Tag Info

Hot answers tagged

25


14

Here is an article I found that may get you started. I can never remember the path to the records off the top of my head. As it mentions basically you can find your DNS information in the AD at this path. DC=<ZoneName>,cn=MicrosoftDNS,cn=System,<DomainDN>, So if you had a domain example.org you would see it at. ...


12

The problem most people face when storing data in AD is Extending the Schema (which often has company-political implications) Using an existing attribute and editing the permissions (which results in AD/ACL bloat that increases your DIT and subsequent replication size) There is an alternative... the best choice in my mind is to use this lesser known ...


10

Schema updates are a one way function. You can only add new schema to AD, you can never delete anything. For this reason you should always carefully evaluate alternatives when software requires schema extensions or updates; be sure it's something you're willing to commit to using. First thing, make sure you have a good backup copy of the AD database ...


9

Has foo user sysadmin rights on SQL Server? Because if it does then any sysadmin user will have by default assigned schema dbo, independently of what is set in User's properties for a specific database. So, in order to have a default schema a user needs to have database roles like db_owner, db_datawriter and so on, instead of server role sysadmin. Tell ...


9

This TechNet article goes into great detail about how to sieze the roles. Don't panic, the domain can function with both if those roles offline for a fairly long amount of time. Don't rush the recovery process because you're nervous. I would promote a new DC first, so that you have two in your domain, then worry about seizing the roles. In addition to ...


8

1) Schema updates are not related to licensing in any way, so, yes, you can run a schema update from ANY Windows installation media (probably excluding SBS, but that's a completely different product). 2) No, SP2 is not a prerequisite for this schema update. 3) No, in order to fully restore AD from a backup, you only need to restart a single DC in DSRM and ...


6

I would make separate databases, because otherwise, if each client is using a similar schema, you're going to either have to combine tables or use lots of prefixes, or have link tables containing client identifying information. In addition, it will be much easier to manage backups/restores of client data if they have their own DBs. There's really no good ...


6

No, the situation you describe is not possible. A domain controller will not replicate an object from a different schema than its own. Active Directory is a little smarter than that. :) From TechNet: Effect of Schema Changes on Replication Attribute definitions are stored in attributeSchema objects in the schema directory partition. Changes to ...


5

I've never seen a schema update (so long as it's done properly) go wrong. MS really seem to have pulled out all the stops in making this a solid and reliable process, and it shows. The only real scenarios in which I could see anything bad happening would be if you lost power partway through (even then I'm not certain), or if your AD was already screwed to ...


5

Grant the user CREATE privilege on the database, e.g. GRANT CREATE ON DATABASE test TO eonil


5

The term "best-practices" when referring to the structure of your Active Directory is very open ended. There are a variety of factors that will determine what will make the most sense for you in your environment, and Microsoft identifies that what works for one enterprise will not necessarily work for another one. That said, Microsoft recommends that you ...


5

Your structure looks generally good enough. My one suggestion is this. Don't get do per-department or per-program OUs unless the computers are dramatically different, or your departments are huge and you actually need them to be separate because of how many objects would be in a single OU that combined everyone. I don't know about your organization but ...


5

Using an auxiliary class means that your private extensions are contained within this class and can be handled as one entity, and it is separated from the standard user class, avoiding conflicts. As this has no drawbacks and might avoid potential problems down the road, I can't think of a single reason why anyone would even consider to extend the user class ...


4

I would be shocked if there was a faster solution than the CREATE TABLE AS SELECT. Exporting and importing, whether you are using the classic version or the DataPump version, is going to require that Oracle read the entire table from disk and write the entire table to disk in the new schema, just like CTAS, but with an interim step of writing the data to ...


4

According to the technet article "Windows Server 2008 R2: Schema Updates", the last update was in the RC. However, this article hasn't been updated since the RTM. A friend of mine has access to the RTM install ISO and said that the \support\adprep folder only had updates through sch47.ldf, which is what the above article mentioned. I didn't do a diff of ...


4

I spend a non-trivial amount of time trying to persuade people to use dia for stuff like this. Not because it's a great diagram-making programme, which it's not (though it's pretty good), but because it runs on Windows, Mac and Linux, so the largest possible group of people can help work on any given diagram. As a secondary benefit, I can send dia files ...


4

CN denotes a common name and is used to denote well-known AD containers such as Users, Computers, System, etc. When create your own Users OU, you've done just that, create an OU, so you no longer use the CN= syntax, you use the OU= syntax for that part of the path. In the example you've provided, if you're just specifying a path to the objects, you wouldn't ...


4

The employeeNumber field while not viewable via the GUI is still able to be queried by anyone with read access to AD if I'm not mistaken. It may take more effort than "Outlook" though. But honestly...it's the last 4 of the SSN...so I think your approach, if management is fine with it, is good enough. Just make sure you don't care about an actual employee ...


3

You may try MySQL Workbench to create a diagram by importing the sql create statements of your database.


3

No, AD schema attributes should be considered permanent. If you only want the attribute to not appear in the Attribute Editor tab, or other dialogs where an object may present the list of possible attributes, you may want to try editing the User class object in AD Schema MMC, and removing the attribute from the list of optional attributes. You would need ...


3

The default, out of the box schema already contains both an employeeNumber and an employeeID attribute... Reading the attributes: PS H:\> Get-ADUser jbob -Properties EmployeeId,EmployeeNumber DistinguishedName : CN=JoeBob,OU=Users,OU=Bros,DC=contoso,DC=com EmployeeID : A1B2C3 EmployeeNumber : 1234556 Enabled : True GivenName ...


2

It's not open-source and not free (license is 99 USD): DBDesc dbdesc is a powerful tool to help you document your databases. It can produce detailed documents describing your databases. [...] Now dbdesc includes a built-in report engine and report viewer to easily browse database documentation. This report can be exported to PDF. ...


2

Yes, MySQL locks the table completely whilst it does the ALTER TABLE statement. Most of this time is spent in physically copying the table, which is why it is recommended you put all your necessary changes together in the one ALTER TABLE statement. There are several approaches to mitigating this problem on a live database if you can't get a decent ...


2

One downside of seperate db's is rolling out schema changes; if you have a couple hundred db's, be prepared to find a clever way to push new tables, stored procedures, indexes for upgrades to them. Another downside is mirroring becomes less attractive for a DR solution as the number of db's grows.


2

You can't, unless the schema or table(s) reside on their own filegroup. SQL server only supports backups at the database level or at the filegroup/file level, not at the table (or at any other object's) level. http://technet.microsoft.com/en-us/library/ms175477.aspx


2

By default, rights to the objects in the schema are not granted to a user. However, there are a few ways in which a user may get the rights to the object. For example, rights can be granted explicitly to the user and/or to a group in which the user is a member. The DENY command denies rights to the user or group even if the user has been granted rights to ...


2

You could always extend the Active Directory with a new field for this purpose. Here is a document that includes instructions on adding a new attribute and limiting permissions on the attribute.


2

You could do this with a bash script and a pipe #!/bin/bash DBNAME="YourDatabaseName" TNAME=shard_ TVAL="0" echo "USE $DBNAME;" while [ $TVAL -lt 10 ] do echo "ALTER TABLE $TNAME$TVAL ...;" TVAL=$[$TVAL+1] done and to use it ./scriptname | mysql -u user -p


2

The employeeType of the inetOrgPerson objectclass would appear to be the appropriate field. You may be able to determine E-mail only by lack of certain fields.



Only top voted, non community-wiki answers of a minimum length are eligible