AD Management

AD Management Tool

Windows Active Directory, a hierarchical directory structure used for storing information and data about networks and domains of large enterprises can be viewed at three levels; namely, the domains, trees and the forests. Objects, resources and services are the main components that make up an Active Directory database. However, the magnitude of data contained in the directory makes its management quite difficult. Especially, for dynamic businesses, where major changes take place in the organizational structure to incorporate growth, mergers and divisions, AD management is a challenging task. Managing the user and computer accounts, assigning group policies and creating or removing new objects, migrating the entire Active Directory, managing user accounts on the Exchange server are some of the major responsibilities that an AD manager has to deal with.

Migrating user accounts, groups, Exchange mailboxes and OUs from one domain to another is not a matter of a few scripted codes. Nevertheless, migration is often executed during merging and restructuring domains. Transitions of such a kind require planning along with the removal of certain security restrictions on domain controllers.

The process of migrating and re-migrating user passwords, global and universal groups, user and computer accounts, workstations, local and remote servers along with other AD data from the source to the target domain is a daunting task. Moreover, carrying out all these changes without impacting the users is a bigger challenge. The native ADMT tool helps in this regard; however, it is recommended that no more than 100 accounts are migrated at a time.

Deletion of user and computer accounts is another issue faced by administrator which requires a lengthy procedure to tackle. Locating the corresponding domain controller, disconnecting it from the network, rebooting the server in the DSRM mode and running utilities like the ntdsutil.exe to perform authoritative restore on the deleted objects takes a lot of time and effort. Moreover, obtaining the DN (distinguished name) of all the deleted objects, and finally reconnecting the DC to the network, especially when an OU is missing also takes up time.

Management issues also arise when new objects are to be created as everyday new employees join organizations. Creating new objects, assigning them exchange accounts and configuring their access rights policies imply using different support tools, command-line utilities and services. Also, auditing active directories on several categories without creating a bottleneck in the network traffic or the security events of the domain controller takes up an important task in AD management. Furthermore, executing all these tasks, without impacting the end users or affecting the workflow is crucial. Therefore, in lieu of all the support tools and in-built utilities, administrators are preferring third party tools to simplify the tasks.