Active Directory Management Tools

An Introduction to the Active Directory Management Tools

Active Directory or directory service management is a vital component of any administration process if Active Directory is implemented in your networking environment. The two types of management or methods of administration that can be utilized to manage the directory service are:

Windows Server 2003 includes a number of new command-line tools that can be utilized to manage Active Directory objects as well as the various parts of the Active Directory directory. The Administrative tools that utilize a GUI can be accessed via the Administrative Tools menu.

The main management tool utilized to manage Active Directory is the Microsoft Management Console (MMC). The MMC is not an actual management tool but provides the MMC interface to load Active Directory snap-ins. Snap-ins provide specific administrative functionality. The MMC interface allows you to create custom console tools, and also enable you to load multiple snap-ins into a single console.

The following MMC snap-ins provides specific Active Directory administrative functionality:

A few improvements introduced in Windows Server 2003 for the Active Directory management tools include the following capabilities:

In addition to the above mentioned MMC snap-ins, you can also use Resultant Set Of Policy to view current policy for a user on a system. You can also plan policy changes using Resultant Set Of Policy. You can use the Active Directory Installation Wizard to create domain controllers, new domains, domain trees, and forests. Windows Server 2003 includes links to the Active Directory Installation Wizard on the Manage Your Server Wizard. This is the wizard which is displayed after the operating system is installed. The Windows Support Tools also contain additional Active Directory specific management tools.

How to add the three commonly utilized Active Directory snap-ins to the MMC:

  1. Click Start, Run and enter mmc in the Run dialog box. Click OK.
  2. Select Add/Remove Snap-in under the File menu.
  3. The Add/Remove Snap-in dialog box is displayed next.
  4. Click the Standalone tab. Click Add.
  5. The Add Standalone Snap-in dialog box is where you add the Active Directory snap-ins that should be displayed in the Microsoft Management Console.
  6. Click Active Directory Domains and Trusts from the available list and click Add.
  7. Click Active Directory Sites and Services from the available list and click Add.
  8. Click Active Directory Users and Computers from the available list and click Add.
  9. Click Close.
  10. The snap-ins which has been selected should be displayed in the Add/Remove Snap-in dialog box.
  11. Click OK
  12. The MMC console tree should now contain nodes for each Active Directory snap-in.

The Active Directory Installation Wizard

The Active Directory Installation Wizard is the main tool that is used to install Active Directory, domain controllers and create new domains and domain trees. You can initiate the Active Directory Installation Wizard directly using Dcpromo.exe. The Active Directory Installation Wizard prompts for the following information as it guides you through its set of configuration pages/screens:

How to use the Active Directory Installation Wizard to install Active Directory for a new domain

  1. Click Start, Run, and then enter dcpromo in the Run dialog box. Click OK
  2. This action launches the Active Directory Installation Wizard.
  3. When the Welcome To The Active Directory Installation Wizard page opens, click Next.
  4. Click Next as well on the Operating System Compatibility page.
  5. Select the Domain Controller For A New Domain option on the Domain Controller Type page. Click Next.
  6. When the wizard displays the Create New Domain page, verify that the Domain In A New Forest option is selected Click Next.
  7. The Active Directory Installation Wizard now shows the New Domain Name page. This is where you enter the DNS name of the domain in the Full DNS Name For New Domain box. Click Next.
  8. You can accept the default NetBIOS name displayed on the NetBIOS Domain Name page. Click Next.
  9. Enter the proper locations in the Database Folder and Log Folder boxes on the Database and Log Folders page. Click Next
  10. When the Shared System Volume page displays, enter the location of the shared system volume folder in the Folder Location box. Click Next.
  11. On the DNS Registration Diagnostics page, select the appropriate option. Click Next.
  12. When the wizard displays the Permissions page, select the Permissions Compatible Only With Windows 2000 and Windows Server 2003 Operating Systems option. Click Next.
  13. On the Directory Services Restore Mode Administrator Password page, enter the required password. Click Next
  14. The Active Directory Installation Wizard now displays the Summary page. All the configuration options that you have selected as navigating through the pages of the wizard are summarized on this page. Click Next to continue with the installation.
  15. When the Completing The Active Directory Installation Wizard page is displayed, click Finish, and then Restart Now.
  16. When the This Server Is Now A Domain Controller page is displayed, click Finish as well.

The Active Directory Domains and Trusts Console

The Active Directory Domains and Trusts console is used to manage domains and trust relationships between domains and forest, change the domain mode, and set user principal name (UPN) suffixes for the forest. With the installation of Windows Server 2003, the Active Directory Domains and Trusts console is by default added to the Start menu. The MMC snap-in file, Domain.msc, can be used to start Active Directory Domains and Trusts from the Run dialog box. You can also start the console from Administrative Tools. The administrative tasks enabled by Active Directory Domains and Trusts can be accessed from the Action menus displayed by selecting a domain name or the root object. You can also perform management tasks on the Properties dialog box of a domain.

The administrative tasks that you can use the Active Directory Domains And Trusts MMC snap-in for are summarized below:

Domain functional levels allow you to enable Active Directory features and functionality in the domain and forest for your network. Windows Server 2003 adds additional functionality based on the mode of the forest. When a new domain is created in a new forest, the functionality level for the domain is Windows 2000 mixed mode, and the functionality level for the new forest is Windows 2000 mode. When you upgrade the domain controllers in a forest, you can improve the functionality level to support further Active Directory features and functionality.

The following domain functionality levels exist:

The following forest functionality levels exist:

You can use the Active Directory Domains and Trusts console to create the following types of trusts between domains and forests:

How to change the domain functionality level using Active Directory Domains and Trusts

  1. Click Start, Administrative Tools and then select Active Directory Domains And Trusts.
  2. Proceed to right-click the domain that you want to upgrade and click Raise Domain Functional Level from the shortcut menu.
  3. When the Raise Domain Functional Level dialog box opens, use the Select An Available Domain Functional Level drop-down list to choose the domain functionality level that you want to use. The drop-down list only displays the levels that can be specified for the particular domain.
  4. Click Raise
  5. When the Raise Domain Functional Level message box appears, click OK.

How to change the forest functionality level using Active Directory Domains and Trusts

  1. Click Start, Administrative Tools and then select Active Directory Domains And Trusts.
  2. Proceed to right-click the domain that you want to upgrade and click Raise Forest Functional Level from the shortcut menu.
  3. When the Raise Forest Functional Level dialog box opens, use the Select An Available Forest Functional Level drop-down list to choose the forest functionality level you want to use. The drop-down list only displays those levels that can be specified for the particular forest.
  4. Click Raise
  5. When the Raise Forest Functional Level message box appears, click OK

How to add or remove UPN suffixes

  1. Click Start, Administrative Tools and then select Active Directory Domains And Trusts.
  2. Right-click the Active Directory Domains And Trusts node and select Properties from the shortcut menu.
  3. When the Active Directory Domains And Trusts dialog box appears, click the UPN Suffixes tab.
  4. If you want to add a UPN suffix, use the Alternative UPN Suffixes box to enter an alternative UPN suffix. Click Add
  5. If you want to remove a UPN suffix, use the Alternative UPN Suffixes box to indicate the UPN suffix that should be removed. Click Remove.
  6. Click Yes to verify your configurations and then click OK.

How to configure different types of trusts between domains and forests using Active Directory Domains and Trusts

Use the steps below to create shortcut trust between two domains in a forest:

  1. Click Start, Administrative Tools and then select Active Directory Domains And Trusts.
  2. Right-click the domain node for the domain that you want to configure shortcut trust for using the console tree and then select Properties from the shortcut menu.
  3. When the Properties dialog box appears, click the Trusts tab.
  4. This is the tab utilized to create new trust relationships between domains
  5. Click New Trust to start the New Trust Wizard.
  6. Click Next on the Welcome To The New Trust Wizard page.
  7. When the Trust Name page appears, in the Name box, enter the name of the domain that you want to use to create trust. Click Next
  8. Select one of the following options on the Direction Of Trust page:
    • Two-Way
    • One-Way: Incoming
    • One-Way: Outgoing
  9. Click Next, when the Sides Of Trust page displays, choose between the following options:
    • This Domain Only for the trust relationship to be created in the local domain.
    • Both This Domain And The Specified Domain for the trust relationship to be created in both domains
  10. Click Next. The wizard now uses the options that you have selected in this step and the previous step to display the appropriate pages.
  11. The Outgoing Trust Authentication Level page is displayed if you have previously selected the following: Two-Way or One-Way: Outgoing and This Domain Only.
    • You can now either select the Domain Wide Authentication option or the Selective Authentication to specify user authentication. Click Next.
  12. The Trust Password page is displayed if you previously selected the following: One-Way: Incoming and This Domain Only
    • You have to enter a password in the Trust Password box and Confirm Trust Password box. Click Next.
  13. The User Name And Password page is displayed if you previously selected Both This Domain And The Specified Domain.
    • " You have to enter a user name and password of an account that has administrative privileges in the domain in the User Name and Password boxes. Click Next
  14. The wizard displays the Trust Selections Complete page. This page contains a list of all the configuration options that you have specified. Click Next
  15. When the Trust Creation Complete page appears, click Next
  16. When the Confirm Outgoing Trust page appears, choose between the following options:
  17. Yes, Confirm The Outgoing Trust
  18. No, Do Not Confirm The Outgoing Trust
  19. Click Next
  20. When the Confirm Incoming Trust page appears, choose between the following options:
    • Yes, Confirm The Incoming Trust
    • No, Do Not Confirm The Incoming Trust
  21. Click Nexti
  22. When the Completing The New Trust Wizard page is displayed, click Finish.

The Active Directory Sites and Services Console

When you need to create and perform administrative tasks on sites, you would use the Active Directory Sites and Services console. Because Active Directory utilizes sites during authentication and replication, the management of sites in Active Directory is important and can be quite complicated. Through the use of Active Directory Sites and Services, you can control the manner in which a directory is replicated within a site and between sites. Active Directory Sites and Services allow you to configure connections between sites, and then specify how replication should occur. When you open the Active Directory Sites and Services console, you are presented with containers that can be used to create new sites, and to manage the sites in your network environment.

The first site object, Default-First-Site-Name , is created when you install the first domain controller in the network. This site is connected with the server that was promoted to domain controller. You should rename the site object to a name that has some significance in your organization.

The Inter-Site Transports container contains site links. You would use this container to create connections among sites. When you create a connection beneath the IP container, the connection would utilize the IP transport protocol. Similarly, when you create a link beneath the SMTP container, those links utilize Simple Mail Transfer Protocol (SMTP) and not IP.

The Subnets container contains information on the subnets in the network. You would use this container to group different subnets to form a site.

How to rename the first site object using Active Directory Sites and Services

  1. Open Active Directory Sites and Services
  2. Right-click Default-First-Site-Name, and select Rename from the shortcut menu.
  3. Proceed to set a meaningful name for the site.

How to create a new site object using Active Directory Sites and Services

  1. Open Active Directory Sites and Services
  2. Right-click the Sites object, and then click New Site from the shortcut menu.
  3. The New Object - (Site) dialog box appears next.
  4. Enter a name for the site in the Name box.
  5. Enter a site link object for the site in the Link Name box.
  6. Click OK.

How to move a server to a new site using Active Directory Sites and Services

  1. Open Active Directory Sites and Services
  2. Expand the Sites node in the console tree, and click the site that contains the server that you want to move.
  3. Right-click the server, and then select Move from the shortcut menu.
  4. When the Move Server windows appear, specify a new site for the server.
  5. Click OK

The Active Directory User and Computers Console

You would use Active Directory Users and Computers to view and manage user account, groups, computer accounts, OUs, and many other Active Directory objects. Through the Active Directory Users and Computers console, you can view, create, set permissions, change, delete and move objects stored in Active Directory. After you create a domain controller, the containers that are by default created are summarized below. You can however create additional containers.

When Advanced Features are activated; additional containers are shown along with the just mentioned containers:

How to add a new domain user account using Active Directory Users and Computers

  1. Open Active Directory Users and Computers.
  2. Click the domain, right-click the OU where the domain user account should be stored, and select New, and then User from the shortcut menu.
  3. When the New Object-User dialog box appears, enter the appropriate information in the following boxes:
    • First Name: Enter the first name of the user.
    • Initials: Enter the initials of the user
    • Last Name: Insert the last name of the user
    • Full Name: This information is automatically populated using the information entered in the prior three boxes. Full Name is the name that would be displayed in the OU that stores the user account.
    • User Logon Name: Enter the unique logon name of the user.
    • User Logon Name (Pre-Windows 2000): This information is automatically populated.
  4. Click Next
  5. In the second New Object-User dialog box that is displayed, you have to enter password settings for the new domain user account.
    • Password: Enter the password that would be utilized to authenticate the user.
    • Confirm Password: Re-enter the password.
  6. You can also enable the following checkboxes for the new user account
    • User Must Change Password At Next Logon: When enabled, the user has to change the password when he/she next logs on.
    • User Cannot Change Password: This option is typically enabled for the Guest account.
    • Password Never Expires: This option is generally enabled for accounts utilized by Windows services or programs.
    • Account Is Disabled: When enabled, the user account can no longer be utilized.
  7. Click Next
  8. Verify that the full name and user logon name details for the new user account are correct.
  9. Click Finish.

How to change a domain user accounts' properties using Active Directory Users and Computers

  1. Open Active Directory Users and Computers.
  2. Click the domain and then select the OU that holds the domain user account.
  3. Locate and right-click the domain user account that you want to change property settings for, and choose Properties from the shortcut menu.
  4. Click the tab that contains the settings that you want to change.
  5. After changing the necessary settings, click OK

The Active Directory Schema Snap-In

The schema in Active Directory defines the kinds of objects that can be stored in the database. It also defines the attributes of those objects. To view the schema and change it, you need to use the Active Directory Schema snap-in. The Active Directory Schema snap-in is not by default displayed on the Administrative Tools menu. Because of this, you would have to install the snap-in and then create a MMC for it as well.

How to install the Active Directory Schema snap-in and create a MMC for it

  1. Click Start, and then click Command Prompt
  2. Enter regsvr32 schmmgmt.dll.
  3. Click Start, then Run, and enter mmc in the Run dialog box. Click OK.
  4. Select Add/Remove Snap-in under the File menu
  5. The Add/Remove Snap-in dialog box is displayed next.
  6. Click the Standalone tab. Click Add
  7. The Add Standalone Snap-in dialog box is where you add Active Directory snap-ins. Double-click Active Directory Schema. Click Close
  8. Click OK in the Add/Remove Snap-in dialog box
  9. Click Save from the File menu.
  10. When the Save As dialog box is displayed, verify that the Save In box contains Administrative Tools.
  11. In the File Name box, enter Active Directory Schema. Click Save.
  12. The Active Directory Schema snap-in would now be displayed on the Administrative Tools menu.

How to create a new attribute object using the Active Directory Schema snap-in

  1. Open the Active Directory Schema
  2. In the console tree, right-click Attributes, and select Create Attribute from the shortcut menu.
  3. When the Create New Attribute dialog box appears, in the Identification section of the box, you have to enter the name for the new attribute object.
  4. In the Common Name box, enter the name that will be used when the attribute appears in dialog boxes.
  5. In the LDAP Display Name box, enter the name for the object associated with the LDAP directory.
  6. In the Unique X.500 Object ID box, enter a unique ID that identifies the attribute object in X.500 namespace.
  7. In the Description box, enter an object description.
  8. Using the Syntax and Range section of the Create New Attribute dialog box, specify what type of data can be stored in the particular attribute.
  9. Click OK to create the attribute object.

The Active Directory Windows Support Tools

Many Active Directory specific support tools are found in the Windows Support Tools toolkit. You can use these tools to configure, manage and troubleshoot Active Directory. The Windows Support Tools can be found on the Windows Server 2003 CD in Tools folder. Before you can use these tools, you have to install it from the Windows Server 2003 CD. The Active Directory specific support tools are summarized in the next section:

Active Directory Command-Line Tools

You can also use a number of command-line tools to manage Active Directory. Windows Server 2003 introduced a set of DS command-line tools that can be used to administer Active Directory. The command-line tools available for Active Directory management functions are summarized below:



Top 5 Free Networking Tools

Bookmark Active Directory Management Tools

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.