Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Active Directory

Knowledge Base Tips topic

[	4070	]	Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base	Last updated: May 24, 2012
[	202	]	Admin Tips	Last updated: May 23, 2012
[	20	]	Registry Tips	Last updated: May 10, 2012
[	20	]	User Tips	Last updated: Apr 18, 2012
[	336	]	Admin Tips	Last updated: May 24, 2012
[	18	]	Registry Tips	Last updated: May 03, 2012
[	4	]	User Tips	Last updated: Feb 07, 2012
[	362	]	Admin Tips	Last updated: Apr 27, 2011
[	102	]	Registry Tips	Last updated: Jun 08, 2011
[	7	]	Command shell	Last updated: Jan 18, 2006
[	19	]	Customization	Last updated: Dec 02, 2010
[	13	]	Disable - Hide	Last updated: Apr 06, 2011
[	6	]	IE	Last updated: Apr 20, 2004
[	24	]	Miscellaneous	Last updated: Jun 08, 2011
[	20	]	Network	Last updated: Jun 06, 2011
[	13	]	Security	Last updated: Feb 01, 2011
[	211	]	User Tips	Last updated: Jun 09, 2011

Active Directory Tips

Sort By: Title | Date | Rating

A Common Misconception Regarding Security Logs: Date - Oct 27, 2005; Rating - 3; Author - Mitch Tulloch; Do domain controllers share security logs?
A Quick Tip Restrict Users From Modifying The Schedule Tasks: Date - Nov 17, 2010; Rating - Not Rated; Author - Nirmal Sharma; This article explains how you can restrict users from deleting a schedule task created by an administrator
A Quick Tip To Change KCC Interval: Date - Mar 02, 2011; Rating - Not Rated; Author - Nirmal Sharma; This article explains how you can change the KCC Interval on Windows Domain Controllers.
A Quick Tip To Check For Morphed Folders In An Active Directory Forest: Date - Nov 16, 2010; Rating - 3; Author - Nirmal Sharma; This article explains how you can check for morphed folders in an Active Directory forest.
A Quick Tip To Check If DCs Can Register Records With DNS Dynamically: Date - Jan 21, 2010; Rating - 4.5; Author - Nirmal Sharma; This article explains a registry key which you can query to know if DCs are using Dynamic DNS protocol to register records with DNS Servers.
A Quick Tip To Check If PDC Emulator Is Working: Date - Feb 04, 2009; Rating - 4.5; Author - Nirmal Sharma; This article explains how you can tell if PDC Emulator in an Active Directory Domain is working.
A Quick Tip To Check The Backup Status Of Each NC In Active Directory Forest: Date - Oct 01, 2009; Rating - 1; Author - Nirmal Sharma; This article shows how you can see the backup status of each Naming Context in Active Directory using command line tool.
A Quick Tip To Configure Time Service In Active Directory Environment: Date - Mar 24, 2009; Rating - 3.7; Author - Nirmal Sharma; This article explains how you can configure time service for an active directory environment.
A Quick Tip to designate a domain controller for client authentications.: Date - Aug 13, 2008; Rating - 4.8; Author - Nirmal Sharma; This article explains the use of SRV priority. This applies to Windows 2000, Windows 2003 and Windows Server 2008.
A Quick Tip To Enable White Space Logging: Date - Oct 01, 2009; Rating - 5; Author - Nirmal Sharma; This article explains the use of White Space Logging and how you enable it on the domain controllers.
A Quick Tip To Fix DC SRVs in Active Directory Domain: Date - Dec 02, 2008; Rating - 1; Author - Nirmal Sharma; This article explains how you can use few simple commands to fix the SRV records of a Domain Controller in an Active Directory Domain.
A Quick Tip To Make Sure FRS Is Working In A Domain: Date - Oct 29, 2008; Rating - Not Rated; Author - Nirmal Sharma; This article explains a small mechanism you can use to make sure FRS is working.
A Quick Tip To Place Authenticating DC In DFS Referral List: Date - Oct 08, 2009; Rating - Not Rated; Author - Nirmal Sharma; This article explains a registry entry which can be used to place the authenticating domain controller on top of the DFS Referral list.
A Quick Tip To Prevent NetLogon Service From Registering SRV and Domain Records: Date - Jan 05, 2011; Rating - Not Rated; Author - Nirmal Sharma; This article explains how you can use a registry hack to prevent NetLogon from registering SRV, CNAME and Domain DNS Records in the DNS Server.
A Quick Tip To Prevent Registration Of A and GC Records For Domain Controllers: Date - Jan 04, 2011; Rating - Not Rated; Author - Nirmal Sharma; This article explains how you can prevent NetLogon service from registering A record for Domain Name and Global Catalog.
A Quick Tip To Strict AD Replication To A Specific Port: Date - Oct 22, 2009; Rating - Not Rated; Author - Nirmal Sharma; This article explains a registry entry which can be used to strict the AD Replication traffic to a specific port.
A Quick Tip To Strict FRS Replication To A Specific Port: Date - Oct 22, 2009; Rating - Not Rated; Author - Nirmal Sharma; This article explains a registry heck which can be used to strict FRS Replication to a specific port.
A Quick Tip To Verify The SRV Records Of Domain Controllers: Date - Jan 27, 2009; Rating - 3.3; Author - Nirmal Sharma; This article explains how you can use the NSLOOKUP tool to verify the SRV records of a domain controller.
Active Directory replication in a multilingual environment: Date - May 29, 2007; Rating - 1; Author - Mitch Tulloch; Active Directory replication in a multilingual environment
Authoritative vs. Non-Authoritative Restoration of Active Directory: Date - Jul 20, 2006; Rating - 4.2; Author - Chris Sanders; It is the absolute worst case scenario possible; your domain controller has crashed. So what type of restore do you do?
Avoid Mapped Drives: Date - Nov 10, 2005; Rating - 2; Author - Mitch Tulloch; Why mapped drives can be a bad idea on today's networks.
Avoid Overuse of Protected Groups: Date - Dec 07, 2005; Rating - 2.7; Author - Mitch Tulloch; protected groups, user rights, PDC Emulator
Avoiding Group Policy Bloat: Date - Jan 03, 2006; Rating - 4; Author - Mitch Tulloch; How to save disk space on SYSVOL when you have lots of Group Policy Objects (GPOs) for your domain.
Avoiding Legacy Built-in Groups: Date - May 10, 2006; Rating - 4.8; Author - Mitch Tulloch; How you can avoid using legacy built-in groups to grant admin-level privileges.
Backup Latency Threshold In Windows Server 2003 With SP1: Date - Mar 25, 2009; Rating - 3.7; Author - Nirmal Sharma; This article explains how you can use a registry entry to display a warning message if a Naming Partition is not backed up for many days.
Change Management Using AGPM: Date - Aug 09, 2007; Rating - 3.5; Author - Chris Sanders; Keeping track of Group Policy changes can be a daunting task if done manually. Luckily, Microsoft’s AGPM utility makes this process a whole lot easier.
Check for problems with GPOs: Date - May 02, 2007; Rating - 2.5; Author - Mitch Tulloch; How to check for possible problems with your GPOs.
Checking Local Group Policy: Date - Dec 21, 2005; Rating - 3.5; Author - Mitch Tulloch; There may be times when you want to check the Local Group Policy Settings on a desktop machine.
Checking the Location of Domain FSMO Roles: Date - Jul 03, 2008; Rating - 5; Author - Chris Sanders; Here is a quick tip to finding out where the FSMO roles for a domain are located.
Comparing RSoP before and after: Date - Apr 26, 2007; Rating - 5; Author - Mitch Tulloch; How to compare RSoP before and after making changes to your Group Policy infrastructure.
Configuring Wireless Security Settings via GPO: Date - Mar 23, 2006; Rating - 3.1; Author - Chris Sanders; Using Group Policy wireless extensions you can more easily manage security and encryption settings for your networks wireless clients.
Creating Dummy (Test) Users: Date - Mar 20, 2008; Rating - 2.8; Author - Mitch Tulloch; How to create a bunch of dummy or test users quickly in Active Directory.
Default Dynamic Port Range: Date - Dec 23, 2010; Rating - 4; Author - Nirmal Sharma; This article explains the default dynamic port range used by the client computers.
Default GPO Permissions: Date - Jul 13, 2006; Rating - 3.7; Author - Chris Sanders; It is very important to assign appropriate permissions to every GPO you create. Here I list the default permissions given to a new GPO.
Delegating Server Controls: Date - Dec 10, 2010; Rating - 5; Author - Nirmal Sharma; This article contains a few links you can use to delegate basic server administrations to junior Administrators.
Disabling network configuration settings using Group Policy: Date - May 08, 2007; Rating - 1.2; Author - Mitch Tulloch; How to disable network configuration settings using Group Policy
Dumping group memberships: Date - Oct 09, 2007; Rating - Not Rated; Author - Mitch Tulloch; A useful tool for dumping groups and membership info.
DynamicSiteName and SiteName – Which site a client computer belongs to?: Date - Jul 30, 2008; Rating - 5; Author - Nirmal Sharma; If you are troubleshooting a client computer which always communicates to a domain controller in different site, you should look at the two registry entries explained in this article. This article applies to Windows 2000 and Windows XP.
Editing the DNS Root Hints Files: Date - Dec 06, 2007; Rating - 4; Author - Chris Sanders; DNS Root Hints are essential for the location of records that takes place during DNS recursion. Here are a couple of quick tips regarding DNS Root Hints.
Enabling Caching of Universal Groups: Date - Apr 19, 2005; Rating - 3.8; Author - Mitch Tulloch; How to enable caching of universal groups in Windows Server 2003 and why this is useful in branch office scenarios.
Enabling Windows Firewall on domain controllers: Date - Aug 08, 2007; Rating - 4; Author - Mitch Tulloch; Steps for enabling WF on domain controllers.
Exempting User Accounts from Domain Password Policies: Date - Jun 14, 2007; Rating - 1; Author - Mitch Tulloch; There's one exemption to how domain password policies are applied.
Fast Searching of Active Directory: Date - Apr 20, 2005; Rating - 4.3; Author - Mitch Tulloch; Make life easier for your users by simplifying how they search for resources in Active Directory.
Find All Locked-Out Accounts: Date - May 12, 2005; Rating - 4.3; Author - Mitch Tulloch; Use Saved Queries to quickly locate all locked out user accounts.
Finding and Fixing Duplicate SIDs on the Network: Date - Nov 26, 2008; Rating - 4.5; Author - Chris Sanders; Duplicate SIDs on the network can cause all types of problems. Why would we have duplicate SIDs and how to we correct it?
Finding global catalog servers: Date - Dec 18, 2007; Rating - 1.5; Author - Mitch Tulloch; How to find all GCs in a domain
Finding schema differences: Date - Nov 06, 2007; Rating - 1; Author - Mitch Tulloch; How to find schema differences between two forests.
Finding the Groups a User Belongs To: Date - Nov 02, 2005; Rating - 3.4; Author - Mitch Tulloch; Here's a useful tool for troubleshooting permissions problems arising from membership in groups.
Forcing Active Directory Replication: Date - Jul 27, 2006; Rating - 4.3; Author - Chris Sanders; There may be some instances where you need to force replication between active directory replication partners. Here I will show you one method of doing this.
Forcing Group Policy to Run at Startup: Date - Jun 12, 2007; Rating - 4.3; Author - Chris Sanders; Group policy can be quirky in the way it runs at startup, often taking two or three reboots before it actually applies to a machine. Here we are going to look at the cause of this and how to fix it.
FRS D2/D4 - When Should You Use Them?: Date - Nov 11, 2008; Rating - Not Rated; Author - Nirmal Sharma; This article discusses about D2 and D4 of File Replication Service in Active Directory and when should you use them?
Functions Of NetLogon Service On Domain Controllers: Date - Dec 22, 2010; Rating - 3; Author - Nirmal Sharma; This article explains the functions of NetLogon Service on domain controllers.
Get control of your severs using Startup/Shutdown Script: Date - Oct 18, 2006; Rating - 3.1; Author - Santhosh Sivarajan; In many situations we need to reset the Local Administrator password and add Domain Admins to the Local Administrator group on a server or client machine without visiting each machine. If you don’t know the password and don’t have access to the severs, you can run this simple script as a Startup/Shutdown script in conjunction with Group Policy.
Group Membership in Multi-Forest Scenarios: Date - May 30, 2007; Rating - Not Rated; Author - Mitch Tulloch; Clearing up uncertainty around some Microsoft documentation on how groups can be nested.
Group Policy in mixed environments: Date - Apr 24, 2007; Rating - Not Rated; Author - Mitch Tulloch; How to target Group Policy differently for different OSes.
Group Policy Objects and Gpotool.EXE: Date - Dec 15, 2010; Rating - 4.5; Author - Nirmal Sharma; This article explains how you can use Gpotool.exe to check the sync problem with Group Policy Objects.
Group Policy Processing At Client Computers: Date - Dec 14, 2010; Rating - 5; Author - Nirmal Sharma; This article explains how Group Policy processing happens at the client computers.
How to change membership in groups based on attributes of users in AD automatically: Date - Jun 01, 2006; Rating - 3; Author - Rostislav Soukup; If your company has a complicated structure, you may need to filter members of your security or distribution groups automatically based on changes to some attribute of users in Active Directory – let's say Department.
How To Change The Default DNS Interval For Domain Controllers?: Date - Jan 14, 2010; Rating - 1; Author - Nirmal Sharma; This article explains how you can use a registry entry to change the default DNS Referesh interval for a domain controller.
How To Force Users To Log On To The Domain?: Date - Sep 03, 2008; Rating - 2.8; Author - Nirmal Sharma; This article explains a mechanism you can use to force client computers to log on to the domain.
How To Know The Primary Member of A SYSVOL Replica Set?: Date - Nov 06, 2008; Rating - 2; Author - Nirmal Sharma; This article explains how to determine the Primary Member of a SYSVOL Replica Set in an Active Directory domain.
How To Quickly Check If Newly Created GPO Replicated To All Domain Controllers?: Date - Mar 25, 2009; Rating - 2.7; Author - Nirmal Sharma; This article explains a quick tip to check whether a newly created GPO replicated to all the Domain Controllers for that domain or not.
How To Recover From A Corrupt Registry Branch: Date - Dec 29, 2010; Rating - Not Rated; Author - Nirmal Sharma; This article explains how you can recover from a corrupted registry branch.
How to remove unwanted local user accounts: Date - Apr 10, 2007; Rating - 3.8; Author - Mitch Tulloch; How to get rid of those pesky local user accounts on your workstations, or at least mitigate their unwanted presence.
How To Use DsQuery To Find All The Domain Controllers In The Domain or Forest?: Date - Oct 01, 2009; Rating - 4; Author - Nirmal Sharma; This article explains DsQuery commands which you can use to find all the domain controllers.
Identifying Unused Accounts: Date - Jul 11, 2007; Rating - 3.2; Author - Mitch Tulloch; How to identify unused user accounts.
Increase file server performance: Date - Jul 12, 2006; Rating - 3; Author - Mitch Tulloch; Don't use your domain controller as a file server--here's why.
Introduction to Windows Server 2003 Active Directory in Application Mode: Date - Apr 20, 2004; Rating - 2.5; Author - Wayne Maples; 368 KB Microsoft Word file : white paper introduces a new capability in the Microsoft Active Directory service: Active Directory in Application Mode (AD/AM).
Managing SRV Records in DNS: Date - Mar 21, 2006; Rating - 2.1; Author - Mitch Tulloch; Tip for troubleshooting SRV records.
MaximumPasswordAge DisablePasswordChange On Client Computers: Date - Jan 27, 2010; Rating - 3.4; Author - Nirmal Sharma; This article explains how a domain client computer changes its password with the domain controller.
Minimize Number Of Repeated Entries In System Log By NetLogon: Date - Mar 03, 2011; Rating - Not Rated; Author - Nirmal Sharma; This article explains how you can use a registry hack to increase the interval for logging duplicate event entries in the System Event Log by the NetLogon service.
Missing Delegation tab: Date - Nov 08, 2007; Rating - 3; Author - Mitch Tulloch; Why the Delegation tab might be missing.
More Grace Period for Restoring Active Directory: Date - Dec 14, 2005; Rating - 3.3; Author - Mitch Tulloch; Watch those tombstones when restoring Active Directory from backup--but there's less worry if you have Service Pack 1 installed.
Port 445 and trust creation: Date - Oct 04, 2007; Rating - 1; Author - Mitch Tulloch; How port 445 is used in trust creation
Pre-staging computer accounts: Date - Apr 25, 2007; Rating - 3.9; Author - Mitch Tulloch; How to ensure client computers are not left in an unmanaged state after joining a domain.
Prevent accidental deletion of OUs: Date - Dec 12, 2007; Rating - 5; Author - Mitch Tulloch; Trying to prevent accidental deletion of OUs
Prevent saving to desktop: Date - May 10, 2007; Rating - 2.2; Author - Mitch Tulloch; How to prevent users from cluttering up their desktops with files.
Preventing Orphaned GPO’s: Date - Jun 13, 2007; Rating - 3; Author - Chris Sanders; When you remove a computer from a domain there are a few steps you should take to ensure that its GPO settings are removed properly as well.
Pruning Old Computer Accounts in AD: Date - May 25, 2006; Rating - 4.4; Author - Chris Sanders; In large organizations the task of keeping Active Directory cleansed of inactive computer accounts can be daunting. Here are a few ways to ease the process.
Quick tips on troubleshooting FSMO roles: Date - Mar 14, 2006; Rating - 3.1; Author - Mitch Tulloch; Here are some tips on troubleshooting FSMO roles.
Schema vs. Enterprise vs. Domain Admins: Date - Jun 20, 2007; Rating - 1.7; Author - Mitch Tulloch; Domain admins can basically do anything, anywhere in the forest.
Service Records of Domain Controller used by Various Services and Components: Date - Dec 03, 2008; Rating - 2.8; Author - Nirmal Sharma; This article explains what all components or Services use the SRV records of domain controller.
Setting Up Disk Quotas with Group Policy: Date - Apr 03, 2007; Rating - 1; Author - Chris Sanders; Setting up disk quotas manually is good for small networks but for larger ones group policy can make this a lot easier.
SYSVOL Replication Notes: Date - Mar 17, 2009; Rating - 5; Author - Nirmal Sharma; This article explains some notes related to the FRS and SYSVOL replication.
TechNet Webcast: Best Practices for Planning Your Migration to Microsoft Exchange 2003: Date - Apr 20, 2004; Rating - Not Rated; Author - Wayne Maples; 96:46 minutes - diagnosing and troubleshooting replication, locating Active Directory database files, backing up and recovering system state data, and seizing flexible single master operation (FSMO) roles
TechNet Webcast: Microsoft Windows NT 4.0 and Microsoft Windows Server 2003 Active Directory Interoperability: Date - Apr 20, 2004; Rating - 1; Author - Wayne Maples; 101:17 minutes - This session covers trust relationships, the Microsoft® Active Directory® Sizer Tool, name resolution methods, migrating accounts from Microsoft Windows NT® 4.0 to Microsoft Windows Server™ 2003, directory and file replication in Windows NT 4.0 and Windows Server 2003, and interoperation of system and group policy.
TechNet Webcast: New Features of Microsoft Windows Server 2003 Active Directory: Date - Apr 20, 2004; Rating - 3; Author - Wayne Maples; 98 minutes - addresses pain points from Microsoft® Windows® 2000 Active Directory deployments and shows how new features of Microsoft Windows Server™ 2003 address those pain points and make management and deployment easier.
TechNet Webcast: Windows Server 2003 Active Directory Diagnostics, Troubleshooting and Recovery: Date - Apr 20, 2004; Rating - 3; Author - Wayne Maples; 92:01 minutes - covers verifying Active Directory functionality, diagnosing and troubleshooting replication, locating Active Directory database files, backing up and recovering system state data, and seizing FSMO roles.
TechNet Webcast: Windows Server 2003 Group Policy Essentials - Level 200: Date - Apr 20, 2004; Rating - 3.8; Author - Wayne Maples; In this session you'll learn just what Group Policy is, and how you can deploy it correctly. Join this webcast to hear Active Directory and Group Policy guru Jeremy Moskowitz (from GPanswers.com) and author of the recently overhauled “Group Policy, Profiles and Intellimirror for Windows 2003, Windows 2000 and Windows XP” teach you the ropes. Learn how to modify Group Policy Objects to lock down desktops and manage your user environments. Gain insights into the thorny issues surrounding permissions. Discover how to delegate the job of creating Group Policy Objects. Last, you'll learn how to troubleshoot Group Policy -- through tools and with your bare hands.
Technical Overview of Windows Server 2003 Active Directory: Date - Apr 20, 2004; Rating - 3.3; Author - Wayne Maples; 250 KB Microsoft Word file : The Windows Server 2003 family makes Active Directory easier to manage, easing migration and deployment.
Tip To Check Network and DNS Settings Before Deploying A DC or Domain: Date - Mar 19, 2009; Rating - Not Rated; Author - Nirmal Sharma; This article explains a small tip or syntax of a command you can use to check the network and DNS settings before deploying a child domain or additional domain controller in an existing forest.
Troubleshooting the Domain Controller Locater Process: Date - Jan 15, 2008; Rating - 1; Author - Chris Sanders; The more complex the network, the more complex the problem that can occur is. Here is a quick run down on some of the steps required in troubleshooting the domain controller locater process.
Troubleshooting Universal Group Caching: Date - Apr 27, 2005; Rating - 3.7; Author - Mitch Tulloch; A tip on how to troubleshoot universal group caching if it doesn't seem to be working properly.
Understanding the DNS Resolver Host File: Date - Jan 10, 2008; Rating - 4.8; Author - Chris Sanders; The DNS Resolver host file can be used to increase performance of DNS services as well as a few other things. This tip aims at giving a better understanding of the DNS resolver host file and its capabilities.
Using a Batch File for Resetting Domain Passwords: Date - Mar 02, 2006; Rating - 4.2; Author - Chris Sanders; Occasionally someone in your organization will need to be able to reset passwords of others without having access to active directory. This can be achieved with a simple batch file…
Using AGPM for Advanced Group Policy Delegation: Date - Sep 05, 2007; Rating - Not Rated; Author - Chris Sanders; Microsoft’s AGPM tool is a great way to have an extra layer of security when managing group policy on your network.
Using the Employee-ID attribute in Active Directory: Date - Dec 20, 2007; Rating - 1; Author - Mitch Tulloch; Using the Employee-ID attribute in Active Directory.
Web-based AD management: Date - May 31, 2006; Rating - 2; Author - Mitch Tulloch; A web-based interface to Active Directory you should know about.
What All Ports Are Rrequired By Domain Controllers And Client Computers?: Date - Feb 04, 2009; Rating - 3.8; Author - Nirmal Sharma; This article explains the key port requirement for Client computers and Domain Controllers communicating with each other.
What Are The Two Things Required To Recover From AD Disaster?: Date - Dec 21, 2010; Rating - 1; Author - Nirmal Sharma; This article explains the two important things required to recover from AD Disaster.
What is Replication Queue and who manages the Queue?: Date - Mar 19, 2009; Rating - Not Rated; Author - Nirmal Sharma; This article explains the mechanim Bridgehead Servers use to process the replication changes.
When Delegation Doesn't Seem to Take: Date - Dec 09, 2005; Rating - 4; Author - Mitch Tulloch; Sometimes you delegate a task to a user, and then later on they can't perform that task. Why?
When to use and not use universal group membership caching: Date - Dec 20, 2005; Rating - 4.3; Author - Mitch Tulloch; This tip explains when to use and not use universal group membership caching.
Which DC Is Selected When Promoting A Member Server To DC?: Date - Nov 11, 2008; Rating - 2.7; Author - Nirmal Sharma; This article discusses the a mechanism used by the DCPromo.exe to select a DC when promoting a member server to Domain Controller.
Who's logged on?: Date - Apr 06, 2006; Rating - 3.1; Author - Mitch Tulloch; How to tell who's currently logged on to an Active Directory domain.
Why do we still need WINS?: Date - Jul 11, 2006; Rating - 3.9; Author - Mitch Tulloch; Why do we still need WINS servers on AD networks?