Windows Server 2008 R2 Active Directory

Präsentation zum Thema: "Windows Server 2008 R2 Active Directory"—  Präsentation transkript:

1 Windows Server 2008 R2 Active Directory
3/28/2017 8:11 PM Windows Server 2008 R2 Active Directory Wolfgang Sauer Principal Consultant AddOn Systemhaus GmbH © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2 Windows Server 2008 RTM Active Directory Funktionen
AD DS auf Servercore Read Only Domain Controller AD Snapshot Mehrere Kennwort Richtlinien Restartable AD DS Attributsfeine Überwachung Policy Maker Integration GP Preferences

3 Windows Server 2008 R2 Active Directory DNS / DHCP Features
Administrative Center Powershell Automation Best Practice Analyzer Papierkorb Managed Service Accounts Offline Domain Join DNS / DHCP Features DNS Blockliste, Replizierter Forwarder DHCP Link Layer Filter, Name Protection, …

4 Administrative Center
Aufgabenorientiert, Flexible Filter Multi Domain, Multi Forest Gut geeignet für seeeehr große AD Formulare Extensions

5 Powershell Automation
AD Powershell Provider über 70 Cmdlets wird beim "dcpromo" mit installiert über RSAT optional installierbar AD Powershell aufrufen alle Cmdlets auflisten Get-Command *-ad*

6 Powershell Automation
Einfache Beispiele (Dejá Vu Exchange 2007) Hilfe Get-Help Get-ADUser [-full, -examples] Benutzer analysieren Get-ADUser hdampf Get-ADUser hdampf –Properties * Terminalserver Eigenschaften  Get-ADUser hdampf –Properties UserParameters

7 Best Practices Analyzer
Validiert "Best Practices" für Active Directory Zertifikatsdienste Remote Desktop Services DNS, IIS

8 Powershell Automation Administrative Center Best Practice Analyzer
Demo Powershell Automation Administrative Center Best Practice Analyzer

9 AD DS Papierkorb Lebensdauer eines Objekts: bestimmt durch "Tombstone Lifetime" Forestweite Konfiguration 60 bzw. 180 Tage

10 Wiederherstellung Autorisierende Wiederherstellung
3/28/2017 8:11 PM Wiederherstellung Autorisierende Wiederherstellung DC in den DSRM booten Backup wiederherstellen Versionsnummer mit "ntdsutil" erhöhen Reanimierung des Tombstone Ldp oder 3rd Party Tools Attributsgewinnung durch AD Snapshot oder "Werding" ( © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11 Lebensdauer eines Objekts
Zwei Phasen "Deleted Object Lifetime" "Tombstone Lifetime"

12 Lebensdauer eines Objekts
Objekte analysieren "deleted objects": OID: "recycled und deleted objects" OID:

13 Lebensdauer eines Objekts
180 Tage Live Object Tombstone Object Garbage collection Windows Server 2008 Returns Tombstones LDAP OID Windows Server 2008 R2 with Recycle Bin enabled (If not enabled, behavior is similar to Windows Server 2008) Returns Deleted LDAP OID Returns Deleted and Recycled Live Object Deleted Object Recycled Object Garbage collection 180 Tage 180 Tage

14 Voraussetzungen und Nebenwirkungen
AD Papierkorb erst wenn: alle Domänen Controller in der Gesamtstruktur auf Windows Server 2008 R2 umgestellt sind in den Gesamtstrukturfunktionsmodus "Windows Server 2008 R2" umgeschalten wurde Wenn der AD Papierkorb aktiviert ist können nur Objekte wiederhergestellt werden die sich in der "Deleted Object Lifetime" Phase befinden

15 Papierkorb Aktivieren
Forestweiter Geltungsbereich und nicht reversibel Enable-ADOptionalFeature "Recycle Bin Feature" -Scope Forest –Target <forest> Get-ADOptionalFeature -Filter {Name –Like "*"}

16 Papierkorb aktiviert? Active Directory Recycle Bin, GUID 766ddcd8-acd0-445e-f3b9-a7f9b6744f2a

17 Managed Service Accounts
Neuer AD Kontentyp automatisches Kennwort Management vereinfachtes SPN Management Verwaltung und Voraussetzung (noch?) nicht mit AD Benutzer & Computer mit Powershell New-ADServiceAccount –SAMAccountName <name> Install-ADServiceAccount –Identity <name> jeweils nur auf einem Computer verwendbar .Net Framework 3.5 (oder 3.5.1) RSAT AD Powershell

18 Managed Service Accounts
verwaltet im AD für Service oder IIS Appl.pool Virtual Account Logon Name = "NT SERVICE\<svcname>"

19 Offline Domain Join "Domain Join" ohne Kontakt zum DC
Computer werden im AD "prestaged" spart einen Reboot -> schnellere Bereitstellung massenweiser VMs PC Lieferant kann Rechner fertig vorinstallieren

20 AD DS Papierkorb Wiederherstellen gelöschter Objekte
Demo AD DS Papierkorb Wiederherstellen gelöschter Objekte

21 Your MSDN resources check out these websites, blogs & more!
3/28/2017 8:11 PM Your MSDN resources check out these websites, blogs & more! Presentations TechDays: MSDN Events: MSDN Webcasts: MSDN Events MSDN Events: Save the date: Tech•Ed 2009 Europe, 9-13 November 2009, Berlin MSDN Flash (our by weekly newsletter) Subscribe: MSDN Team Blog RSS: Developer User Groups & Communities Mobile Devices: Microsoft Solutions User Group Switzerland: .NET Managed User Group of Switzerland: FoxPro User Group Switzerland: © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22 Your TechNet resources check out these websites, blogs & more!
3/28/2017 8:11 PM Your TechNet resources check out these websites, blogs & more! Presentations TechDays: TechNet Events TechNet Events: Save the date: Tech•Ed 2009 Europe, 9-13 November 2009, Berlin TechNet Flash (our by weekly newsletter) Subscribe: Schweizer IT Professional und TechNet Blog RSS: IT Professional User Groups & Communities SwissITPro User Group: NT Anwendergruppe Schweiz: PASS (Professional Association for SQL Server): © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23 Save the date for tech·days next year!
3/28/2017 8:11 PM Save the date for tech·days next year! 7. – 8. April 2010 Congress Center Basel © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24 Premium Sponsoring Partners
3/28/2017 8:11 PM Premium Sponsoring Partners Classic Sponsoring Partners Media Partner © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25 3/28/2017 8:11 PM © 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.