The Five FSMO Roles

1. Schema Master – The schema master domain controller controls all updates and modifications to the schema. Once the Schema update is complete, it is replicated from the schema master to all other DCs in the directory.

2. Domain Naming Master – The domain naming master domain controller controls the addition or removal of domains in the forest.

3. Infrastructure Master – The Infrastructure Manager role is responsible for updating references from objects within its domain with objects in other domains.

4. Relative ID (RID) Master – Manages the Security Identifier (SID) for every object within the domain.

5. PDC Emulator – The PDC emulator role provides backwards compatibility for Windows NT backup domain controllers (BDCs)

This was a quick summary of the FSMO roles for complete details see the article Windows 2000 Active Directory FSMO role I know it says Windows 2000 but it provides a good explanation of all the FSMO roles.

Company: Dovestones
Website: http://www.dovestones.com/active-directory/FSMORoles.html

The cleanup wizard searches Active Directory for duplicate Windows NT accounts, and then suggests merge operations that would remove the duplicate accounts. Once an operation has been selected the wizard merges various account types, their attributes and their properties into a single user account.

Removing duplicate accounts in your Active Directory environment can help improve performance for Exchange Servers.

The Active Directory Account Cleanup Tool allows you to:

• Identify duplicate objects to be merged. You can have the wizard search or you can manually select duplicate account from Active Directory that you want to merge.
• Review and modify merge operations before you merge the duplicate accounts
• Export and import lists of accounts
• Use command line options to run the wizard.

Active Directory Account Cleanup is a command line tool ADClean.exe that is installed in the SystemRoot\Program Files\Exchsrvr\Bin folder.

Applies to:

• Microsoft Exchange Server 2003 Enterprise Edition
• Microsoft Exchange Server 2003 Standard Edition
• Microsoft Exchange 2000 Server Standard Edition
• Microsoft Windows Small Business Server 2003 Premium Edition
• Microsoft Windows Small Business Server 2003 Standard Edition

For more information and complete command line options see links below

Company: Microsoft
Websites: ADClean Command Line Options | How to Run the Active Directory Account Cleanup Wizard

These tools are for use with Windows 2003 Server only. The Rename Tools is not supported in an Active Directory forest that has any version of Exchange Server prior to 2003 SP1.

Using the Domain Rename Tools you can change not only the name of a domain but you can change the structure of the domain hierarchy such that the parent of a domain can be changed.

A good example of this is a situation involving company acquisition, mergers or name changes. Using the Active Directory Domain Rename Tools you can make several kinds of changes to an existing Windows Server 2003 forest; including:

• Renaming without repositioning any domain in the forest structure

• Create a new domain tree structure by repositioning domains with a tree

• Create new tree

It is important to note that the goal of the domain rename functionality provided for a Windows Server 2003 forest is to ensure that there is a supported method to rename domains in a deployed Active Directory Forest. The intent is not to make a domain rename a routine operation.

The reason for this is the domain rename process is complex and requires a great deal of care in planning and execution. It can also be a time consuming process.

Microsoft has a couple of documents that give step by step instructions on the domain rename process. See link below.

Company: Microsoft
Website: http://technet.microsoft.com/en-us/windowsserver/bb405948.aspx

Exchange Load Generator allows you to test how a server running exchange responds to email loads. To simulate an email load your run this tool on client computers.

Running the tool on client computers will send multiple requests to the exchange server causing a mail load.

Running a simulated load helps administrators validate a deployment plan. It also helps Exchange Administrators validate Exchange Server configurations and settings.

Test results can also help identify bottlenecks on your exchange servers.

The computer that you will be running Exchange Load Generator from should be a member of the Active Directory Domain. The Exchange Load Generator Tool requires Domain Administrator rights because it must create user accounts, Organizational units and query based distribution groups in the Active Directory Forest.

The tool can be installed on Windows 2003, 2008 server, Vista and XP. It is best to simulate the workload from the client computer.

In conclusion Microsoft’s Exchange Load Generator is a good tool to simulate an email load on your Exchange Servers. It’s also a good way to validate your servers in a deployment plan and overall solution.

Company: Microsoft
Website: Exchange Load Generator 32 bit
Website: Exchange Load Generator 64 bit

ExchMbx needs to be run on a Windows 2000, Windows XP or Windows 2003 Server; these machines also need to have the Exchange System Manager tools installed.

I will show one example of how you can do Exchange command line management using ExchMbx.

Mailbox-enabling an AD user object.

In this example we will mailbox-enable an already existing AD user object. We’re mailbox-enabling an AD user named Testguy01 located in an Organizational Unit (OU) named MY Users. The user belongs to an Active Directory domain named exchangedomain.local (DC=exchangedomain, DC=local), and we are creating the mailbox in Mailbox store store1 in the first storage group on the exchange server.

The mailbox is created with the –cr switch/option.

C:\ExchMbx>exchmbx -b “CN=Testguy01,OU=My User ,OU=Hosted,DC=Exchangedomain,DC=local”
-cr exserver01:”First Storage Group:Mailbox Store (store1)”

Another example: You can easily pipe lists of distinguished names (DNs) to ExchMbx by using windows input mechanisms. You can easily create thousands of mailboxes. Moving mail-enabled mailboxes, clearing attributes can also be easily done with ExchMbx.

Exchmbx –move MDB –upto 100

Will move the first 100 mailboxes. Using these commands lets you quickly perform tasks that would be difficult or time consuming if you were to only use the Windows GUI tools.

PlatForms

• Windows 2000
• Windows Server 2003
• Windows XP
• Tested against Exchange 2000 and Exchange 2003
• Untested on Exchange 2007

* Requires the installation of Exchange Tools on the machine running the executable.

Company:.joeware
Website: http://www.joeware.net/freetools/tools/exchmbx/index.htm

So for example, you modify a user account on Domain Controller1 and you want to verify these changes replicated to Domain Controller2 with no issues. Using Repadmin your can determine whether all domain controllers have the same replicated values.

If a specific domain controller does not have the same value, and the changes were made some time ago, you can begin troubleshooting why the Domain Controller has not received the change.

I nice feature of Repadmin is the ability to provide specific information related to replication errors.

To list any replication errors enter Repadmin /SHOWREPS and the FQDN of the domain controller you want to check. You will see a listing of each inbound connection and its status.

Administrators can use Repadmin to view the replication topology as seen by the Domain Controllers. Repadmin can also be used to manually force replication between Domain Controllers.

Repadmin can also be used to monitor the health of an Active Directory Forest.

The operations replsummary, showrepl, showrepl /csv, and showvector /latency can be used to check for replication problems.

Company: Microsoft
Download: Windows Support Tools
Syntax: http://technet.microsoft.com/en-us/library/cc736571%28WS.10%29.aspx

The Account Lockout and Management Tools is an extracted executable called ALTools.exe. This file can be downloaded from the Microsoft download center. Once ALTools.exe is downloaded you will extract the file to a directory of your choice. These tools can be installed on a domain controller, member server or a workstation.

Accinfo.dll
This DLL file will add a new tab to Active Directory Users and Computers called Additional Account info. The tab adds lots of information about users logon details, password details, logon count, bad password count, etc.

ALockout.dll
This tool will create a log file that will help troubleshoot account lockout problems. It can help determine a process or application that is sending wrong credentials.

ALoInfo.exe
This tool displays all user account names and the age of their passwords. You can use tool this to determine which accounts are about to expire.

EnableKerbLog.vbs
Used as a startup script, allows Kerberos to log on to all your clients that run Windows 2000 and later.

EventCombMT.exe
This tool gathers event logs from several machines to one central location. You can create filters for searching specific event IDS across all servers.

LockoutStatus.exe
Displays various information about locked out accounts. LockOutStatus.exe uses the NLParse.exe tool to parse the Netlogon logs for specific Netlogon return status codes. What I like best about this tool is it will tell me which Domain Controller the account was locked out on first. It also determines all the Domain Controllers that are involved in a lockout.

NLParse.exe
Used to extract and display entries from the Netlogon log files.

Company: Microsoft
Website: Account Lockout and Management Tools

The limitation to this is you cannot copy items or information from the snapshot to the production database. The Directory Service Comparison Tool makes use of Active Directory Snapshots to expand its functionality.

Main features of Directory Service Comparison Tool

• Display differences between objects in Active Directory and Active Directory Snapshots

• Restore attribute values from snapshots to Active Directory

• Reanimate deleted object

• Display differences in group membership for a selected object (users, computers and groups). Allows for full or selective restore of group membership at any time.

• Retrieve relevant AD audit event log entries for a specific object from all domain controllers in a domain. Filtering options allow you to find and inspect attribute specific event log entries.

Directory Service Comparison Tools requires the domain services to be running Windows Server 2008. Directory Service Comparison Tool does not have to be installed on a domain controller, it can be installed on Windows 2008 Server, Windows XP SP3, and most likely Windows Viste (not tested yet).

Company: Lindstrom
Website: http://lindstrom.nullsession.com/?page_id=11

This tool is easy to use, select the computers to query by selecting them in Active Directory or from a text file. The query results can be XML or text file.

Typical usage scenarios

RSOP Queries:

* Do a software inventory for users and computers in a domain or OU
* See which applications are installed on computers in the domain
* Track the rollout of new GPOs on a domain
* Find computers that have not downloaded and applied new GPOs

WMI Queries:

* Do a complete hardware inventory (processor, memory, hard disk space, etc) for all computers in the domain
* Scan all computers to see if a particular hotfix is applied
* See the amount of disk space that is available on computers
* Test a WMI filter before implementing it in the domain

Company: Microsoft
Website: Group Policy Inventory

Prior to having the GPMC tool loaded you would have to browse through domains, sites and OU’s to find a specific GPO. All of that wasted time can be avoided with the Group Policy Manage Console.

Key features of Group Police Manage Console (GPMC

• Centralized console that makes managing all Group Policies easier

• Backup and restore of group policy objects

• Import/export and copy/paste of Group Policy objects and WMI filters

• HTML reporting for Group Policy object settings and (RSoP) Resultant Set of Policy

• Scripting of Group Policy related tasks that are exposed within this tool

The Group Policy Management Console is a free add on for Windows 2003 and XP. It works for Domain Controllers running windows 2000 but can only be install on systems running Windows 2003 or XP. For Domain Controllers running Windows 2008 the GPMC tool is loaded by default.

GPMC gives administrators a whole new way of looking at group polices. Once you get used to how it works, it’s a must have tools for designing and troubleshooting group polices.

Company: Microsoft
Website: Group Policy Management Console