Active Directory:

Lead: DeWayne Hyatt

Description:

IFAS is a member of the UFAD single-domain forest at the University of Florida.

Getting Started:

• Administrative Rights Request Form (required to receive IF-ADMx accounts)
• Setting up an Admin workstation
• Pre-Staging a Computer
• The IFAS Computer Startup Script
• Login Scripts
• Co-Mangaged Delegation diagram:
  1. PDF file
  2. Visio file
     Visio diagram - If you do not have Visio, download a copy of the Visio Viewer application (3790KB)
• Co-Managed Delegation explanation
• Managing "Network Managed By"
• The LUA Approach: running under least-privilege user accounts
• Procedures for Deleting Expired Computers
• Procedures for Machine/User Mapping
• Adding an IFAS Shortcut to users' Network Places

Status:

• Determining a user's UF Dir to UFAD password sync status
• Domain Controller Replication Status (updated every 15 minutes)
• IFAS AD reporting and notification

Getting Assistance:

• DeWayne Hyatt is the IFAS point of contact for AD issues although one should email ITNSLAN@ad.ufl.edu for efficiency. At the UF level, Alex York, Andrew Carey and Joe Gasper are available to assist. Whomever you access for assistance, troubleshooting is greatly enhanced by attaching the output from the Alliance reporting tool (MPSRPT_Alliance_X86.EXE) which is available here.

Tools:

• Changing your Admin account passwords
• Explorer shortcuts that "runas" IF-ADMN (Windows XP only)
• Using Runas
• Offering remote assistance
• Admin Helper Script
• Client Lookup Tool
• Advertising printers to all users
• Renaming computers via netdom command-line
• Problems in deleting a computer object
• KillPol: This tool enables you to temporarily remove policy restriction for the current user.

Places:

• Logon scripts: \\ad.ufl.edu\ifas\logon-scripts
  (you will have to use your if-admn credentials to view this folder)
• Windows 2003 Server Administration Tools: \\ad.ufl.edu\ifas\private\ICC\AdminTools
• Exchange 2003 Server Tools: \\ad.ufl.edu\ifas\private\ICC\AdminTools\EXCH2K3

Historical interest:

• Active Directory Advisories: Active Directory Forum
• AD Policies and Procedures: version 1.4

Documentation for IFAS AD Admins:

• Creating a new OU within IFAS

Object Recovery:

As of about August of 2007, UFAD completed installation of CommVault object-level backup for Active Directory. It is now running as a production service within UFAD. They are currently running one full backup of Active Directory per week (on Friday night) and incremental backups every two hours between 8 AM and 8 PM, Monday through Friday. Retention is currently set at 30 days.

This means that the UFAD staff can now easily restore single objects within Active Directory, or even individual attributes of an object to an earlier point in time. While this doesn’t replace the need for cautious work, it does offer some degree of security in case of emergency. Please consider CommVault to be in place for disaster recovery purposes.

With a planned upgrade to the newest version of CommVault later in 2007, we will be able to grant individual access to unit admins for their department-side OU’s. This should allow units to view and restore backed-up objects in their own department OU’s without assistance from UFAD.