see the MCITP:SA will automatically receive the new MCSA: Windows Server 2008 Certification.

MK FAQ 2 : What happens if I have the MCITP:EA?

This was interesting because the MCITP: EA and MCITP: SA will both have the same MCSA: WS2008 title.   I was hoping for two certs as I have both :)   

Note: It was common for people to get both the MCITP:EA and MCITP:SA certifications.

MK FAQ 3 : When will our transcripts be updated?

According to the twitter conversation above transcripts should change on April 24, 2012.

UPDATE:  Blog reader let me know in the comments that his transcript was updated on 4/17/2012.  Nice job by Microsoft getting ahead of schedule.

MK FAQ 4 : What happens to our old certifications?

This one I really like a lot!   I like that old certs will enter a legacy state and be stated that way on the official Microsoft transcript.

I also like that new exams and certifications will also retire.  It makes people need to stay somewhat current and re-certify.  Other companies already use the model the most famous probably being Cisco.   

I know there are going to be cynics out there that remember MCSE's being referred to as "paper tigers" or MCSEs that got their certs through brain dumps and that made us all look bad but Microsoft is definitely moving in the right direction in my opinion.

I'll take an analogy from the Army.  Every Army soldier goes through bootcamp and has "basic" skills but there is a lot more training and experience needed to become a Ranger or Special forces and deal with the advanced issues/topics.   That is how I look at a lot of these certs (from any company).  They are a good step but getting an MCSA or MCSE doesn't mean someone knows everything....it is an ongoing process.

One of my AD Heroes is Joe Richards and he once rated himself a 6 out of 10 in AD.   Again it is a lifelong learning process...no one knows it all not even a guy like Joe (love how humble and cool he is)

I'd like to hear from the community.  What do you think about the new changes and updates?

Security Compliance Manager 2.5 Released

Ned Pyle wrote a blog entry in January on the  Microsoft askds blog  about Security Compliance Manager 2.5 Beta

The tool has been officially released and is no longer in beta.

From the download center

We are pleased to announce that version 2.5 is released and now available for download from the Microsoft Download Center!

          Download SCM 2.5 now


I've been testing 2.5 Beta and really glad that it is now out of beta as it will be much easier to get the tool approved for use where I work.

You can read about the key features & benefits on the Microsoft site so I won't copy and paste them again here.

There will be follow up blog posts with more info and screen shots from the tool.

Active Directory Administrative Center Twitter Question

I recently saw a question on Twitter about the Active Directory Administrative Center (ADAC)

Twitter is a site everyone knows but more and more it is a great place for tech information and sharing in the community.  There are a lot of good tweets on Active Directory and links to information.  There is also a fair amount of spam/bad links.  Those are usually easy to spot though (picture is a "sexy" model for example)

Thanks a lot to @SamErde for letting me use his post for this blog.

ADAC was released with Windows 2008 R2.  It has gained some traction but currently it is definitely still not the GUI tool of choice for Active Directory Administration.  AD Users & Computers still wins but that may change in Windows 8 when features like the AD Recycle Bin and Fine-Grained Passwords are brought into ADAC giving both of those features a much needed GUI.

In order to truly test I created three forests in my lab and created a forest trusts between the first forest and the other two forests.  I did see TechNet articles that this could be done but I like to verify.

I'm not just a blogger I also work in this world and I know setting up the trusts can be a pain.  You have to have proper ports open  That is often easier said than done.  Become friends with the firewall admins :)   You also need to ensure that name resolution is working.  I used conditional forwarders to resolve the domain names in DNS.  Stub zones and secondary zones would also work.

There are a lot of posts and resources about setting up trusts.  If you run into issues look at the basics first

• For potential port blockages tools like telnet, portqry, wireshark, and netmon are really good starting points.
• For DNS issues nslookup is a good place to start troubleshooting.  (wireshark/netmon are good there too)

At this point the forest trusts have been setup and the two way trusts are functional.   The first thing we need to do is to try and add one of the other domains in ADAC.

Add Navigation Nodes in ADAC - Windows Server 2008 R2

Add Navigation Nodes in ADAC - Windows Server 8 Beta

I added the screenshot from a Windows Server 8 Beta box just to show that the location for adding the Navigation Nodes has changed.

I'm going to use Windows 2008 R2 for the rest of the examples.   I select add navigation nodes from there I can add another domain.  

Adding domain in another forest to ADAC via Navigation Node

Once I add the domain from the trusted forest I can now see it in ADAC

Remote domain from trusted forest now appears in ADAC

That is great but what does that really get me?  I am able to view objects in the remote domain due to the default nature of AD allowing read access to most objects.

I'm not able to make any changes which is a good thing.  The fact that the forest trust exists doesn't give any rights to administer the remote domain.

Notice in the screenshot below, I attempt to update/edit a user in the remote forest/domain.  I'm unable to make any changes but can read his info.

Attempting to update a user 

Without any rights I can't really do much.  In this case I want the same account to be able the objects in both forests.

There are several options here but I added my admin account into the Built-In Administrators group in the remote domain.

My admin account has been added into the Administrators group in the remote domain

After the addition has replicated I then try to update the user account from ADAC again.  This time you will notice that the fields are not grayed out and I can make changes.

Wishlist:  I would like the ability to add another domain in the navigation node but also specify alternate credentials when I do that.  That would be handy if an admin has a separate admin account in the remote forest/domain.   I'm still researching that and will update the blog if I find something.

There is a good article about ADAC on TechNet that is worth reading.  

What are your thoughts on ADAC.  For those at 2008 R2 is it gaining traction in your environments?

LastLogonTimestamp for Group Members

I was recently working in a secure environment and one of the issues was way too many domain admin accounts.  This is not a problem just in secure environment.  I've yet to encounter a federal organization that does an outstanding job of limiting the number of domain admins.  I've seen Joe Richards write about working at a Fortune 5 company where they ran with less than 5 domain administrators.  More and more organizations are trying to limit domain admins.  I doubt we will ever get to a point where less than five is the norm but things are getting better...slowly but surely.

The first step the security team took was to identify members of the domain admin group and the last time they logged in.  This is a good initial step to remove those that haven't logged on or used their accounts.  If someone hasn't used their domain admin account in 120 days or longer then I would question if they need the account.

Some folks on the security team were manually going and using a box that had the additional account info tab from the acctinfo.dll.  They were then looking at lastlogon box within the tab and manually entering that into a spreadsheet.  I knew there were easier ways to do this so I stepped in to help out.

For this exercise I keyed off the LastLogonTimeStamp (LLTS) The lastlogontimestamp can be off by 9-14 days.  The link to the askds blog entry on LLTS does a great job of explaining it.  If 9-14 days is not acceptable then you would have to query lastlogon on every DC.  Lastlogon does not replicate and that is why every DC would have to be queried.

For the examples I'm in my lab domain which is mkw2k8R2.com and I only have three users in the domain admin group.  I've only logged in with one of those users.

Method 1 - Using ADFIND

Regular blog users will not be surprised to find out that I used adfind from Joe Richards for method 1.  

adfind -default -f "memberof=cn=domain admins,cn=users,dc=mydomain,dc=mysuffix" samaccountname lastlogontimestamp -tdc -nodn -csv 

Method 2 - Using Quest AD Powershell Cmdlets

Many people that started with powershell and AD years ago are probably familiar with the free AD cmdlets from Quest.  

get-qaduser -memberof "domain admins" | select-object samaccountname, lastlogontimestamp

Method 3 - Using Microsoft's AD Powershell v2 Cmdlets

With the introduction of Windows 2008 R2 and Windows 7 Microsoft introduced the AD module for Windows Powershell.  There is already a lot of good information about the AD Module for Powershell so I won't go over that here.   I also admit I'm not a powershell master/guru.

get-aduser -LDAPFilter "(memberof=cn=domain admins,cn=users,dc=mkw2k8r2,dc=com)" -property lastlogondate | ft samaccountname, lastlogondate

If you noticed I used lastlogondate which is not an actual AD attribute.  My friend Richard Mueller had a good writeup on lastlogondate.    See the link and Richard's answer for more info on lastlogondate which is essentially the same as lastlogontimestamp

Method 4 - Using CSVDE

CSVDE is what you call an old school tool.  Those that have been around AD for years have definitely used the tool at some point.  It was around before adfind and powershell. 

csvde -f c:\userslogon.csv -r "(memberof=cn=domain admins,cn=users,dc=mkw2k8r2,dc=com)" -l samaccountname, lastllogontimestamp  

One problem with the CSVDE method is how it handles the output.   LastLogonTimeStamps are Integer8 (64-bit numbers) that CSVDE can't handle.  You will notice in methods 1-3 those tools did a good job of decoding the attribute.

Elizabeth Greene has a really good blog entry that has a formula you can use in excel to convert it into a readable date.

Notice in the screenshot the difference between the native format in cell C2 and what it looks like after I applied the formula

Method 5 - Using Repadmin

This method I first saw used in the blog from the askds team that I linked to earlier and I'll link to again here

repadmin /showattr dc1root dc=mkw2k8r2,dc=com /subtree /filter:"(memberof=cn=domain admins,cn=users,dc=mkw2k8r2,dc=com)" /attrs:lastlogontimestamp

Other Methods

I really like methods 1-3 the best.  There are other methods that I have not included here but I figured five is a good start for anyone.  Some other things you might see out there

• VBScript - Richard is the king in this category and if you want to use VBScript I recommend testing his scripts out.
• Powershell v1 without AD cmdlets - remember when I said I was not a powershell guru yet.  I'm guessing that is something that can be done but haven't tried to do it yet.   The AD cmdlets from Microsoft and Quest both work for me so I try to stick to them.

You can use these examples and modify them if you are looking for other groups.  There are other/better ways to identify old/stale accounts in a domain if you want to do it domain wide.  More to come on that.

I'm really looking forward to hearing from readers and the community on other methods for doing this.  If there are better ways to do it in Powershell please leave a comment and I'll definitely update the blog.

Inactive Domain Admins beware....you will be removed :)

Windows Server 8 AD Cloning, Virtualization, and Snapshots Warning

Windows Server 8 Beta has a lot of nice features.  Two features that are getting a lot of buzz in the Active Directory World are the ability to easily clone domain controllers and the support to restore Active Directory using snapshots.

Using snapshots can cause USN Rollback and other problems.  Mark Ramey from the Microsoft AD team has an excellent blog entry that you can read for more info.

I added the word Warning to the title of this blog because I've seen a few blogs, posts, and articles that may lead people to believe that this can all be done with a few mouse clicks.  This is not the case, it is not hard but there are some major prerequisites and steps that people have to be aware of.

A few screenshots from my lab using VMware workstation.  These options exist in most hypervisor  products.

Cloning in VMware Workstation 8

Snapshot in VMWare Workstation 8

***WARNING***  You can't just use the GUI and start cloning and taking snapshots without causing issues in a domain/forest with multiple DCs.  You can't manually copy the virtual machine files.  VMWare workstation 8 and the current VMWare products don't support these features.

To take advantage of these features the virtualization host must support VM Generation ID.   I'm guessing by the time Windows 8 is released all major vendors will support this but that means most folks will have to upgrade their hypervisor.

Microsoft currently has two really good documents that are a must read for anyone interested in these new features

Test Lab Guide:  Demonstrate Virtualized Domain  Controller (VDC) in Windows Server "8" Beta

Understand and Troubleshoot Virtualized Domain Controller (VDC) in Windows Server "8" Beta  - written by Ned Pyle - Outstanding document!!

I won't repeat the documents but some important sections


Steps to deploy a cloned virtualized domain controller

1.       Create the customized DcCloneConfig.xml file on a source domain controller

2.       Detect incompatible programs on the source domain controller

3.       Ensure the PDC emulator runs Windows Server "8" Beta, is not the clone source, and is available

4.       Authorize the source domain controller for cloning

5.       Shutdown the source domain controller and copy its disk

6.       Create a new clone virtual machine using the copied disks

7.       Start the source and cloned domain controller, then allow cloning to occur

For those that are fans of the GUI

There is no task-oriented graphical management program for VDC cloning in Windows Server "8" Beta; the provisioning steps are performed manually or using Windows PowerShell 

 Steps to restore a DC snapshot

1.       Take snapshot of DC

2.       Create a new Group Policy

3.       Validate GP replication (SYSVOL replication)

4.       Restore DC Snapshot

You can read the the documents to get a lot more info.   Ned's document is 162 pages...Ned is the king of documentation and writing :)

As I start using this feature more and eventually use this in production in the future I hope to write more on these features.  I won't try to replicate Ned's excellent document but there is going to be more to come.