561 Appendix A. Tool List There are more Active Directory tools than you can shake a domain controller at! There are over 50 tools used in this book alone. In this appendix, I've listed each tool I used in the book along with the tasks that can be accomplished with it, what kind of tool it is, where it can be found, and the recipes in which it was used. ACL Diagnostics Command (acldiag.exe) Tasks that can be accomplished: View the ACL (permission and audit entries) for an object, check an object's ACL against the default in the schema, get effective permissions for a user or group, and check and fix delegations performed through the Delegation of Control wizard Type of tool: Command line Where to find it: Support Tools for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 14.9 , Recipe 14.12 Active Directory Domains and Trusts Snap-in (domain.msc) Tasks that can be accomplished: Raise domain mode (Windows 2000) or functional level (Windows Server 2003) of a domain or forest, manage trusts, and view and modify the description and managedBy attributes for a domain Type of tool: MMC snap-in 562 Where to find it: adminpak.msi for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 2.6, Recipe 2.7, Recipe 2.9, Recipe 2.13, Recipe 2.14, Recipe 2.15, Recipe 2.16, Recipe 2.17, Recipe 2.18, Recipe 2.19, Recipe 2.20, Recipe 2.21, Recipe 2.22, Recipe 3.25 Active Directory Installation Wizard (dcpromo.exe) Tasks that can be accomplished: Promote and demote a domain controller Type of tool: Wizard Where to find it: %SystemRoot%\System32 on Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 2.1 , Recipe 2.2, Recipe 2.3, Recipe 2.4, Recipe 3.1, Recipe 3.2, Recipe 3.3, Recipe 3.4 Active Directory Load Balancer Command (adlb.exe) Tasks that can be accomplished: Balance the load among connection objects within a site Type of tool: Command line Where to find it: 563 Windows Server 2003 Resource Kit Recipes in which it is used: Recipe 11.24 Active Directory Schema Snap-in (schmmgmt.msc) Tasks that can be accomplished: Browse, create, and modify classes and attributes Type of tool: MMC snap-in Where to find it: adminpak.msi for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 3.25, Recipe 5.10, Recipe 10.1, Recipe 10.2, Recipe 10.7, Recipe 10.8, Recipe 10.9, Recipe 10.10, Recipe 10.11, Recipe 10.12, Recipe 10.13, Recipe 10.14, Recipe 10.19, Recipe 10.20, Recipe 10.21, Recipe 14.11 Active Directory Sites and Services (dssite.msc) Tasks that can be accomplished: Browse and manipulate site topology objects (sites, subnets, links, servers, etc.), manage connection objects, schedule replication, force replication from a partner, trigger the KCC, enable the global catalog, specify an alternate LDAP query policy for a domain controller, and enable universal group caching Type of tool: MMC snap-in Where to find it: 564 adminpak.msi for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 3.11, Recipe 3.17, Recipe 3.20, Recipe 7.9, Recipe 11.1, Recipe 11.2, Recipe 11.3, Recipe 11.4, Recipe 11.5, Recipe 11.7, Recipe 11.9, Recipe 11.10, Recipe 11.11, Recipe 11.12, Recipe 11.14, Recipe 11.16, Recipe 11.22, Recipe 11.23, Recipe 11.25, Recipe 11.27, Recipe 12.4, Recipe 12.6 Active Directory Users and Computers Snap-in (dsa.msc) Tasks that can be accomplished: Browse, create, and manipulate users, groups, computers, OUs, and other domain specific objects. Create and save queries to find objects, raise the functional level of a domain, view and transfer the FSMOs for a domain, delegate control, and much more Type of tool: MMC snap-in Where to find it: adminpak.msi for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 3.8 , Recipe 3.25, Recipe 5.1, Recipe 5.2, Recipe 5.3, Recipe 5.4, Recipe 5.5, Recipe 5.6 , Recipe 5.7, Recipe 5.9, Recipe 6.1, Recipe 6.3, Recipe 6.4, Recipe 6.5, Recipe 6.6 , Recipe 6.7, Recipe 6.8, Recipe 6.12, Recipe 6.13, Recipe 6.14, Recipe 6.15, Recipe 6.16, Recipe 6.17, Recipe 6.20, Recipe 6.21, Recipe 6.22, Recipe 6.24, Recipe 6.25, Recipe 6.27, Recipe 6.28, Recipe 6.29, Recipe 7.1, Recipe 7.2, Recipe 7.3, Recipe 7.4, Recipe 7.6, Recipe 7.7, Recipe 7.8, Recipe 8.1, Recipe 8.2, Recipe 8.4, Recipe 8.7 AD Prep Utility (adprep.exe) Tasks that can be accomplished: Prepare a Windows 2000 domain and forest for update to Windows Server 2003 565 Type of tool: Command Where to find it: \i386 on Windows Server 2003 CD Recipes in which it is used: Recipe 2.10, Recipe 2.11 ADSI Edit (adsiedit.msc) Tasks that can be accomplished: Generic Active Directory editor that can be used to search, browse, create, and manipulate objects throughout a forest Type of tool: MMC snap-in Where to find it: Support Tools for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 4.10 , Recipe 4.11, Recipe 4.13, Recipe 4.16, Recipe 4.17, Recipe 4.18, Recipe 4.20, Recipe 4.21, Recipe 4.23, Recipe 6.30, Recipe 6.31, Recipe 8.9, Recipe 11.26, Recipe 11.29 , Recipe 13.17, Recipe 14.3, Recipe 14.15, Recipe 15.15, Recipe 15.16, Recipe 16.13, Recipe 16.18, Recipe 17.1, Recipe 17.4, Recipe 17.7, Recipe 17.8, Recipe 17.9 Audit Policy Command (auditpol.exe) Tasks that can be accomplished: Enable or disable auditing on a computer 566 Type of tool: Command line Where to find it: Resource Kit for Windows 2000 Recipes in which it is used: Recipe 15.12 Backup Wizard (ntbackup.exe) Tasks that can be accomplished: Back up and restore a domain controller, including Active Directory Type of tool: Wizard Where to find it: %SystemRoot%\System32 on Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 3.2 , Recipe 16.1, Recipe 16.4, Recipe 16.5, Recipe 16.6 CSVDE Command (csvde.exe) Tasks that can be accomplished: Import and export objects using a comma-separated value (CSV) formatted file Type of tool: Command line Where to find it: 567 %SystemRoot%\System32 on Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 4.26, Recipe 4.27 Default Domain Controller Security Policy Snap-in (dcpol.msc) Tasks that can be accomplished: Modify the settings of the Domain Controller Security GPO Type of tool: MMC snap-in Where to find it: %SystemRoot%\System32 on Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 14.1, Recipe 14.14, Recipe 15.12 Default Domain Security Policy Snap-in (dompol.msc) Tasks that can be accomplished: Modify the settings of the Domain Security GPO Type of tool: MMC snap-in Where to find it: %SystemRoot%\System32 on Windows 2000 and Windows Server 2003 Recipes in which it is used: 568 Recipe 6.11, Recipe 14.19 Default Group Policy Restore Command (dcgpofix.exe) Tasks that can be accomplished: Restore the Domain Controllers Security Policy and Domain Security Policy to the default Type of tool: Command line Where to find it: %SystemRoot%\System32 on Windows Server 2003 Recipes in which it is used: Recipe 9.22 DNS Snap-in (dnsmgmt.msc) Tasks that can be accomplished: Browse and manipulate DNS server configuration; and browse, create, and modify zones and resource records. Enable debug logging, perform DNS test queries, restart the DNS service, modify permissions, and modify application partition configuration Type of tool: MMC snap-in Where to find it: adminpak.msi for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 13.1, Recipe 13.2, Recipe 13.3, Recipe 13.4, Recipe 13.5, Recipe 13.6, Recipe 13.7, Recipe 13.9, Recipe 13.10, Recipe 13.11, Recipe 15.6 569 DNSCmd Command (dnscmd.exe) Tasks that can be accomplished: Manipulate DNS server configuration; query, create, and modify zones; and resource records. View server statistics, enable debug logging, and modify application partition configuration Type of tool: Command line Where to find it: Support Tools for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 13.1, Recipe 13.2, Recipe 13.3, Recipe 13.4, Recipe 13.5, Recipe 13.7, Recipe 13.9, Recipe 13.10, Recipe 13.11, Recipe 15.6, Recipe 15.7 Domain Controller Diagnosis Command (dcdiag.exe) Tasks that can be accomplished: Run a variety of diagnostics tests against a domain controller Type of tool: Command line Where to find it: Support Tools for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 3.5 , Recipe 3.12, Recipe 11.28, Recipe 12.8, Recipe 13.12, Recipe 17.6 570 DS ACL Command (dsacls.exe) Tasks that can be accomplished: View and set ACLs on objects Type of tool: Command line Where to find it: Support Tools for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 7.7, Recipe 8.2, Recipe 13.6, Recipe 14.7, Recipe 14.10, Recipe 14.13, Recipe 17.9 DS Add Command (dsadd.exe) Tasks that can be accomplished: Add computer, contact, group, OU, user, and quota objects Type of tool: Command line Where to find it: %SystemRoot%\System32 on Windows Server 2003 Recipes in which it is used: Recipe 5.1, Recipe 6.1, Recipe 6.2, Recipe 7.1, Recipe 8.1, Recipe 8.2, Recipe 15.13 DS Get Command (dsget.exe) . can be accomplished: Prepare a Windows 2000 domain and forest for update to Windows Server 2003 565 Type of tool: Command Where to find it: i386 on Windows Server 2003 CD Recipes in which. Command line Where to find it: Support Tools for Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 14.9 , Recipe 14.12 Active Directory Domains and Trusts Snap-in (domain.msc). %SystemRoot%System32 on Windows 2000 and Windows Server 2003 Recipes in which it is used: Recipe 2.1 , Recipe 2.2, Recipe 2.3, Recipe 2.4, Recipe 3.1, Recipe 3.2, Recipe 3.3, Recipe 3.4 Active Directory