Reduced Administrative Effort for Interactive Administrative Tasks

Enhanced Command-line and Automated Management

During your review of PowerShell version 2.0 in Windows Server 2008 R2, you will want to familiarize yourself with the new GUI tools, Graphical PowerShell and the Out-GridView cmdlet. As illustrated in the following figure, Graphical PowerShell provides a GUI that allows you to interactively create and debug PowerShell scripts within an integrated development environment similar to Visual Studio.

Graphical PowerShell includes the following features:

Syntax coloring for PowerShell scripts (similar to syntax coloring in Visual Studio)

Support for Unicode characters

Support for composing and debugging multiple PowerShell scripts in a multi-tabbed interface

Ability to run an entire script, or a portion of a script, within the integrated development environment

Support for up to eight PowerShell runspaces within the integrated development environment

Note: Graphical PowerShell feature requires Microsoft .NET Framework 3.0.

The new Out-GridView cmdlet displays the results of other commands in an interactive table, where you can search, sort, and group the results. For example, you can send the results of a get-process, get-wmiobject, or get-eventlog command to Out-GridView and use the table features to examine the data.

Also during your review, you will want to familiarize yourself with the new and updated cmdlets available in PowerShell version 2.0 and Windows Server 2008 R2, a very few of which are listed in the following figure.

Improved Identity Management

Identity management has always been one of the critical management tasks for Windows-based networks. The implications of a poorly managed identity managed system are one of the largest security concerns for any organization.

Windows Server 2008 R2 includes identity management improvements in the Active Directory Domain Services and Active Directory Federated Services server roles.

Improvements for All Active Directory Server Roles

Windows Server 2008 R2 includes the following identity management improvements that affect all Active Directory server roles:

New forest functional level. Windows Server 2008 R2 includes a new Active Directory forest functional level. Many of the new features in the Active Directory server roles require the Active Directory forest to be configured with this new functional level.

Enhanced command line and automated management. PowerShell cmdlets provide the ability to fully manage Active Directory server roles.

Improved automated monitoring and notification. An updated System Center Manager 2007 Management Pack helps improve the monitoring and management of Active Directory server roles.

Active Directory PowerShell Cmdlets: Step-by-step Feature Review

In this task you will use the PowerShell V2 Graphical Console to perform basic user and group administrative tasks. You will begin by loading the ActiveDirectory module, exposing over 75 Active Directory cmdlets. You will then use these cmdlets to administer Active Directory.

To review how the Active Directory PowerShell cmdlets feature works, you need to complete the tasks in the following table. Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 43: Active Directory PowerShell Cmdlets

High-level task	Details
Start the PowerShell V2 Graphical Console	On the Start menu, click All Programs, click Windows PowerShell V2, and then click Graphical Console (Windows PowerShell V2).
Load the Active Directory Module	In the PowerShell V2 Graphical Console, in the Command Pane, type the following commands, pressing Enter after each command. Add-Module ActiveDirectory Get-Module
List the available cmdlets	In the PowerShell V2 Graphical Console, in the Command Pane, type the following command, and then press Enter. Get-Command *ad*
Browse an Active Directory domain	In the Command Pane, enter the following commands, pressing Enter after each command (where domain_name is the name of your domain and top_level_domain is your top level domain). Cd AD: PWD DIR | Format-Table -Auto CD "DC=domain_name,_name DC=top_level_doman" DIR | ft –a Tip: You can press the TAB key to auto complete many of these commands and save a great deal of typing.
List all user objects	In the Command Pane, enter the following commands, pressing Enter after each command. CD CN=Users Dir | ft –a Get-ADObject –Filter {name -like “*”} Get-ADUser –Filter {name -like “*”} Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto
Enable the Guest user object	In the Command Pane, enter the following commands, pressing Enter after each command. Enable-ADAccount –Identity Guest Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto
Display information about the Domain Admins group	In the Command Pane, enter the following commands, pressing Enter after each command (where domain_name is the name of your domain and top_level_domain is your top level domain). Get-ADGroup -SearchBase "DC=domain_name,DC=top_level_domain" -SearchScope Subtree -Filter {Name -Like "*Domain Admins*"} -Properties Extended
Display information about a domain	In the Command Pane, type the following command and then press Enter (where domain_name is the name of your domain). Get-ADDomain domain_name The output of this command allows you to easily determine things such as operations master roles.
Display information about domain controllers	In the Command Pane, type the following command and then press Enter. Get-ADDomainController –Discover
Display information about the domain password policy	In the Command Pane, type the following command and then press Enter (where domain_name is the fully qualified domain name of your domain). Get-ADDefaultDomainPasswordPolicy domain_name
Create a new organizational unit	In the Command Pane, type the following command and then press Enter (where where domain_name is the name of your domain and top_level_domain is your top level domain). New-ADOrganizationalUnit –Name “Europe” –Path “DC=domain_name,DC=top_level_domain”
Display the properties of the new organizational unit	In the Command Pane, type the following command and then press Enter (where where domain_name is the name of your domain and top_level_domain is your top level domain). Get-ADOrganizationalUnit “OU=Europe,DC=domain_name,DC=top_level_domain” –Properties Extended
Delete the new organizational unit	In the Command Pane, type the following commands and then press Enter after each command (where where domain_name is the name of your domain and top_level_domain is your top level domain). CD AD: CD “DC=domain_name,DC=top_level_domain” Set-ADorganizationalUnit Europe –ProtectedFromAccidentalDeletion $False Remove-ADOrganizationalUnit Europe
Close the PowerShell V2 Graphical Console	Close the PowerShell V2 Graphical Console.

Improvements in Active Directory Domain Services

The Active Directory Domain Service server role in Windows Server 2008 R2 includes the following improvements:

Recovery of deleted objects. Domains in Active Directory now have a Recycle Bin feature that allows you to recover deleted objects. If an Active Directory object is inadvertently deleted, you can restore the object from the Recycle Bin. This feature requires the updated R2 forest functional level.

Improved process for joining domains. Computers can now join a domain without being connected to the domain during the deployment process, also known as an offline domain join. This process allows you to fully automate the joining of a domain during deployment. Domain administrators create an XML file that can be included as a part of the automated deployment process. The file includes all the information necessary for the target computer to join the domain.

Improved management of user accounts used as identity for services. One time-consuming management task is the maintenance of passwords for user accounts that are used as identities for services, also known as service accounts. When the password for a service account changes, the services using that identity also must be updated with the new password. To address this problem, Windows Server 2008 R2 includes a new feature known as managed service accounts. In Windows Server 2008 R2, when the password for a service account changes, the managed service account feature automatically updates the password for all services that use the service account.

Reduced effort to perform common administrative tasks. As illustrated in the following figure, Windows Server 2008 R2 includes a new Active Directory Domain Services management console, Active Directory Administrative Center.



Figure 22: Active Directory Administrative Center management console

Active Directory Administrative Center is a task-based management console that is based on the new PowerShell cmdlets in Windows Server 2008 R2. Active Directory Administrative Center is designed to help reduce the administrative effort for performing common administrative tasks.

Active Directory Administrative Center: Step-by-step Feature Review

To review how the Active Directory Administrative Center feature works, you need to complete the tasks in the following table. Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 54: Explore the Active Directory Administrative Center

High-level task	Details
Start the Active Directory Administrative Center	On the Start menu, point to Administrative Tools, and then click Active Directory Administrative Center.
Navigate to an organizational unit	In Active Directory Administrative Center, in the Explorer pane, click Overview. Using the fly-out menu system, navigate to organizational_unit (where organizational_unit is the name of the organizational unit where you want to create an organizational unit). Tip: Click the right arrow next to the domain root to begin using the fly-out menu system. As you navigate, type the first few letters of each organizational unit to shorten the navigation.
Create an organizational unit	In the Tasks pane, click New, and then click Organizational Unit. The Create dialog box appears. In the Create dialog box, in Name, type Demonstration OU, and then click OK.
Create a user	Using the fly-out menu system, navigate to Demonstration OU. In the Tasks pane, click New, and then click User. The Create dialog box appears. Compete the Create dialog box by using the following information, and then click OK: First Name: Pilar Last Name: Ackerman User logon: pilarau Select Password never expires check box. Clear Change password at next logon check box. Password: P@ssw0rd
Create a new group	Using the fly-out menu system, navigate to Demonstration OU. In the Tasks pane, click New, and then click Group. The Create dialog box appears. Compete the Create dialog box by using the following information, and then click OK: Name: Support Select Protect from Accidental Deletion check box.
Add a user to a group	In Search, type Pilar Ackerman. In the Results pane, click Pilar Ackerman. In the Tasks pane, click Add to group. In the Select Groups dialog box, in Enter the object names to select, type Support, click Check Names, and then click OK.

Active Directory Recycle Bin: Step-by-step Feature Review

To review how the Active Directory Recycle Bin feature works, you need to complete the following tasks:

Enable the Active Directory Recycle Bin feature

Delete objects in Active Directory

Verify the deleted objects are in the Active Directory Recycle Bin

Recover the objects in the Active Directory Recycle Bin

Verify the deleted objects have been recovered.

Note: Perform these steps in a test environment as these steps could adversely affect your production environment.

Enable the Active Directory Recycle Bin Feature

Perform the steps in the following table while logged on as a member of the Enterprise Admins security group. Before you can recover deleted objects in your Active Directory infrastructure, you must enable the Active Directory Recycle Bin feature.

Table 65: Enable the Active Directory Recycle Bin Feature

High-level task	Details
Start the Active Directory PowerShell Snap-in	On the Start menu, point to Administrative Tools, and then click Active Directory PowerShell Snap-in.
Check the state of the Recycle Bin feature	In Windows PowerShell, type the following command and then press Enter. Get-ADOptionalFeature –Filter ‘Name –Like “*”’ In the output you should see the: EnabledScopes property is currently empty, which indicates that this feature is not enabled. RequiredForestMode property indicates the prerequisites for enabling this feature.
Enable the Recycle Bin feature	In Windows PowerShell, type the following command and then press Enter (where forest is the name of your forest). Enable-ADOptionalFeature ‘Recycle Bin Feature’ –Scope Forest –Target ‘forest’ Note: The Recycle Bin feature is disabled by default. To confirm the command, press Enter. Note: Once you enabled the Recycle Bin feature, you cannot disable the feature at a later time.
Verify the Recycle Bin feature is enabled	In Windows PowerShell, type the following command and then press Enter. Get-ADOptionalFeature –Filter ‘Name –Like “*”’ The value of the EnabledScopes property reflects that the Recycle Bin is enabled.

Delete Objects in Active Directory

Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 76: Delete Objects in Active Directory

High-level task	Details
Start the Active Directory Administrative Center	On the Start menu, point to Administrative Tools, and then click Active Directory Administrative Center.
Navigate to an organizational unit	Using the fly-out menu system, navigate to Demonstration OU Tip: Click the right arrow next to the domain root to begin using the fly-out menu system. As you navigate, type the first few letters of each organizational unit to shorten the navigation.
Delete an organizational unit	In the Tasks pane, click Delete. In the Delete Confirmation dialog box, click Yes.

Verify the deleted objects are in the Active Directory Recycle Bin

Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 87: Verify the deleted objects are in the Active Directory Recycle Bin

High-level task	Details
Start the Active Directory PowerShell Snap-in	On the Start menu, point to Administrative Tools, and then click Active Directory PowerShell Snap-in.
Display the contents of the Recycle Bin	In Windows PowerShell, type the following command and then press Enter (where domain is your domain name and top_level_domain is your top level domain name). Get-ADObject –SearchBase “CN=Deleted Objects,DC=domain,DC=top_level_domain” –ldapFilter “(objectClass=*)” -includeDeletedObjects This command displays the entire contents of the recycle bin. Leave the output of this command on the screen as you will use it in the next step.
Verify the Pilar Ackerman user object is in the Recycle Bin	In Windows PowerShell, type the following command and then press Enter. Get-ADObject –Filter ‘Name –Like “*Pilar Ackerman*”’ –SearchScope Subtree –includeDeletedObjects The output of this command will show the details for the Pilar Ackerman user object. The distinguished name indicates this object is in the Recycle Bin.
Verify the Demonstration OU is in the Recycle Bin	In Windows PowerShell, type the following command and then press Enter. Get-ADObject –Filter ‘Name –Like “*Demonstration OU*”’ –SearchScope Subtree –IncludeDeletedObjects The output of this command will show the details for the Demonstration OU organizational unit. The distinguished name indicates this object is in the Recycle Bin.

Recover Deleted Objects in Active Directory Recycle Bin

Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 98: Recover Deleted Objects in Active Directory Recycle Bin

High-level task	Details
Start the Active Directory PowerShell Snap-in		On the Start menu, point to Administrative Tools, and then click Active Directory PowerShell Snap-in.
Attempt to restore the Pilar Ackerman user object	In Windows PowerShell, copy the objectGUID value for the object Pilar Ackerman to the clipboard. Tip: To copy text from a command prompt, right click and then select Mark. Highlight the text to copy and then press Enter. The objectGUID was listed in a previous output. In Windows PowerShell, type the following command and then press Enter (where objectGUID is the objectGUID for Pilar Ackerman). Restore-ADObject –Identity objectGUID Tip: To paste, right-click and then click Paste. The command fails with an error message indicating that the objects parent object does not exist.
Identify the parent container for the Pilar Ackerman user object	In Windows PowerShell, type the following command and then press Enter. Get-ADObject –Filter ‘Name –Like “*Pilar Ackerman*”’ –SearchScope Subtree –includeDeletedObjects –properties lastKnownParent This command displays the last known parent object, which you can tell, is also in the Recycle Bin.
Restore the deleted organizational unit	In Windows PowerShell, type the following command and then press Enter (where objectGUID is the objectGUID of the Demonstration OU organizational unit). Restore-ADObject –Identity objectGUID Tip: To complete this command, copy the value of the objectGUID property from the Demonstration OU object, which can be found from the output of the last command.
To restore all the deleted objects	In Windows PowerShell, type the following command and then press Enter (where domain is your domain name and top_level_domain is your top level domain name). Get-ADObject –ldapFilter “(lastKnownParent=OU=Demonstration OU, DC=domain,DC=top_level_domain)” –includeDeletedObjects | Restore-ADObject This command lists all objects that have the last known parent attribute as the Demonstrated OU and pipes them into the Restore-ADObject Cmdlet.

Verify the Deleted Objects Are Recovered

Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 109: Verify the Deleted Objects Are Recovered

High-level task	Details
Start the Active Directory Administrative Center	On the Start menu, point to Administrative Tools, and then click Active Directory Administrative Center.
Verify the Demonstration OU organizational unit has been recovered	Using the fly-out menu system, navigate to Demonstration OU Tip: Click the right arrow next to the domain root to begin using the fly-out menu system. As you navigate, type the first few letters of each organizational unit to shorten the navigation.
Verify the Pilar Ackerman user object has been recovered	In Search, type Pilar Ackerman The Pilar Ackerman user object should appear in the results pane.

Offline Domain Join: Step-by-step Feature Review

Offline domain join involves two steps. In the first step you provision a computer account in Active Directory and save the account information in a file. In the second step you use that file in a command that inserts the domain join information into an offline version of Windows.

Perform the steps in the following table while logged on as a member of the Enterprise Admins security group.

Table 1110: Offline domain join

High-level task	Details
Provision a new computer account	On the Start menu, in Start Search, type cmd, and then press Enter. At the command prompt, type the following command and then press Enter (where domain_name is the name of your domain). DJOIN /Provision /Domain domain_name /Machine DEN-SRV-01 /SaveFile DEN-SRV-01.DJoin This command creates a computer account in Active Directory and stores the computer account password and related information in an encrypted file. The encrypted file can then be used to offline domain join a computer.
Display the contents of the provisioning file	At the command prompt, type the following command and then press Enter. Type DEN-SRV-01.DJoin Note: The contents of the .DJoin file are encrypted.
Verify the computer account is created in Active Directory	On the Start menu, point to Administrative Tools and then click Active Directory Administrative Center. Using the fly-out menu system, navigate to domain_name\Computers (where domain is the name of your domain). Tip: Click the right arrow next to the domain root to begin using the fly-out menu system. As you navigate, type the first few letters of each organizational unit to shorten the navigation. In the information pane, note that the computer account DEN-SVR-01 has been created.
To join the computer to the domain	The following command would be run on DEN-SRV-01 to join that computer to the domain DJOIN /Requestodj /LoadFile DEN-SVR-01.DJoin /WindowsPath \Mount\Windows Note: Do not run this command. It is provided for reference purposes only. This command is intended to be run against an offline copy of Windows such as a WIM file or VHD that has been mounted as a drive or folder in the file system.

Improvements in Active Directory Federated Services

Active Directory Federated Services in Windows Server 2008 R2 includes a new feature known as authentication assurance. This feature allows administrators to establish authentication policies for accounts that are authenticated in federated domains. This enables a variety of advanced authentication scenarios, such as smart cards, for example.

Download 2,81 Mb.