Bart's Weblog

Just a blog…

Archive for the ‘Active Directory’ Category

Schemus Active Directory synchronisation tool

Posted by bartvdw on 2121/0505/2015

Recently had some questions in regards to the Schemus tool, which is a tool used to synchronize Active Directory information to cloud services, such as Symantec, Websense, etc. and I wanted to share that specific information.

Before you begin, it’s interesting to know:
& = AND
| = OR
! = NOT

If you use if to synchronize email addresses, you have the option to define the OU’s where to look for users if your AD is segmented accordingly, but the problem can be if both users and mail-enabled user reside in the same OU. To overcome that problem (as in: let’s exclude mail-enabled users), add this to the search filter: (!(msExchRecipientTypeDetails=128))

Full example: (|(&(objectCategory=person)(objectClass=user)(!(msExchRecipientTypeDetails=128)))(objectCategory=group))

(add objectCategory definitions if required, such as distribution groups, public folders, …)

Another thing that can cause troubles is that by default the tool uses %mail% variable to look up the primary email address, however that attribute is not maintained by Exchange, it’s an AD attribute and therefor it can have any value, even empty. That means that if the person who creates users must fill in that attribute correctly or you will have issues. To overcome that, change the Primary Mail attribute to following value: %proxyAddresses{s/(SMTP:|.*:.*)(.*)/$2/}%

By defining ‘SMTP’ (uppercase), we indicate we want the primary email address, the line Mail Aliases defines the same string, but with ‘smtp’ lowercase.

For Websense it can be difficult to synchronize users that have no mailbox or email address (ex. web filtering service, for authentication), in that case change the Primary Mail string to %userPrincipleName% as that should exist and filled in correctly.

msExchRecipientTypeDetails AD values:

Posted in Active Directory, Schemus, Symantec, Websense | Leave a Comment »

Best practices for DNS settings on DC and domain members

Posted by bartvdw on 1717/0707/2013

Very good and to the point summary!

Posted in Active Directory, DNS, Microsoft, Windows | Leave a Comment »

VMware: ESXi Active Directory integration and default AD group

Posted by bartvdw on 0202/0505/2013

Came across this nice to know configuration item when joining ESXi hosts in Active Directory: the default AD group “ESX Admins”. Read the link below for details!

Undocumented parameters for ESXi 5.0 Active Directory integration

Posted in Active Directory, ESX(i), VMware | Leave a Comment »

Complete Step by Step to Remove an Orphaned Domain Controller

Posted by bartvdw on 1919/0303/2013

Great article describing all different steps and scenario’s, a must read!

Complete Step by Step to Remove an Orphaned Domain Controller

Posted in Active Directory, Microsoft, Windows | Leave a Comment »

AD: Migrate FRS to DFSR

Posted by bartvdw on 1919/1111/2012

Short background: FRS is used to replicate SYSVOL between domain controllers since Windows Server 2000. However starting with WS2008 you can migrate to DFSR for this replication, if you meet the requirements ofcourse.

Below some great resources which explain why you want to migrate and how to execute it.

SYSVOL Migration Series: Part 1 – Introduction to the SYSVOL migration process

SYSVOL Migration Series: Part 2 – Dfsrmig.exe: The SYSVOL migration tool

SYSVOL Migration Series: Part 3 – Migrating to the Prepared State

SYSVOL Migration Series: Part 4 – Migrating to the ‘REDIRECTED’ state

SYSVOL Migration Series: Part 5 – Migrating to the ‘ELIMINATED’ state

FRS to DFSR Migration Tool Released

Migrating SYSVOL replication from NTFRS to DFSR using Windows Server 2008 R2

FRS to DFSR migration guide published

Posted in Active Directory, Microsoft, Windows | 1 Comment »

Active Directory Replication Status Tool

Posted by bartvdw on 0202/0808/2012

Posted in Active Directory, Microsoft | Leave a Comment »

Active Directory and the Resilient File System (ReFS)

Posted by bartvdw on 0202/0808/2012

Posted in Active Directory, Microsoft, Windows Server 2012 | Leave a Comment »

Windows Server 2012: Goodbye dcpromo !

Posted by bartvdw on 1313/0606/2012

With the new release Windows Server 2012 the command dcpromo is no more… If you type in the command you will receive a pop-up informing you it has moved to Server Manager.

The link below describes how to promote a Windows Server 2012 to domain controller step-by-step.

As always this also has a new schema version, for the RC version it’s currently 56. My earlier post with the AD schema numbers has also been updated with this information.

Promote Windows Server 2012 to Domain Controller, step-by-step

Active Directory schema version numbers

Posted in Active Directory, Windows, Windows Server 2012 | 1 Comment »

Active Directory default Tombstone lifetime

Posted by bartvdw on 0909/0101/2012

Great post by Joe regarding Active Directory default Tombstone lifetime, a must read article!

Default Tombstone Lifetime yet again… Alternate working title: TechNet why do you hate tombstoneLifetime and correct information?

Posted in Active Directory, Windows | Leave a Comment »

PowerShell: Outlook unified signature based on Active Directory information

Posted by bartvdw on 0303/0909/2011

I came across this nice PowerShell solution to have unified Outlook signature based on Active Directory information in your company. Check it out!

Outlook signature based on user information from Active Directory

Deploying a Unified Email Signature Template in Outlook

Microsoft TechNet Script Center link: Outlook signature based on user information from Active Directory

Posted in Active Directory, Outlook, PowerShell | Leave a Comment »