If you have renamed a Windows Server 2008 or Windows Server 2008 R2 domain controller you should be aware of a problem. The problem is that a DFSR object is not renamed to the new name. This does not cause any problems until you remove the domain controller in question and after doing a demote or cleaning it up with metadata cleanup the object will become orphaned. So if you have renamed 2008 or 2008 R2 DCs you should follow the steps in KB2001271 to fix this.
Tag: Active Directory
Some time ago I had the unfortunate job to do some manual cleaning of an old and since long disconnected (and not decommissioned) Exchange Server in Active Directory using adsiedit.msc and this is not something one want to do I can promise you. Anyway during the testing phase I had to make sure that certain keys and values in adsiedit.msc were safe to be deleted and to accomplish this I removed all permissions on the keys to make sure that no one could read the information. You might think that restoring the permissions on objects in adsiedit.msc is the same as the management with file and folders but that is not the fact.
Instead use the command DSACLS to control the access control lists of Active Directory objects and run for example the following command to let the group Everyone get full permission on the object “First administrative group”.
DSACLS "CN=First Administrative Group,CN=Administrative groups,CN=CONTOSO, CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=CONTOSO,DC=LOCAL" /G Everyone:GA
Beware when working in adsiedit.msc and be very certain about what you are doing before deleting stuff. Sometimes just removing all permissions on objects is the best way because then you can always use the above command to restore permission to the object(s).
When preparing an existing Active Directory environment for migration to Windows Essential Business Server one must run a tool which scan the environment and make sure that no errors exist before the migration can even start. This tool is called Windows Essential Business Server Preparation and Planning Wizards and can be downloaded from Microsoft Download Center without cost.
The thing is that this tool is a great utility to use in existing environments, even though they are not being migrated and never will be migrated to Windows EBs. The tool is a great health check and will most likely show errors or potential problems you had no idea existed in your server environment. It find problems with DNS, in Active Directory and replication and will guide you to recommended system changes and much more. I strongly recommend everyone to run it on your own environments to see what it finds.
Just a quick note related to scanning for errors and best practices is that the upcoming Windows Server 2008 R2 will include a number of best practices analyzers for roles such as DNS, Active Directory and many more. This is really slick!