Active Directory

Backlink attributes are constructed and not changeable. For example, in a group membership, the member attribute on the group is changeable, while the backlink attribute—the memberOf attribute on the user—is not.

The Windows PowerShell cmdlets in turn connect to the Active Directory Web Service (ADWS) that was introduced in Windows Server 2008 R2. If you want to use ADAC with a domain that does not have any Windows Server 2008 R2 or newer domain controllers, you’ll need to download and install ADWS for Windows Server 2003 or Windows Server 2008. We’ll discuss ADWS in more detail in Chapter 9, including details on how to add it to older domain controllers.

The benefit of converting a security group to a distribution group is usually not so obvious. The most useful aspect of this conversion is that you can safely disable a security group to verify whether or not it is being used for Windows security.

Universal and global groups can be used in access control lists (ACLs) on any resource in the forest or in trusting domains. Domain local groups can only be used in ACLs in the domain in which they are created.

w32tm /config /update /manualpeerlist:"0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org" /syncfromflags:manual /reliable:YES
w32tm /resync /rediscover /nowait

It is specifically a bad idea to restore the RID master from a backup, so you should keep the RID master on a separate domain controller if you want to be able to restore the other FSMO role holders from a backup

PDC Emulator - dc=mycorp,dc=com

Infrastructure Master - cn=Infrastructure,dc=mycorp,dc=com

RID Master - cn=RID Manager$,cn=System,dc=mycorp,dc=com

Schema Master - cn=Schema,cn=Configuration,dc=mycorp,dc=com

Domain Naming Master - cn=Partitions,cn=Configuration,dc=mycorp,dc=com

The information in the attribute is stored as a DN, representing the NTDS Settings object of the domain controller that is the role owner. So, example contents for this attribute might be:

CN=NTDS Settings, CN=MYSERVER1, CN=Servers, CN=My Site,
CN=Sites, CN=Configuration, DC=mycorp, DC=com

Once the Active Directory Recycle Bin has been enabled, the infrastructure master’s functions are performed independently by every DC in the forest. That is, the tasks just described are no longer delegated to a single DC.

is a common misunderstanding that the schema and domain naming masters cannot be hosted outside of the root domain. Any domain controller in the forest (from any domain) can host the schema and domain naming master FSMO roles. In general, we recommend that these FSMOs be kept on a domain controller in the forest root unless you have a reason to place them elsewhere.

The Global Catalog is read-only and cannot be updated directly.