Siddharth Bhai
Program Manager
Microsoft Corporation
Active Directory in
Windows Server 2008 R2:
What’s New?
Presented at Seattle Windows Networking
User Group – May 6, 2009
Tour the Active Directory features in
Windows Server 2008 R2
Encourage you to want to learn more about
these features
Demonstrate the value Windows Server 2008
What’s new in Active Directory?
◦
PowerShell Cmdlets
◦
Active Directory Administrative Center
◦
Best Practice Analyzer
◦
Active Directory Web Services
◦
Recycle Bin for AD
◦
Managed Service Accounts
◦
Offline Domain Join
◦
Authentication Assurance
◦
Health Model
AD Core
LDAP
AD Web Services
S.DS.P / S.DS.AM / S.DS.AD
AD PowerShell
MUX
WCF
.NETWPF
.NET .NETS
E
R
V
E
R
C
L
I
E
N
T
WCF
.NETADUC/ADSS/ADDT
WSH
ADSI
LDAP
MM
C
… GUIDS RPC-Based Protocols
… DSR SAM CLIAD Core
DS RPC-Based Protocols
… DSR SAMAD Admin Center
GUIBPA
Past limitations
◦
Hodgepodge of command line tools for
administration and configuration
◦
Difficult to compose to achieve complex tasks
Feature takeaways
◦
Comprehensive set of AD cmdlets for AD DS and AD
LDS administration and configuration
◦
Brings the power and flexibility of PowerShell core to
AD
Consistent vocabulary and syntax
◦
Verbs – Add, New, Get, Set, Remove, Clear…
◦
Nouns – ADObject, ADUser, ADComputer, ADDomain, ADForest,
ADGroup, ADAccount, ADDomainController, …
Easily discovered
◦
No need to find, install, or learn other tools, utilities or
commands
Flexible output
◦
Output from one cmdlet easily consumed by another
Easily composed
◦
Create higher level tools for complex operations
Leverage .Net Framework
◦
All the capabilities of .Net Framework
End-to-End manageability
Add-ADComputerServiceAccount Add-ADDomainControllerPasswordReplicationPolicy Add-ADFineGrainedPasswordPolicySubject Add-ADGroupMember Add-ADPrincipalGroupMembership Clear-ADAccountExpiration Disable-ADAccount Disable-ADOptionalFeature Enable-ADAccount Enable-ADOptionalFeature Get-ADAccountAuthorizationGroup Get-ADAccountResultantPasswordReplicationPolicy Get-ADComputer Get-ADComputerServiceAccount Get-ADDefaultDomainPasswordPolicy Get-ADDomain Get-ADDomainController Get-ADDomainControllerPasswordReplicationPolicy Get-ADDomainControllerPasswordReplicationPolicyUsag e Get-ADFineGrainedPasswordPolicy Get-ADFineGrainedPasswordPolicySubject Get-ADForest Get-ADGroup Get-ADGroupMember Get-ADObject Get-ADOptionalFeature Get-ADOrganizationalUnit Get-ADPrincipalGroupMembership Get-ADRootDSE Get-ADServiceAccount Get-ADUser Get-ADUserResultantPasswordPolicy Install-ADServiceAccount Move-ADDirectoryServer Move-ADDirectoryServerOperationMasterRole Move-ADObject New-ADComputer New-ADFineGrainedPasswordPolicy New-ADGroup New-ADObject New-ADOrganizationalUnit New-ADServiceAccount New-ADUser Remove-ADObject Remove-ADComputer Remove-ADGroup Remove-ADUser Rename-ADObject Remove-ADComputerServiceAccount Remove-ADDomainControllerPasswordReplicationPolicy Remove-ADFineGrainedPasswordPolicy Remove-ADFineGrainedPasswordPolicySubject Remove-ADGroupMember Remove-ADOrganizationalUnit Remove-ADPrincipalGroupMembership Remove-ADServiceAccount Reset-ADServiceAccountPassword Restore-ADObject Search-ADAccount Set-ADAccountControl Set-ADAccountExpiration Set-ADAccountPassword Set-ADComputer Set-ADDefaultDomainPasswordPolicy Set-ADDomain Set-ADDomainMode Set-ADFineGrainedPasswordPolicy Set-ADForest Set-ADForestMode Set-ADGroup Set-ADObject Set-ADOrganizationalUnit Set-ADServiceAccount Set-ADUser Uninstall-ADServiceAccount Unlock-ADAccount
Past limitations
◦
Non task-oriented UI causes customer pain
◦
Representation in MMC not scalable for large datasets
◦
Limited to managing one domain at a time
Feature takeaway
◦
Task oriented administration model, with support
for larger datasets and progressive disclosure of data
◦
Consistency between CLI and UI capabilities
◦
Navigation experience designed to support
multi-domain, multi-forest environments
Progressive
Disclosure
Multi-Domain
Multi-Forest
PowerShell
based
Task Oriented
Foundational
◦
Past Limitations
LDAP/RPC protocol used for administration and
configuration
Lack of developer experience in Visual Studio
◦
Feature Takeaways
Built using WCF and WS* protocols
WS-Enum, WS-Transfer, IMDA
Replaces LDAP and RPC for remote administration
Not intended for developer consumption in this release
Simpler firewall management
Feature takeaways
◦
Analyzes AD settings that cause most unexpected
behavior in customer environments
◦
Flags settings/configurations that violate
recommended best practices
◦
Provides guidance only, does not modify settings
◦
User initiates scan, not a monitoring solution
◦
Scan can be initiated through Server Manager or
from PowerShell directly
◦
BPA scan can be initiated from client using PS
remoting
Import-Module BestPractices
Invoke-BpaModel Microsoft/BestPractices/DirectoryServices
Get-BpaResult
Microsoft/BestPractices/DirectoryServices
Windows Server 2008
R2
introduces a new Forest
and Domain functional level
◦
Recycle bin requires WS08 R2 Forest Functional level
Required in order to ensure that all DCs preserve attributes
necessary for complete object recovery
◦
Raising functional level alone has no effect other than
allowing optional features to be enabled
Assures customer that they can raise functional level without
unforeseen side effects
◦
Functional level can be lowered only if all optional features
are disabled (
recycle bin cannot be disabled
)
Optional features can be enable individually
Enable-ADOptionalFeature
‘Recycle Bin Feature’ –Scope Forest
–Target {target}
Past limitations
◦
Accidental deletions are the number #1 cause of
AD Disaster\Recovery scenarios
Feature takeaways
◦
Allows recovery of deleted users, groups, etc
Locate deleted object:
Get-ADObject –Filter
{} -IncludeDeletedObjects
Recover deleted object:
Restore-ADObject
-Identity {id}
◦
All attributes are automatically restored
Including well know & problematic ‘Linked Attributes’
Description, password, group membership, etc.
Tombstone
Object
Recycled
Object
Deleted
Object
Windows Server 2008
No Recycle bin feature
