Tag Info

Hot answers tagged

25


14

Here is an article I found that may get you started. I can never remember the path to the records off the top of my head. As it mentions basically you can find your DNS information in the AD at this path. DC=<ZoneName>,cn=MicrosoftDNS,cn=System,<DomainDN>, So if you had a domain example.org you would see it at. ...


12

The problem most people face when storing data in AD is Extending the Schema (which often has company-political implications) Using an existing attribute and editing the permissions (which results in AD/ACL bloat that increases your DIT and subsequent replication size) There is an alternative... the best choice in my mind is to use this lesser known ...


10

Schema updates are a one way function. You can only add new schema to AD, you can never delete anything. For this reason you should always carefully evaluate alternatives when software requires schema extensions or updates; be sure it's something you're willing to commit to using. First thing, make sure you have a good backup copy of the AD database ...


9

Has foo user sysadmin rights on SQL Server? Because if it does then any sysadmin user will have by default assigned schema dbo, independently of what is set in User's properties for a specific database. So, in order to have a default schema a user needs to have database roles like db_owner, db_datawriter and so on, instead of server role sysadmin. Tell ...


9

This TechNet article goes into great detail about how to sieze the roles. Don't panic, the domain can function with both if those roles offline for a fairly long amount of time. Don't rush the recovery process because you're nervous. I would promote a new DC first, so that you have two in your domain, then worry about seizing the roles. In addition to ...


8

1) Schema updates are not related to licensing in any way, so, yes, you can run a schema update from ANY Windows installation media (probably excluding SBS, but that's a completely different product). 2) No, SP2 is not a prerequisite for this schema update. 3) No, in order to fully restore AD from a backup, you only need to restart a single DC in DSRM and ...


6

I would make separate databases, because otherwise, if each client is using a similar schema, you're going to either have to combine tables or use lots of prefixes, or have link tables containing client identifying information. In addition, it will be much easier to manage backups/restores of client data if they have their own DBs. There's really no good ...


6

No, the situation you describe is not possible. A domain controller will not replicate an object from a different schema than its own. Active Directory is a little smarter than that. :) From TechNet: Effect of Schema Changes on Replication Attribute definitions are stored in attributeSchema objects in the schema directory partition. Changes to ...


5

I've never seen a schema update (so long as it's done properly) go wrong. MS really seem to have pulled out all the stops in making this a solid and reliable process, and it shows. The only real scenarios in which I could see anything bad happening would be if you lost power partway through (even then I'm not certain), or if your AD was already screwed to ...


5

Using an auxiliary class means that your private extensions are contained within this class and can be handled as one entity, and it is separated from the standard user class, avoiding conflicts. As this has no drawbacks and might avoid potential problems down the road, I can't think of a single reason why anyone would even consider to extend the user class ...


5

The term "best-practices" when referring to the structure of your Active Directory is very open ended. There are a variety of factors that will determine what will make the most sense for you in your environment, and Microsoft identifies that what works for one enterprise will not necessarily work for another one. That said, Microsoft recommends that you ...


5

Your structure looks generally good enough. My one suggestion is this. Don't get do per-department or per-program OUs unless the computers are dramatically different, or your departments are huge and you actually need them to be separate because of how many objects would be in a single OU that combined everyone. I don't know about your organization but ...


5

Grant the user CREATE privilege on the database, e.g. GRANT CREATE ON DATABASE test TO eonil


4

I spend a non-trivial amount of time trying to persuade people to use dia for stuff like this. Not because it's a great diagram-making programme, which it's not (though it's pretty good), but because it runs on Windows, Mac and Linux, so the largest possible group of people can help work on any given diagram. As a secondary benefit, I can send dia files ...


4

The employeeNumber field while not viewable via the GUI is still able to be queried by anyone with read access to AD if I'm not mistaken. It may take more effort than "Outlook" though. But honestly...it's the last 4 of the SSN...so I think your approach, if management is fine with it, is good enough. Just make sure you don't care about an actual employee ...


4

CN denotes a common name and is used to denote well-known AD containers such as Users, Computers, System, etc. When create your own Users OU, you've done just that, create an OU, so you no longer use the CN= syntax, you use the OU= syntax for that part of the path. In the example you've provided, if you're just specifying a path to the objects, you wouldn't ...


4

I would be shocked if there was a faster solution than the CREATE TABLE AS SELECT. Exporting and importing, whether you are using the classic version or the DataPump version, is going to require that Oracle read the entire table from disk and write the entire table to disk in the new schema, just like CTAS, but with an interim step of writing the data to ...


4

According to the technet article "Windows Server 2008 R2: Schema Updates", the last update was in the RC. However, this article hasn't been updated since the RTM. A friend of mine has access to the RTM install ISO and said that the \support\adprep folder only had updates through sch47.ldf, which is what the above article mentioned. I didn't do a diff of ...


3

You may try MySQL Workbench to create a diagram by importing the sql create statements of your database.


3

The default, out of the box schema already contains both an employeeNumber and an employeeID attribute... Reading the attributes: PS H:\> Get-ADUser jbob -Properties EmployeeId,EmployeeNumber DistinguishedName : CN=JoeBob,OU=Users,OU=Bros,DC=contoso,DC=com EmployeeID : A1B2C3 EmployeeNumber : 1234556 Enabled : True GivenName ...


3

No, AD schema attributes should be considered permanent. If you only want the attribute to not appear in the Attribute Editor tab, or other dialogs where an object may present the list of possible attributes, you may want to try editing the User class object in AD Schema MMC, and removing the attribute from the list of optional attributes. You would need ...


2

psst! Hey you! Yeah you, the confused looking dude! This isn't reddit! :-) Also, more importantly, that's not how you add schemas in OpenLDAP (see the manual) -- You want to add an include /path/to/the/schema/file directive to the LDAP server's configuration file (/etc/openldap/slapd.conf). Something like include /etc/openldap/schema/apple.schema ...


2

Each has possible pros and cons, and there may be an option you haven't considered. Here's some general input, hope it helps. Create 2 databases Maintenance becomes slightly more complex, with 2 databases to keep in sync, 2 databases to manage backups for, check performance on, etc. Front-end access becomes slightly more complex, where you need to UNION ...


2

If Exchange has not been actually installed anywhere (or if it's there, but you can afford completely losing it), you can remove all Exchange-related informations from Active Directory and the run the preparation steps again. You need to remove the Exchange Organization object in the Configuration partition of your Active Directory forest; the easiest way ...


2

You could do this with a bash script and a pipe #!/bin/bash DBNAME="YourDatabaseName" TNAME=shard_ TVAL="0" echo "USE $DBNAME;" while [ $TVAL -lt 10 ] do echo "ALTER TABLE $TNAME$TVAL ...;" TVAL=$[$TVAL+1] done and to use it ./scriptname | mysql -u user -p


2

Unless there are existing ObjectClasses that have the attributes you want you need to extend your LDAP server's schema to support these new attributes in a sane way (preferable to munging/recycling existing attributes for new purposes, and more flexible). If there are already ObjectClasses that meet your requirements it's better to make your entities members ...


2

The employeeType of the inetOrgPerson objectclass would appear to be the appropriate field. You may be able to determine E-mail only by lack of certain fields.


2

I have had good luck with the following technique below (using a schema named "myschema" for the example). It sounds like you have most of the pieces in place but the schema/role ownership might not be set correctly. -- Create the role that will own the schema CREATE ROLE [myschema_owner] AUTHORIZATION [dbo]; -- Create the role that will have execute ...


2

As for finding what's using the attributes, I think your best hope is some rather severe logging of the directory service access events by enabling the setting for it in the audit config of the Domain Controllers GPO, as well as setting aggressive audit ACLs to inherit throughout the domain. The logs will likely get very noisy. If possible, the new ...



Only top voted, non community-wiki answers of a minimum length are eligible