Tag Archives: manage

Uncomplicated AD object management on remote server domain

Windows Server 2003 comes with different tools, also known as MMC consoles for managing the Active Directory. The most common of these tools is the Active Directory Users and Computers (ADUC) snap-in which is used for daily management of users and computer objects. With this MMC console, administrators can create, manage and delete user and computer accounts configured with the directory structure. In order to access this console, you have to navigate through Start menu to All Programs/ Administrative Tools and ensure that you are logged into a domain controller since only a DC contains this option.

Under Administrative Tools menu there are other snap-in consoles as well, such as the Active Directory Schema. Schema as we all know contains the attribute definitions of Active Directory objects, but in order to accommodate new definitions in the pool of the already existing ones, schema modification is required. Active Directory Schema MMC console is used for this purpose, although such modifications take place at the forest functional level.

On the other hand, the Active Directory Users and Computers console is strictly a domain level snap-in and does not allow you to work on the Active Directory at the forest level. With this tool, you can only work on the Active Directory objects specific to a domain. Furthermore, the domain which gets listed on the console is the one corresponding to the domain controller on which you will be logged on to. In case you wish to manage a different domain, say a remote domain for a different geographical location, you can take help of the Connect to Domain command. This command lets you search the required domain or enter the domain IP address to access it.

However, this was the case for a remote domain. What if the domain controller itself is situated at a different location? Well, Active Directory users and computers let you to manage domains even if you are not logged in domain controller. ADUC can be easily accessed from a member server by manually loading it on an MMC. This can be carried out by entering the MMC command at the Run prompt of the server to load the console with the tool.

However, for this option, you must have a server at disposal. Otherwise it becomes necessary to establish a Remote Desktop Protocol (RDP) session with one of the servers. This protocol allows you to control server remotely, even a domain controller server. This way you can use the ADUC console even from a remote domain controller.

These hassles can however be avoided with the use of Lepide Active Directory Management and Reporting (LADMR) software. This AD management tool eliminates the need of MMC consoles like ADUC or ADS as it provides a single interface for all kinds of tasks like creating, managing and deleting user or computer accounts and viewing or modifying the AD schema. Whether you have to manage objects on a remote domain or local, this software will provide a single console tree where all the domains and their constituent objects can be viewed and managed easily without worrying about RDP sessions or DC server login.

Uncomplicated AD object management on remote server domain

Windows Server 2003 comes with different tools, also known as MMC consoles for managing the Active Directory. The most common of these tools is the Active Directory Users and Computers (ADUC) snap-in which is used for daily management of users and computer objects. With this MMC console, administrators can create, manage and delete user and computer accounts configured with the directory structure. In order to access this console, you have to navigate through Start menu to All Programs/ Administrative Tools and ensure that you are logged into a domain controller since only a DC contains this option.

Under Administrative Tools menu there are other snap-in consoles as well, such as the Active Directory Schema. Schema as we all know contains the attribute definitions of Active Directory objects, but in order to accommodate new definitions in the pool of the already existing ones, schema modification is required. Active Directory Schema MMC console is used for this purpose, although such modifications take place at the forest functional level.

On the other hand, the Active Directory Users and Computers console is strictly a domain level snap-in and does not allow you to work on the Active Directory at the forest level. With this tool, you can only work on the Active Directory objects specific to a domain. Furthermore, the domain which gets listed on the console is the one corresponding to the domain controller on which you will be logged on to. In case you wish to manage a different domain, say a remote domain for a different geographical location, you can take help of the Connect to Domain command. This command lets you search the required domain or enter the domain IP address to access it.

However, this was the case for a remote domain. What if the domain controller itself is situated at a different location? Well, Active Directory users and computers let you to manage domains even if you are not logged in domain controller. ADUC can be easily accessed from a member server by manually loading it on an MMC. This can be carried out by entering the MMC command at the Run prompt of the server to load the console with the tool.

However, for this option, you must have a server at disposal. Otherwise it becomes necessary to establish a Remote Desktop Protocol (RDP) session with one of the servers. This protocol allows you to control server remotely, even a domain controller server. This way you can use the ADUC console even from a remote domain controller.

These hassles can however be avoided with the use of Lepide Active Directory Management and Reporting (LADMR) software. This AD management tool eliminates the need of MMC consoles like ADUC or ADS as it provides a single interface for all kinds of tasks like creating, managing and deleting user or computer accounts and viewing or modifying the AD schema. Whether you have to manage objects on a remote domain or local, this software will provide a single console tree where all the domains and their constituent objects can be viewed and managed easily without worrying about RDP sessions or DC server login.

Perdemia's Permission Analyzer: How to get an overview of access rights

Perdemia has released Permission Analyzer 2.1, a Windows application that lets network administrators manage NTFS permissions. The software eliminates the mystery – and the dangers – of adding permissions that allow contractors and users to access the proper data stores.

Recent news stories about Hillary Clinton’s email server and the breach of the Pentagon’s servers might lead network managers to believe that most security threats are external. Security experts tell us, however, that most data breaches happen because of activity within an organization. Permission Analyzer 2.1 provides the tools that business people need to keep their servers safe and secure. By running Permission Analyzer 2.1 regularly, the management team can effectively control employee access to company data.

Unlike other programs that help manage permissions on a network, Permission Analyzer 2.1 scans an entire network and builds a database that can then be used by network administrators, chief information officers (CIOs), systems auditors, or any authorized employees who need to manage the network. Multiple users can use the database to perform queries and to show results in seconds, without scanning the network for every overview that is being built by a user. This design eliminates unnecessary network traffic, and dramatically reduces network load.

Permission Analyzer 2.1 can scan an entire network, or focus on specific computers and directories. You can even analyze nested group information by selecting LDAP organizational units to scan. Once the database has been updated with the current information, users can run reports or query the database by creating filters that include or exclude members, permissions, files, or folders.

A unique feature of Permission Analyzer 2.1’s design is its ability to work with all of the members from an Active Directory group or Organizational Unit. With competitors’ software, if a user wants to ensure that nobody in the Consultants group had access to the Personnel Department’s folder, it would be necessary to inspect every member in the Consultants group individually. With Permission Analyzer 2.1, the user could use a single query to ensure that no members of the Consultants group has access to the Personnel information. In just a few minutes, network administrators could ensure that only the proper people have access to personnel folders, the legal department’s confidential information, top management’s planning directories, and other sensitive data.

It is easy to save selections of filters, exports, and policies and run them automatically using Windows Scheduler. Many network administrators, for example, schedule a daily network scan as well as HTML/CSV exports and policies that will send an email notification when unwanted permissions are found.

The software lets you drill down into the database and trace the origin of any group of permissions. Unusual permissions could be inherited from a direct or indirect group membership or from a parent folder. Or such permissions may be indicators of a security breach.

Permission Analyzer 2.1’s internal database can support the largest networks that an enterprise might run. In addition, the Enterprise and Consultant Editions of the software work with Oracle, DB2, MS SQL, MySQL, and other popular databases.

Whether you’re a network administrator who needs to manage NTFS permissions, a security officer who needs to be sure that every employee and consultant has the proper access and permissions, or a line manager who wants to streamline and automate permissions information, Permission Analyzer 2.1 has the tools that you need.

Permission Analyzer 2.1 runs under Windows Vista or higher. Prices for the Basic Edition begin at $299(US), with affordable Standard, Enterprise, and Consultant Editions available. A trial version is available online, as well as time-limited versions of each of the Permission Analyzer 2.1 editions