Active Directory

Guide to ADFS Federation (Metadata Import Edition) | Lazy Admin Blog

Posted on Updated on

How to set up a Relying Party Trust in 5 minutes using XML metadata.

Setting up a manual federation trust is a recipe for typos. If a 3rd party sends you a URL or an XML file, use it. Importing metadata ensures that certificates, identifiers, and endpoints are configured perfectly without you having to manually paste long strings of thumbprints.

1. The Pre-Reqs (Don’t start without these!)

Before you open the ADFS console, make sure you have:

  • The Metadata: Either a file or a URL (e.g., https://adfs.xyz.com/federationmetadata/2007-06/federationmetadata.xml).
  • The Claim Mapping: Exactly which LDAP attribute they need (e.g., Employee-ID) and what it should be called on their end (e.g., Name ID).
  • Contact Info: Name, email, and phone for their admin. Put this in the Notes field so the next admin isn’t hunting for it during a certificate expiry.

2. Step-by-Step: Adding the Trust

  1. Open ADFS Management and go to Trust Relationships > Relying Party Trusts.
  2. Right-click and select Add Relying Party Trust.
  3. Select Data Source: Choose “Import data about the relying party from a file” and point it to their federationmetadata.xml.
  4. MFA: Select “I do not want to configure multi-factor authentication” (unless required by your security policy).
  5. Authorization: Select “Permit all users to access this relying party.”
  6. Finish: On the final screen, open the Notes tab and paste the 3rd party contact details.

3. Configuring the Claim Rules

This is the “handshake” where you translate your AD data into something they can read.

  1. Right-click your new trust and select Edit Claim Rules.
  2. Click Add Rule and choose “Send LDAP Attributes as Claims.”
  3. Claim Rule Name: “Send EmployeeID as NameID” (Be descriptive!).
  4. Attribute Store: Active Directory.
  5. Mapping:
    • LDAP Attribute: Employee-ID
    • Outgoing Claim Type: Name ID

4. The “Lazy” Testing Method

Don’t wait for them to tell you it’s broken. Test it yourself:

  1. Go to your ADFS sign-on page: https://your-adfs-url.com/adfs/ls/idpinitiatedsignon.htm.
  2. Select the new trust from the list and sign in.
  3. The Proof: Take a screenshot of the successful login page and send it to the 3rd party. If you can see the trust, you’ve done your part.

This entry was posted in Active Directory and tagged , , , , , , , , , .

Stop Brute Force Cold: How to Rename the Local Administrator via GPO | Lazy Admin Blog

Posted on Updated on

The “Administrator” account is a universal target. Because every Windows machine has one by default, hackers already have 50% of the login equation—the username. By renaming this built-in account across your entire Active Directory domain, you significantly lower the risk of automated brute-force attacks.

Best of all? You don’t have to touch a single workstation. We can do this globally using Group Policy Preferences (GPP).

Step 1: Create or Edit your GPO

  1. Open the Group Policy Management console (gpmc.msc).
  2. Create a new GPO (e.g., “Security – Rename Local Admin”) or edit an existing one linked to your target Workstations or Servers OU.
  3. Right-click the GPO and select Edit.

Step 2: Configure the Local User Preference

Navigate to the following path within the editor: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups

  1. Right-click Local Users and Groups and select New > Local User.
  2. Configure the following settings in the dialog box:
    • Action: Select Update.
    • User name: Select Administrator (built-in) from the dropdown. (Using the built-in identifier ensures the rename works even if the account was previously renamed).
    • Rename to: Enter your new, non-obvious username (e.g., SrvManager_Admin).
    • Full name: Enter a descriptive name.
    • Password: You can optionally reset the password here, though using LAPS (Local Administrator Password Solution) is recommended for password management.

Step 3: Deployment & Verification

By default, Group Policy refreshes every 90 minutes. If you want to see the change immediately on a specific client, run the following command in an elevated prompt:

DOS

gpupdate /force

Is it working?

If the name hasn’t changed, use the GPResult tool to see if the policy is being applied to the computer object:

DOS

gpresult /r

Troubleshooting Tips:

  • OU Check: Ensure the Computer object is actually inside the OU where the GPO is linked.
  • Security Filtering: Verify that Authenticated Users or Domain Computers have “Read” and “Apply Group Policy” permissions in the GPO’s Delegation tab.
  • Replication: If some sites see the change and others don’t, check your Domain Controller replication status.

Why this is a “Lazy Admin” Win

Instead of using scripts or manual intervention, GPO Preferences handle the logic for you. If you ever need to change the name again, you update one field in the GPO, and the entire domain follows suit.

This entry was posted in Active Directory, Windows and tagged , , , , , , , , , .

Master the Forest: Top Active Directory Interview Questions & Answers | Lazy Admin Blog

Posted on Updated on

Part 1: The Logical vs. Physical Structure

Understanding how AD is organized is the first step in mastering the service. Interviewers often look for the distinction between how objects are managed (logical) and how traffic flows (physical).

Logical Components

These define the administrative boundaries and hierarchy:

  • Forest: The uppermost boundary. It contains one or more trees that share a common schema and global catalog.
  • Tree: A collection of domains that share a contiguous namespace (e.g., corp.com and dev.corp.com).
  • Domain: The primary unit of replication and security. All objects in a domain share a common database (ntds.dit).
  • Organizational Unit (OU): Containers used to organize objects within a domain. OUs are primarily used to delegate administration and apply Group Policy.

Physical Components

These define how AD exists on hardware and over the network:

  • Domain Controllers (DC): The servers that host the AD database and handle authentication.
  • Sites: A grouping of IP subnets connected by high-speed links. Sites are used to control replication traffic and ensure users log on to a local DC rather than one across a slow WAN link.

Part 2: The Core “Under the Hood” Mechanics

The Active Directory Database

The database is stored in %systemroot%\ntds as ntds.dit. Key files include:

  • edb.log: Transaction logs (changes are written here first).
  • res1.log / res2.log: Reserve logs to ensure the system can write to disk if space runs out.
  • edb.chk: The checkpoint file that tracks which transactions have been committed to the database.

The Global Catalog (GC)

The GC is a partial, read-only replica of every object in the forest. It allows users to search for resources (like a printer in another domain) without needing to query every single DC in the forest.

SYSVOL Folder

The SYSVOL folder is a shared directory on every DC that stores the domain’s public files, including:

  • Login scripts (Netlogon share).
  • Group Policy Templates.
  • It is kept in sync across all DCs using the File Replication Service (FRS) or DFSR.

Part 3: Protocols and Naming

LDAP (Lightweight Directory Access Protocol)

LDAP is the language used to talk to Active Directory. It follows the X.500 standard and uses TCP/IP.

  • Distinguished Name (DN): The full path to an object (e.g., CN=JohnDoe,OU=Sales,DC=corp,DC=com).
  • Relative Distinguished Name (RDN): Just the object’s name (e.g., JohnDoe).
  • UPN (User Principal Name): The “email-style” login name (e.g., johndoe@corp.com).

Part 4: Essential Admin Tools

ToolPurpose
ADSIEditA low-level “registry editor” for Active Directory objects and attributes.
LDPA tool for performing LDAP searches and operations manually.
RepadminThe go-to command-line tool for diagnosing replication health.
NetdomUsed for managing trust relationships and joining computers to domains via CLI.
Dcpromo(Legacy) The command to promote or demote a Domain Controller.

Common Interview Scenario: “My Replication is Broken”

Answer: I would start by checking connectivity between sites. Then, I would use repadmin /showrepl to see which naming contexts (Domain, Configuration, or Schema) are failing. I’d also check the DNS SRV records to ensure the DCs can find each other.

#ActiveDirectory #SysAdmin #WindowsServer #ITJobs #TechInterview #Microsoft #Networking #ITOps #LazyAdmin

This entry was posted in Active Directory, Interview Questions, Windows and tagged , , , , , , , , , .

How to Identify FSMO Roles and Global Catalogs with ReplMon

Posted on Updated on

In a healthy Active Directory environment, knowing exactly which Domain Controllers (DCs) hold your Operations Master roles is vital for disaster recovery and maintenance. Active Directory defines five specific roles, often referred to as FSMO (Flexible Single Master Operations) roles:

  1. Schema Master (Forest-wide)
  2. Domain Naming Master (Forest-wide)
  3. RID Master (Domain-wide)
  4. PDC Emulator (Domain-wide)
  5. Infrastructure Master (Domain-wide)

Step 1: Installing the Tools

Replication Monitor isn’t installed by default. You must install the Windows Support Tools from your installation media:

  • Navigate to the \Support\Tools folder on your product CD.
  • Run Setup.exe.
  • Once installed, launch it via Start > Programs > Support Tools > Tools > Active Directory Replication Monitor.

Step 2: Determine Operations Master Role Holders

ReplMon makes it incredibly simple to see the “Owner” of each role without digging through multiple consoles.

  1. Add your server: Right-click Monitored Servers and follow the wizard to add at least one DC from your domain.
  2. View FSMO Roles: Right-click the server in the list and select Properties.
  3. Check Ownership: Click the FSMO Roles tab. You will see a list of the five roles and the specific DC currently holding them.
  4. Verify Connectivity: Click the Query button next to any role. This performs a real-time check to ensure the role holder is online and responding.

Step 3: Locating Global Catalog (GC) Servers

Global Catalogs are essential for multi-domain forests and universal group memberships. If your GCs go offline, users may experience login failures.

  1. Inside Replication Monitor, ensure you have added your servers.
  2. Right-click the server name.
  3. Select Show Global Catalog Servers in Enterprise.
  4. A list will populate showing every DC in your forest that has been promoted to a Global Catalog.

Why use ReplMon instead of the GUI?

While you can find this info in AD Users & Computers or AD Domains & Trusts, ReplMon gives you a centralized view. You don’t have to switch between three different MMC snap-ins to see both forest-wide and domain-wide roles.

The LazyAdmin Tip: If you notice that one server is holding all five roles, it might be a performance bottleneck! Consider spreading these roles across different DCs in larger environments to improve redundancy.

#ActiveDirectory #FSMO #ReplMon #SysAdmin #WindowsServer #ITPro #Infrastructure #LazyAdmin #ServerMaintenance #DataCenter #TechTutorials

This entry was posted in Active Directory, Windows and tagged , , , , , , , , .

LDIFDE vs. CSVDE: How to Export Active Directory Data

Posted on Updated on

Exporting Active Directory objects doesn’t require complex scripts. Windows includes built-in tools to handle this via the command line. Choosing between them depends on what you plan to do with the data.

1. LDIFDE (LDAP Data Interchange Format)

Best for: Migrations and bulk modifications.

LDIFDE exports data in the .ldf format. This format is superior for importing data back into AD because it can handle operations like add, modify, and delete.

Command Syntax:

DOS

ldifde -f Exportuser.ldf -s ADservername -d "CN=username,CN=Users,DC=domain,DC=com"
  • -f: The filename for the export.
  • -s: The source Active Directory server.
  • -d: The Distinguished Name (DN) of the root search point.

2. CSVDE (Comma Separated Value)

Best for: Reporting and Excel analysis.

CSVDE exports data into a standard CSV format. This is perfect if you need to create a spreadsheet of user attributes for a manager or an audit. Note that CSVDE cannot be used to modify existing objects; it only supports “Add” operations during an import.

Advanced Export Command:

This command filters for specific objects with mailboxes and pulls a massive list of attributes (Name, Company, Title, Phone, etc.):

DOS

csvde -m -f Mailboxes.csv -d "OU=Users,DC=domain,DC=com" -r "(&(objectClass=user)(mail=*))" -l "objectClass,displayName,memberOf,proxyAddresses,title,telephoneNumber,company,userPrincipalName,sAMAccountName"
  • -m: Omits binary attributes (like objectGUID) that aren’t readable in text.
  • -r: The LDAP filter (e.g., only users with an email address).
  • -l: The list of specific attributes you want to include in the columns.

Comparison Table: Which should you use?

FeatureLDIFDECSVDE
Output FormatPlain Text (.ldf)Comma Separated (.csv)
Best UseModifying/Moving ObjectsReporting / Spreadsheet Analysis
ReadabilityHarder for humansVery easy (Excel)
Import SupportAdd, Modify, DeleteAdd only

The LazyAdmin Tip: Always use the -m switch with CSVDE. If you don’t, your CSV file will be filled with unreadable binary strings for attributes like user certificates or SID history, making it almost impossible to use in Excel!

#ActiveDirectory #SysAdmin #ITPro #DataExport #WindowsServer #CSVDE #LDIFDE #LazyAdmin #TechTips #ServerManagement

This entry was posted in Active Directory, Windows and tagged , , , , , , , , .

Installing ADSI Edit on Windows Server 2003

Posted on Updated on

Whether you are performing a schema extension or manually cleaning up metadata after a failed Domain Controller demotion, ADSI Edit is the tool you need. Because it interacts directly with the Active Directory database, it is powerful—and dangerous.

Warning: ADSI Edit does not have “undo” functionality. Always ensure you have a valid System State backup before making manual attribute changes.

Step 1: Locating the Installation Files

On Windows Server 2003, ADSI Edit is not installed by default. It is part of the Windows Support Tools package.

  • From the CD: Insert your Windows Server 2003 installation media and navigate to: [CD-DRIVE]:\SUPPORT\TOOLS\
  • Run the Installer: Double-click SUPTOOLS.MSI and follow the installation wizard.
  • No CD? You can download the “Windows Server 2003 Service Pack 2 Support Tools” directly from the Microsoft Download Center.

Step 2: Launching the Console

Once the Support Tools are installed, you can launch the editor:

  1. Go to Start > Run.
  2. Type adsiedit.msc and press Enter.

Step 3: Troubleshooting “adsiedit.msc not found”

If you have installed the tools but still receive an error that the file cannot be found, the system likely hasn’t registered the required library (.dll) file properly.

To manually register the DLL:

  1. Go to Start > Run.
  2. Type the following command: regsvr32 adsiedit.dll
  3. You should see a success message stating that the DllRegisterServer succeeded.

What can you do with ADSI Edit?

ADSI Edit allows you to view and edit the three primary partitions of the Active Directory database:

  • Domain Partition: Contains the users, groups, and OUs.
  • Configuration Partition: Contains forest-wide configuration data (like site topology).
  • Schema Partition: Contains the definitions for every object type and attribute in the forest.

#ActiveDirectory #ADSIEdit #WindowsServer #SysAdmin #ITPro #Microsoft #TechSupport #LazyAdmin #ServerManagement #VintageTech #ADTroubleshooting

This entry was posted in Active Directory, Windows and tagged , , , , , , , , .

How to Boot a Windows Server 2003 DC into Directory Services Restore Mode (DSRM)

Posted on Updated on

There are times when Active Directory becomes unstable, or you need to perform a “System State” restore. To do this, you must take the Domain Controller offline by booting into Directory Services Restore Mode (DSRM).

In this mode, the server stops functioning as a DC and instead functions as a standalone member server, allowing you to manipulate the AD database files (ntds.dit) while they aren’t in use.

⚠️ The Golden Rule of DSRM: The Password

When you boot into DSRM, Active Directory is not running. This means you cannot log in with your Domain Admin credentials.

You must use the Local Administrator account, and the password is the unique DSRM Password that was set years ago when the server was first promoted to a Domain Controller (via dcpromo).

Tip: If you’ve forgotten this password but the server is still currently running as a DC, you can reset it before rebooting using the setdsrmpassword command in ntdsutil.

Step-by-Step: Booting into DSRM Locally

If you have physical access (or console access via iDRAC/iLO/vCenter) to the machine, follow these steps:

  1. Initiate a Restart: Restart the Domain Controller as you normally would.
  2. The F8 Menu: As soon as the BIOS screen disappears and the Operating System selection menu appears, start tapping the F8 key.
  3. Advanced Options: You will be presented with the Windows Advanced Options Menu. Use the arrow keys to select Directory Services Restore Mode (Windows domain controllers only) and press Enter.
  4. Login: Once the Windows login screen appears, log on as the Local Administrator using that specific DSRM password.

What happens in this mode?

  • The NTDS service is stopped.
  • The server does not respond to authentication requests from users.
  • The local SAM (Security Accounts Manager) database handles authentication.
  • You can now run ntdsutil or backup software to perform database maintenance or restores.

#ActiveDirectory #DSRM #SysAdmin #WindowsServer #ITPro #TechSupport #ServerAdmin #LazyAdmin #Troubleshooting #LegacyIT

This entry was posted in Active Directory, Windows and tagged , , , , , , , .

How to Change the Static IP Address of a Windows Domain Controller

Posted on Updated on

Whether you are re-IPing a subnet or moving a server to a new VLAN, changing a Domain Controller’s IP address requires more than just updating the NIC settings. If DNS records don’t update correctly, users won’t be able to log in, and replication will fail.

Prerequisites

  • Credentials: You must be a member of the Domain Admins group.
  • Access: Log on locally to the system console. If you lose network connectivity during the change, you may need to boot into DSRM to recover.

Step-by-Step: Changing the IP Address

  1. Open Network Connections: Right-click My Network Places (or Network in newer versions) and click Properties.
  2. Edit Adapter: Right-click your Local Area Connection and select Properties.
  3. TCP/IP Settings: Double-click Internet Protocol (TCP/IP).
  4. Update Addresses:
    • Enter the new IP address, Subnet mask, and Default gateway.
    • Update the Preferred and Alternate DNS servers.
    • Note: Usually, a DC points to itself (127.0.0.1) or a partner DC for DNS.
  5. WINS (Optional): If your environment still uses WINS, click Advanced > WINS tab and update any static WINS server entries.
  6. Apply: Click OK until all dialog boxes are closed.

Critical Step: Post-Change Registration

Once the IP is changed, Windows needs to tell the rest of the domain where the DC is now located. Do not skip these commands.

Open a Command Prompt and run:

  1. Register DNS Records:DOSipconfig /registerdns This forces the DC to update its ‘A’ (Host) record in DNS.
  2. Fix Service Records:DOSdcdiag /fix This ensures that vital SRV records (which clients use to find the DC) are updated to point to the new IP.

Potential Pitfalls: Mapped Drives and Hardcoded IPs

Changing the IP settings won’t affect shared permissions, but it will break any connection made via IP address rather than hostname.

  • Avoid This: net use g: \\192.168.0.199\data (This breaks after the change).
  • Do This: net use g: \\DC1\data (This continues to work regardless of the IP).

The LazyAdmin Lesson: Always use DNS names (Hostnames) for your resources. It saves you from manual updates every time a server moves!

ActiveDirectory #SysAdmin #WindowsServer #Networking #IPAddress #ITPro #DNS #Troubleshooting #LazyAdmin #ServerAdmin

This entry was posted in Active Directory, Windows and tagged , , , , , , , , .