Pat Spencer

I found this article quite helpful.  It contains some excellent detailed information. https://redmondmag.com/articles/2009/07/01/6-tips-for-troubleshooting-active-directory.aspx Especially detailed is the AD Diagnostics Registry settings:

Fix Trust Relationship if a simple Computer password reset is required http://blog.blksthl.com/2013/03/18/fix-the-trust-relationship-between-this-workstation-and-the-primary-domain-failed/ This is dead simple, but if you were not aware, you do not necessarily need to rejoin the domain if the trust relationship is broken with AD.  Just resetting the password is all . Steps using Powershell: Login locally to the server Run the PowerShell command: Reset-ComputerMachinePassword -Server -Credential Restart-Computer

There are lots of great blogs out there on how to do the overall migration of Public folders from previous versions of Exchange to 2013, but few of them detailed how to deal with a few choice issues that I encountered in a recent migration that I performed. For a good, detailed, checklist of how to do the migration, see any of the following:     http://exchangeserverpro.com/exchange-server-2010-2013-migration-moving-public-folders/     http://blogs.technet.com/b/meamcs/archive/2013/07/25/part-4-step-by-step-exchange-2007-to-2013-migration.aspx     http://www.msexchange.org/articles-tutorials/exchange-server-2013/migration-deployment/migrating-public-folders-exchange-2013-part1.html My migration was for 50,000 folders, and about 130GB of data. The issues that I ran into were (but not limited to):     Needing a System Attendant mailbox on each server hosting Public Folders     Spaces at the end of the names of fold...

Found this great article. http://blog.scosby.com/post/2012/12/13/Disabling-Windows-Server-2012-Lock-Screen-Timeout.aspx Disabling the Windows Server 2012 Lock Screen Timeout In Server 2012 by default, the lock screen will put the monitors to sleep after 1 minute. I found myself waking the monitors too frequently. An initial web search led me to a MSDN forum post for Windows 8 that unlocked a missing Power Settings feature in Server 2012.   1.        Open the following registry key      a.        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7     2.        Set the following value      a.        Attributes => 2   3.        Now open Control Panel>Power Options>Change Plan Settings...

This is a quick and dirty but works. Here is a simple script to export and then import the OU structure from one AD to another, such as when you want to create a lab from a production AD. To export the Prod OU's to a CSV, enter the following command:  Get-ADOrganizationalUnit -Filter *|select name,@{n="Path";E={($_.DistinguishedName).replace("OU="+$_.name+",","") }} | ConvertTo-Csv -NoTypeInformation |out-file -FilePath Prod-OUS-4-Import.csv Next,  edit the domain name in the CSV to change it to the new domain. Also, clean up the file to remove any OU's that are out of scope.  Third, run the following script using the CSV to import the names and Path of the OU's # Command Line Parameters Param(  [Parameter(Mandatory=$false,HelpMessage='CSV FIle')][string]$Inputfile=".\Prod-OUS-4-Import.csv" ) import-module activedirectory # Read in data $OUS = import-csv $InputFile $ous |ft -a  #validate data on screen # get current ...

I was recently asked to evaluate an Active Directory environment to determine it's health, specifically relating to GPO's and how they were being used. I discovered that the number and configuration of the OU's, GPO's, and contents, were a clear indication that the administration of GPO's was not well understood by the committee of people who were managing them, and that there were clearly problems being self-inflicted due to these issues. The question, however, was how can we quickly assess whether the management of GPO's was in trouble, and also how can we quantify the issue? The first thing to understand is that there are Recommended Best Practices from Microsoft for how to manage GPO's.  See https://technet.microsoft.com/en-us/library/cc785903(v=ws.10).aspx But how to quantify these subjective suggestions? First,  "Minimize the Use of the Block Policy Inheritance Feature".   You can determine the number of OU's that have Blocked Policy Inhe...

I have been working for a little while on creating tools for an administrator to be able to manage an Active Directory for Least Privileges Principles, and to secure AD Access. Specifically here, I will be talking about configuring Monitoring and Alerts for suspicious behavior in the administration of Active Directory. The first activity to monitor and to generate an alert is a logon by a member of the Microsoft Privileged Groups.  It is assumed that you have read and are following the Microsoft Best Practice of normally having ZERO members of the Privileged Groups (Domain Admins, Enterprise Admins, etc).  Membership in these groups is only granted temporarily in order to perform a specific task.   The Intruder Attack Surface of your Ad is minimized by reducing the time that this elevation of privileges exist. But what about abuse of privilege, or unauthorized role elevation? By monitoring and alerting on every logon and logoff on any computer of anyone with this group me...