Active Directory Application Mode (ADAM)

Active Directory®Application Mode

  • ADAM How To...

  • ADAM Concepts

  • Administering ADAM

  • ADAM troubleshooting and frequently asked questions (FAQs)

  • ADAM Administration Tools

  • Glossary


ADAM How To...

How to ...

  • Install or Remove ADAM

  • Create or Remove an ADAM Instance

  • Manage an ADAM Instance

  • Manage Replication, Sites, and Configuration Sets

  • Manage Schemas and Directory Partitions

  • Manage Users and Groups

  • Manage Access Control

  • Monitor and Maintain ADAM

  • Synchronize Data from Active Directory to an ADAM Instance


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Install or Remove ADAM

Install or remove ADAM

  • Install ADAM

  • Remove ADAM


Install ADAM

To install ADAM

  1. Open Add or Remove Programs from Control Panel.

  2. Click Add/Remove Windows Components.

  3. Click Active Directory Services under Components, and then click Details.

  4. Select the Active Directory Application Mode (ADAM) check box under Subcomponents of Active Directory Services, and then click OK.

  5. Click Next on the Windows Components page.

  6. Review the message that appears. Based on the contents of message, do one of the following:

    • Click Finish if the message, "You have successfully completed the ADAM Setup Wizard" appears.

    • If an error message appears, make a note of the error, click Finish, and then review the Active Directory Application Mode (ADAM) event messages in Event Viewer.

Notes

  • To open Add or Remove Programs, click Start, click Control Panel, and then click Add or Remove Programs.

  • If an error occurs in the Active Directory Application Mode Setup Wizard before the Completing the Active Directory Application Mode Setup Wizard page, first review the error message that describes the cause of the problem. Then, click Start, click Run, and type the following:

    %windir%\Debug\adamsetup.log

See Also

  • Adaminstall
  • Install an ADAM replica from media


Remove ADAM

To remove ADAM

  1. Open Add or Remove Programs from Control Panel.

  2. Click Add/Remove Windows Components.

  3. Click Active Directory Services under Components, and then click Details.

  4. Clear the Active Directory Application Mode (ADAM) check box under Sub Components of Active Directory Services, and then click Next.

Notes

  • To open Add or Remove Programs, click Start, click Control Panel, and then click Add or Remove Programs.

  • You can sort programs in Add or Remove Programs by selecting different options in Sort by.

  • You might be prompted to restart the computer after removing Active Directory Application Mode (ADAM). If you choose not to restart the computer, future installations of ADAM might fail.

  • It is not possible to remove ADAM if there is an ADAM instance running on the computer.


Create or Remove an ADAM Instance

Create or Remove an ADAM Instance

  • Use the ADAM Setup Wizard

  • Perform an unattended install of an ADAM instance

  • Install an ADAM replica from media

  • Remove an ADAM instance

  • Perform an unattended removal of an ADAM instance


Use the ADAM Setup Wizard

Use the ADAM Setup Wizard

  • Starting the ADAM Setup Wizard

  • Selecting a setup option

  • Specifying an instance name

  • Specifying communication ports

  • Selecting an application directory partition option

  • Specifying file locations

  • Selecting a service account

  • Selecting an administrator account

  • Importing LDIF files during setup

  • Reviewing ADAM Setup Wizard selections

  • Finishing the installation


Starting the ADAM Setup Wizard

To start the ADAM Setup Wizard

  1. Click Start, point to All Programs, point to ADAM, and then click Create an ADAM instance.

  2. On the Welcome to the Active Directory Application Mode Setup Wizard page, click Next.

Note

  • You can use the ADAM Setup Wizard to install a new, unique ADAM instance or to install a replica ADAM instance.

See Also

  • Adaminstall
  • Install an ADAM replica from media


Selecting a setup option

On the Setup Options page, you must choose whether to install a unique Active Directory Application Mode (ADAM) instance or join an existing configuration set.

To select a setup option

  • On the Setup Options page, do one of the following, and then click Next:

    • Click A unique instance.

    • Click A replica of an existing instance.

Notes

  • The following table summarizes the two choices presented on this page.

    Setup option Result

    A unique instance

    If you choose to install a unique ADAM instance, the ADAM instance that you install will not be a part of any existing configuration set, and it will not have any replication partners. The ADAM Setup Wizard will create new, default copies of the configuration and schema directory partitions for the new ADAM instance that you are creating. Any schema extensions that you have added to any other ADAM instance will not be available in this new ADAM instance.

    A replica of an existing instance

    If you choose to install a replica of an existing ADAM instance, the ADAM instance that you are installing will contain replicated copies of the configuration and schema directory partitions (including any schema extensions) from the instance from which you choose to replicate. In addition, you have an opportunity in the ADAM Setup Wizard to selectively replicate any application directory partitions that exist in the source configuration set. You must specify a running ADAM instance as the source from which to replicate. To speed up the replication process for the new instance, you can use a restored copy of a previously backed up ADAM instance as the data source.
  • An ADAM instance consists of a single copy of the ADAM directory service, along with its associated directory store, assigned Lightweight Directory Access Protocol (LDAP) and Secure Sockets Layer (SSL) ports, and application event log. You can run multiple ADAM instances simultaneously on a single computer. For more ADAM terminology, see Related Topics.

  • You can only join an ADAM instance to a configuration set during ADAM installation.

See Also

  • Glossary
  • Understanding ADAM replication and configuration sets
  • Install an ADAM replica from media


Specifying an instance name

On the Instance Name page, you must provide an easily recognizable name for the Active Directory Application Mode (ADAM) instance that you are installing. This name is used on the local computer to uniquely identify this ADAM instance.

The name that you specify appears in the following places:

  • Event Viewer

  • Services snap-in

  • Add or Remove Programs

To specify an instance name

  • On the Instance Name page, type a name for the ADAM instance that you are installing, and then click Next.

Notes

  • The Active Directory Application Mode Setup Wizard presents a default instance name of instanceX, where X equals 1 for the first ADAM instance that is installed on the computer, 2 for the second ADAM instance that is installed on the computer, and so on.

  • The name that you specify must meet the following requirements:

    • It must be unique with respect to other ADAM instances running on the same computer.

    • It must be no longer than 44 characters.

    • It must use characters only from the ranges of a through z, A through Z, or 0 through 9.

    • The name "ntds" cannot be used.

  • The instance name that you specify is used to construct the service name, the service display name, and the service description, as follows:

    Name supplied during setup Service name Service display name Service description

    instance1

    ADAM_instance1

    instance1

    Blank (No default description is provided.)
  • You can modify the service display name, as well as the service description, after installation. For more information, see Related Topics.

See Also

  • View or modify the service display name of an ADAM instance
  • View or modify the service description of an ADAM instance
  • Start, stop, pause, resume, or restart an ADAM instance


Specifying communication ports

On the Ports page, you can specify the communications ports that the Active Directory Application Mode (ADAM) instance will use to communicate with directory-enabled applications. Directory-enabled applications locate an ADAM instance by using a combination of the name of the computer on which the ADAM instance is running and a communication port number. An ADAM instance can communicate using Lightweight Directory Access Protocol (LDAP) or Secure Sockets Layer (SSL). You must provide a port number for each.

If you are not sure what communication port numbers to use, accept the default values.

To specify communication ports

  1. On the Ports page, type a port number in LDAP port number.

  2. Type a port number in SSL port number, and then click Next.

Notes

  • By default, ADAM uses the default communication port numbers of 389 and 636 for LDAP and SSL, respectively. If either of these ports is already in use on the destination computer, ADAM specifies the first available port, starting at 50000.

  • If you plan to run ADAM and Active Directory concurrently on the same computer, you must assign ports other than 389 and 636 to ADAM. Active Directory requires the use of ports 389 and 636 (as well as ports 3268 and 3269, if the domain controller running Active Directory is configured as a global catalog).

  • For more information about how directory-enabled applications can locate a given ADAM instance, see Related Topics.

  • For information about changing the communication ports of an ADAM instance, see Related Topics.

See Also

  • Modify the communication ports used by an ADAM instance
  • Running ADAM on Windows XP Professional
  • Administering computers running ADAM
  • Administering an ADAM instance


Selecting an application directory partition option

On the Application Directory Partition page, you can create a new application directory partition during setup for Active Directory Application Mode (ADAM). An application directory partition holds data that is specific to one or more directory-enabled applications. The ADAM Setup Wizard does not require that you create an application directory partition. You can also create application directory partitions at any time after ADAM installation.

To select an application directory partition option

  • On the Application Directory Partition page, do one of the following, and then click Next:

    • Click No, do not create an application directory partition.

    • Click Yes, create an application directory partition, and then specify a distinguished name for the new partition. ADAM supports both X.500-style and Domain Name System (DNS)-style distinguished names. You can use any of the distinguished name attribute types in the following table when specifying an application partition in ADAM. You must include at least one attribute in the distinguished name that you specify.

      Distinguished name attribute Type

      C

      Country/region

      CN

      Container

      DC

      Domain component

      L

      Locality

      O

      Organization

      OU

      Organizational unit
      For example:

      CN=Partition1,DC=Woodgrove,DC=COM

Important

  • If you want to add organizational unit (OU) containers in your application directory partition, limit the distinguished name that you specify to the following object classes: OU, C, O, and DC. By default, OUs can only be added under these object classes. For example, you can add an OU to o=Microsoft,c=US. You cannot add an OU to cn=test,o=Microsoft,c=US.

Note

  • You can also create application directory partitions after ADAM installation. For more information, see Related Topics.

See Also

  • Delete an application directory partition
  • Add an application directory partition
  • Understanding ADAM data and data stores
  • Administering directory partitions


Specifying file locations

On the File Locations page, you can view and change the default installation directories for Active Directory Application Mode (ADAM) data (.dit) files and recovery (.log) files.

By default, ADAM data files and recovery files are installed on the destination computer in the following directory:

\%ProgramFiles%\Microsoft ADAM\instancename\data

where instancename equals the ADAM instance name that you specified on the Instance Name page.

By default, ADAM program files and administration tools are installed in the following directory:

\%windir%\ADAM

To specify install file locations for ADAM data or recovery files

  • On the File Locations page, do one of the following:

    • Click Next to accept the default file locations.

    • Type new file locations in Data files or Data recovery files, and then click Next.

Notes

  • If the directory paths that you specify do not already exist, the ADAM Setup Wizard creates them for you.

  • The ADAM Setup Wizard does not accept environmental variables in file location paths.


Selecting a service account

On the Service Account Selection page in the ADAM Setup Wizard, you must select a service account for use by the Active Directory Application Mode (ADAM) instance. The account that you select determines the security context in which the ADAM instance runs. Changing the service account after installation may require some additional configuration.

In most cases, the ADAM Setup Wizard defaults to the Network Service account as the service account. The Network Service account is a special, built-in account, with authority similar to that of an authenticated user account. The name of the account is NT AUTHORITY\NetworkService. The Network Service account has limited access to the local computer and authenticated access (as the computer account) to network resources. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Network Service account access network resources using the credentials of the computer account.

For more information about selecting a service account and ADAM service account requirements, see Selecting an ADAM service account.

To select a service account

  • On the Service Account Selection page, do one of the following, and then click Next:

    • Click Network service account.

    • Click This account, click Browse, and then select a local or domain account.

Notes

  • On Windows XP Professional, workstation and domain user accounts that are used as the ADAM service account must be members of the local Administrators group.

  • When you install ADAM on Windows XP Professional computers that are joined to a workgroup, you must edit the forceguest registry key to allow users to bind to ADAM successfully. For more information, see Enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup.

  • For additional considerations when running ADAM on Windows XP Professional, see Running ADAM on Windows XP Professional.

  • To enable auditing for an ADAM instance running under a service account other than the Network Service account, you must grant the Generate security audits right to the account that is used as the ADAM service account.

  • To enable a workstation or domain user account as a service account, you must grant the Log on as a service right to the account that is used as the ADAM service account. For more information, see Add the Log on as a service right to an account.

See Also

  • Running ADAM on Windows XP Professional
  • Administering computers running ADAM
  • Selecting an ADAM service account
  • Administering an ADAM instance


Selecting an administrator account

On the ADAM Administrators page, you must select a user or group to become the default administrator for this Active Directory Application Mode (ADAM) instance. This user or group that you select will have full administrative control of the ADAM instance.

By default, the ADAM Setup Wizard specifies the currently logged on user. You can change this selection to any local or domain account or group on your network.

To select an administrator account

  • On the ADAM Administrators page, do one of the following, and then click Next:

    • Click Currently logged on user.

    • Click This account, click Browse, and then select a local or domain account or group.

Notes

  • If you specify a group to become the ADAM administrator, every member of that group will have administrative control of the ADAM instance.

  • The user or group that you select automatically becomes a member of the Administrators group in the configuration directory partition of the ADAM instance. For more information about users and groups in ADAM, see Related Topics.

  • Do not specify built-in groups or built-in accounts, such as DOMAIN\Administrators. Instead, if you want to specify a group, specify a domain group, such as domainname\Domain Admins, where domainname represents the name of your domain.

See Also

  • Understanding ADAM users and groups
  • Administering users and groups


Importing LDIF files during setup

On the Import LDIF Files page, you can specify that the optional ms-InetOrgPerson.ldf, ms-User.ldf, ms-UserProxy.ldf, and MS-AZMan.ldf LDAP Data Interchange Format (LDIF) files be imported. Together, these files contain several user class schema definitions, along with objects for use with Windows Authorization Manager, that can be imported into the schema of the new ADAM instance that is currently being installed.

To import LDIF files during setup

  • On the Import LDIF Files page, do one of the following, and then click Next:

    • If you do not want to import or use the optional user class schema definitions, click Do not import LDIF files for this instance of ADAM.

    • If you want to use the optional user class schema definitions or Windows Authorization Manager with your ADAM instance, click Import the selected LDIF files for this instance of ADAM; in Available files, click one or more of the LDAP Data Interchange Format (LDIF) files to import; and then click Add.

Notes

  • The following table describes each of the optional .ldf files.

    .ldf file User classes Import this file if ...

    MS-User.LDF
    • Person

    • Organizational-Person

    • User

    You want to create user objects in the ADAM directory, but you do not want to create users of the InetOrgPerson class (as defined in RFC 2798).

    MS-InetOrgPerson.LDF
    • Person

    • Organizational-Person

    • User

    • inetOrgPerson

    You want to create user objects in the ADAM directory, and you want to create users of the InetOrgPerson class (as defined in RFC 2798).

    MS-UserProxy.LDF
    • User-Proxy

    You want to create proxy objects in ADAM for use in bind redirection. For more information about proxy objects and bind redirection, see Understanding ADAM bind redirection.

    MS-AZMan.LDF
    • Not applicable

    You want to use Windows Authorization Manager with ADAM. For information about role-based authorization in Windows Server 2003, see "Dynamic Groups in Windows Server 2003 Authorization Manager" at the Microsoft MSDN Web site.
  • If you choose not to import these LDIF files during setup, you can import them at a later time, using the ldifde command-line tool. For more information, see Related Topics.

  • This wizard page appears only during the installation of a unique ADAM instance and not during the installation of a replica ADAM instance.

  • You must be logged on as an account that is specified as the ADAM administrator to import these schema class definitions into the ADAM schema.

See Also

  • Import the user classes supplied with ADAM
  • Administering users and groups
  • Understanding ADAM users and groups
  • ADAM Ldifde


Reviewing ADAM Setup Wizard selections

On the Ready to Install page, you can review the ADAM setup options that you have selected.

To review or change your selections in the ADAM Setup Wizard

  1. In the Selections box, use the scroll bar to review your selections.

  2. To change any of your selections:

    1. Click Back until you reach the wizard page that contains the setting that you want to change.

    2. After making the change, click Next until you reach the Ready to Install page again.

  3. To make any additional changes, repeat step 2.

  4. Click Next.

Note

  • After you click Next, the ADAM Setup Wizard automatically begins copying files and configuring the new ADAM instance.


Finishing the installation

If the Active Directory Application Mode Setup Wizard completes successfully, the Completing the Active Directory Application Mode Setup Wizard page displays the message "You have successfully completed the ADAM Setup Wizard." If the Active Directory Application Mode Setup Wizard does not complete successfully, an error message appears.

Errors can occur either during the setup process or during directory service initialization.

To finish the installation

  • Review the message that appears. Based on the contents of message, do one of the following:

    • If "You have successfully completed the ADAM Setup Wizard" appears, click Finish.

    • If an error message appears, make a note of the error, click Finish, and then review the Active Directory Application Mode (ADAM) event messages in Event Viewer.

Notes

  • If an error occurs in the Active Directory Application Mode Setup Wizard before the Completing the Active Directory Application Mode Setup Wizard page, first review the error message that describes the cause of the problem. Then, click Start, click Run, and type either of the following:

    %windir%\Debug\adamsetup.log

    %windir%\Debug\adamuninstall.log

    These files contain information that can help you troubleshoot the cause of the ADAM setup failure.

  • For both installs and uninstalls, ADAM uses a registry key to return error codes and messages back to the caller (for example, an .msi package). ADAM Setup creates this registry key and associated values only if errors or warnings occur. This registry key is HKLM\Software\Microsoft\Windows\CurrentVersion\ADAM_Installer_Results, and it includes the possible values in the following table.

    Key Contents

    ADAMInstallErrorCode

    The numeric error code that caused the installer to fail

    ADAMInstallErrorMessage

    A message that is associated with the install error code

    ADAMInstallWarnings

    Messages that are associated with the install warnings

    ADAMUninstallErrorCode

    The numeric error code that caused the uninstall to fail

    ADAMUninstallErrorMessage

    A message that is associated with the uninstall error code

    ADAMUninstallWarnings

    Messages that are associated with the uninstall warnings


Perform an unattended install of an ADAM instance

In addition to using the Active Directory Application Mode Setup Wizard, you can install Active Directory Application Mode (ADAM) without user intervention. An unattended ADAM installation requires an answer file (Answer.txt) that contains a set of preconfigured installation options.

To perform an unattended install of an ADAM instance

  1. Using any text editor, create a new text file. (As an option, you can copy and paste the sample answer file below into your answer file.)

  2. Specify the installation parameters, as described in the table below.

  3. Save your answer file.

  4. At a command prompt (or in a batch or script file), change to the drive and directory that contains the ADAM setup files, and then type the following command:

    Adamsetup /c:"adaminstall.exe /answer: drive:\pathname\filename.txt "

    where drive:\pathname\filename.txt represents the drive, path, and file name of your answer file. (The double quotation marks in the command are required.)

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • The following table describes the parameters that can be used in an ADAM answer file. These parameters are not case sensitive. In other words, you can specify either InstallType or installtype in your answer file. However, case is preserved on the values that you specify for the instancename and servicepassword parameters.

    Parameter Possible values Default behavior if the parameter is not present in the answer file

    InstallType

    Valid for all installations.

    Optional.

    Unique — Creates a unique instance of ADAM.

    Replica — Creates an instance of ADAM by replicating all or part of an existing ADAM instance, either over the network or from restored backup media.

    When values are also specified in the answer file for the ReplicationDataSourcePath and ReplicationLogSourcePath parameters, and when InstallType is set to Replica, ADAM setup installs an ADAM replica instance from restored backup media. If values for those parameters are not present, ADAM setup installs an ADAM replica instance over the network. For more information about installation from media, see Install an ADAM replica from media.

    Tools — Installs ADAM tools only.

    Any other value — Returns "Invalid installation type specified in InstallType" error message.

    Same behavior as Unique

    ShowOrHideProgressGUI

    Valid for all installations.

    Optional.

    Show — ADAM setup displays progress information during installation.

    Hide — ADAM setup does not display progress information during installation.

    Same behavior as Hide

    ShowAdamShortcuts

    Valid for all installations.

    Optional.

    Show — ADAM setup installs shortcuts for the ADAM tools into the ADAM program group.

    Hide — ADAM setup does not install shortcuts for the ADAM tools in the ADAM program group.

    Same behavior as Show

    InstanceName

    Valid for all installations.

    Optional.

    An ADAM instance name must meet the following requirements:

    • It must be unique with respect to other ADAM instances running on the same computer.

    • It must be no longer than 44 characters.

    • It must use characters only from the ranges of a through z, A through Z, or 0 through 9.

    The instance will be named Instancen, where n is the lowest number greater than 0 and Instancen is unique on the local computer.

    ApplicationPartitionsToReplicate

    Valid only for replica installations.

    Optional.

    Specify the distinguished names of the application partitions to replicate from the source ADAM instance.

    The following example specifies three application partitions to replicate:

    ApplicationPartitionsToReplicate = "CN=my,O=partition" "DC=partition2" "CN=embed qu\"ote in DN"

    To replicate all application partitions from the source ADAM instance, specify "*" as the value. Any value that is specified for ApplicationPartitionsToReplicate is ignored if InstallType is not set to Replica.

    No application partitions are replicated.

    ReplicationDataSourcePath

    Valid only for replica installations.

    When a value for this parameter is present, ADAM setup attempts an installation from media. If the value for this parameter is not valid, ADAM setup writes an error to the setup log.

    Specify the directory path to a restored instance of ADAM data. Any value that is specified for ReplicationDataSourcePath is ignored if InstallType is not set to Replica or if a value is not also specified for ReplicationLogSourcePath.

    Application data is replicated over the network, rather than from a restored backup of an ADAM instance. If a value is specified for this parameter, but not for ReplicationLogSourcePath, an error occurs.

    ReplicationLogSourcePath

    Valid only for replica installations.

    When a value for this parameter is present, ADAM setup attempts an installation from media. If the value for this parameter is not valid, ADAM setup writes an error to the setup log.

    Specify the directory path to the log file for a restored instance of ADAM. Any value that is specified for ReplicationLogSourcePath is ignored if InstallType is not set to Replica or if a value is not also specified for ReplicationDataSourcePath.

    Application data is replicated over the network, rather than from a restored backup of an ADAM instance. If a value is specified for this parameter, but not for ReplicationDataSourcePath, an error occurs.

    LocalLDAPPortToListenOn

    Required for all installations.

    389 or any unused port number between 1025 and 65535, inclusive.

    Any other value — Returns "Invalid local LDAP port specified."

    Defaults to 389. Or, if 389 is not available, defaults to the first available port equal to or greater than 50000.

    LocalSSLPortToListenOn

    Required for all installations.

    636 or any unused port number between 1025 and 65535, inclusive.

    Any other value — Returns "Invalid local SSL port specified."

    Defaults to 636. Or, if 636 is not available, defaults to the first available port equal to or greater than 50000.

    SourceServer

    Required for replica installations.

    A valid DNS name or network basic input/output system (NetBIOS) name.

    Any other value — If the installation type is replica, returns "Invalid syntax for replication source server," else do nothing.

    If the installation type is replica, returns "Replication source server not specified," else do nothing.

    SourceLDAPPort

    Required for replica installations.

    Either 389 or a number between 1025 and 65535.

    Any other value — If the installation type is replica, returns "Invalid replication source port specified," else do nothing.

    If the installation type is replica, returns "Replication source port not specified," else do nothing.

    NewApplicationPartitionToCreate

    Valid for installations of new, unique ADAM instances.

    Optional.

    A valid distinguished name — Creates an application partition with the specified name.

    "" (empty string) — No new application partition will be created.

    Any other value — If the installation type is unique, returns "Invalid application partition syntax in NewApplicationPartitionToCreate," else do nothing.

    Same behavior as ""

    DataFilesPath

    Valid for all installations.

    Optional.

    A syntactically correct path name, which may include unresolved environment variables that do not contain existing ADAM files.

    Any other value — Returns "Invalid path in DataFilesPath."

    Store data files in Program Files\Microsoft ADAM\instancename\data.

    LogFilesPath

    Valid for all installations.

    Optional.

    A syntactically correct path name, which may include unresolved environment variables that do not contain existing ADAM files.

    Any other value — Returns "Invalid path in LogFilesPath."

    Stores log files in Program Files\Microsoft ADAM\instancename\data

    ServiceAccount

    Valid for all installations.

    Optional.

    A valid DNS domain name, followed by a backslash and the account or group name.

    A valid NetBIOS domain name, followed by a backslash and the account name.

    A valid user principal name (UPN).

    A valid account name only. (This is generally not recommended, because resolving an account name that is not accompanied by a domain name requires additional processing.)

    Any other value — Returns "Invalid user specified in ServiceAccount."

    This instance of ADAM will run under the Network Service account.

    AddPermissionsToServiceAccount

    Valid for all installations.

    Optional.

    Yes — ADAM setup attempts to add the Log on as a service right to the account that is specified as the service account.

    Any other value — ADAM setup does not attempt to add the Log on as a service right to the account that is specified as the service account.

    ADAM setup does not attempt to add the Log on as a service right to the account that is specified as the service account.

    ServicePassword

    Valid for all installations.

    Required, unless ServiceAccount is the Network Service account.

    Any string of characters, including the empty string.

    If ServiceAccount is the Network Service account, do nothing; otherwise, returns "No password specified in ServicePassword."

    Administrator

    Valid for all installations.

    Optional.

    A valid DNS domain name, followed by a backslash and the account name.

    Do not specify built-in groups or built-in accounts, such as DOMAIN\Administrators. Instead, if you want to specify a group, specify a domain group, such as domainname\Domain Admins, where domainname represents the name of your domain.

    A valid NetBIOS domain name, followed by a backslash and the account name.

    A valid UPN.

    A valid account name only. (This is generally not recommended, because resolving an account name that is not accompanied by a domain name requires additional processing.)

    Any other value — Returns "Invalid user specified in Administrator."

    The currently logged on user will have administrator permissions on this instance of ADAM.

    ShowInAddRemovePrograms

    Valid for all installations.

    Optional.

    Show — Lists the ADAM instance in Add or Remove Programs.

    Hide — Does not list the ADAM instance in Add or Remove Programs

    The installed ADAM instance is shown in Add or Remove Programs.

    ImportLDIFFiles

    Valid for all installations.

    Optional.

    The optional .ldf files (ms-User.ldf, ms-InetOrgPerson.ldf, ms-UserProxy.ldf, and ms-azman.ldf) that you want to import into the ADAM schema. The file names must be enclosed in double quotation marks, delimited with a space (" ").

    None of the optional .ldf files are imported.
  • The following represents a sample answer file for use with adaminstall.

    [ADAMInstall]

; The following line specifies to install a unique ADAM instance.
InstallType=Unique

; The following line specifies the name to be assigned to the new instance.
InstanceName=MyFirstInstance

; The following line specifies the communications port to use for LDAP.
LocalLDAPPortToListenOn=389

; The following line specifies an application partition to create
NewApplicationPartitionToCreate="o=microsoft,c=us"

; The following line specifies the directory to use for ADAM data files.
DataFilesPath=C:\Program Files\Microsoft ADAM\instance1\data

; The following line specifies the directory to use for ADAM log files.
LogFilesPath=C:\Program Files\Microsoft ADAM\instance1\data

; The following line specifies the .ldf files to import into the ADAM schema.
ImportLDIFFiles="ms-inetorgperson.ldf" "ms-user.ldf"
  • For both installs and uninstalls, ADAM uses a registry key to return error codes and messages back to the caller, for example, an .msi package. ADAM Setup creates this registry key and associated values only if errors or warnings occur. This registry key is HKLM\Software\Microsoft\Windows\CurrentVersion\ADAM_Installer_Results, and it includes the possible values in the following table.

    Key Contents

    ADAMInstallErrorCode

    The numeric error code that caused the installer to fail

    ADAMInstallErrorMessage

    A message that is associated with the install error code

    ADAMInstallWarnings

    Messages that are associated with the install warnings

    ADAMUninstallErrorCode

    The numeric error code that caused the uninstall to fail

    ADAMUninstallErrorMessage

    A message that is associated with the uninstall error code

    ADAMUninstallWarnings

    Messages that are associated with the uninstall warnings

See Also

  • Starting the ADAM Setup Wizard
  • Install ADAM
  • Manually register ADAM service principal names in Active Directory
  • Adaminstall


Install an ADAM replica from media

Install an ADAM replica from media

When you install an Active Directory Application Mode (ADAM) replica from media, you use a restored backup of an ADAM instance as the data source, rather than another ADAM instance.

  • Using the Active Directory Application Mode Setup Wizard

  • Using ADAM unattended install

Using the Active Directory Application Mode Setup Wizard

To install an ADAM replica from media

  1. Restore a backup copy of the ADAM instance from which you want to install to an alternate location. (Do not restore the backup to the original location of the ADAM instance.)

  2. At a command prompt, type the following:

    d:\path\ adaminstall /adv

    where d:\path\ represents the location of Adaminstall.exe.

  3. Follow the steps in the Active Directory Application Mode Setup Wizard.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • To view Help for any given wizard page, click Help in the Active Directory Application Mode Setup Wizard.

  • You can install an ADAM replica only from media created by restoring a backup copy of an ADAM instance. For information about restoring an ADAM instance, see Related Topics.

  • When you restore an ADAM instance for use in a replica installation from media, you must restore the files to an alternate location, rather than to the original location from which they were backed up.

  • After you restore ADAM files from a backup to an alternate location, the Adamntds.dit file and Edb*.log files will be nested in the specified alternate location. For example, if you specify c:\restore_dir as the restore location for the ADAM files, Adamntds.dit and the Edb*.log files will be located at c:\restore_dir\Program Files\Microsoft ADAM\instancename\data, where instancename represents the ADAM instance that was restored.

  • For information about how to back up an ADAM instance, see Related Topics.

  • For more information about ADAM unattended installs, see Related Topics.

Using ADAM unattended install

To install an ADAM replica from media

  1. Restore a backup copy of the ADAM replica from which you want to install to an alternate location. (Do not restore the backup to the original location of the ADAM instance.)

  2. Create an ADAM unattended install answer file that contains the answer file attributes and values in the following table, in addition to any other answer file parameters that you want to set, as described in Perform an unattended install of an ADAM instance.

    Attribute Value

    InstallType

    Replica

    ReplicationDataSourcePath

    The directory location to which you restored the ADAM replica data files

    ReplicationLogSourcePath

    The directory location to which you restored the ADAM replica log files

    ApplicationPartitionsToReplicate

    The application directory partitions (from the restored files) that you want to install. Setting ApplicationPartitionsToReplicate equal to * installs all application directory partitions that exist in the restored files. Setting a specific value for this parameter installs the specified application directory partitions, along with any application directory partitions that are not part of the restored files but that do exist on other ADAM instances in the configuration set.

  3. At a command prompt (or in a batch or script file), change to the drive and directory that contains the ADAM setup files, and then type the following command:

    adamsetup /c:"adaminstall.exe /answer: drive:\pathname\filename.txt"

    where drive:\pathname\filename.txt represents the drive, path, and file name of your answer file.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • You can install an ADAM replica only from media created by restoring a backup copy of an ADAM instance. For information about restoring an ADAM instance, see Related Topics.

  • When you restore an ADAM instance for use in a replica install from media, you must restore the files to an alternate location, rather than to the original location from which they were backed up.

  • After you restore ADAM files from a backup into an alternate location, the Adamntds.dit file and Edb*.log files will be nested in the alternate location that you specified. For example, if you specified c:\restore_dir as the restore location for the ADAM files, Adamntds.dit and the Edb*.log files will be located at c:\restore_dir\Program Files\Microsoft ADAM\instancename\data, where instancename represents the ADAM instance that was restored.

  • For information about how to back up an ADAM instance, see Related Topics.

  • For more information about ADAM unattended installs, see Related Topics.

  • For more information about unattended install parameters, see Related Topics.

See Also

  • Perform an unattended install of an ADAM instance
  • Adaminstall
  • Back up an ADAM instance to a file or a tape
  • Restore an ADAM instance


Remove an ADAM instance

To remove an ADAM instance

  1. Open Add or Remove Programs.

  2. Click Change or Remove Programs, and then click the ADAM instance that you want to remove.

  3. Click Remove.

Notes

  • To open Add or Remove Programs, click Start, click Control Panel, and click Add or Remove Programs.

  • You can sort programs in Add or Remove Programs by selecting different options in Sort by.

  • It is not necessary to restart the computer after removing an ADAM instance.


Perform an unattended removal of an ADAM instance

You can remove an ADAM instance without using Add or Remove Programs, by performing an unattended removal of Active Directory Application Mode (ADAM). An unattended removal of ADAM can only be performed under the security context of the ADAM administrator. If you are not currently logged on as the ADAM administrator, the ADAM administrator credentials can be specified through a text answer file.

To perform an unattended removal of an ADAM instance

  • At a command prompt (or in a batch or script file), type the following command:

    adamuninstall /i: instancename /answer:d:\dirpath\filename

    where instancename represents the name of the ADAM instance to be removed, and d:\dirpath\filename represents the drive, path and file name of an optional answer file containing the credentials of the ADAM administrator for the specified instance.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • To pass the credentials of the ADAM administrator to adamuninstall from the command line, create a text answer file containing the following syntax:

    Administrator= domain\account

    AdministratorPassword= password

    where domain\account represents the domain and account name of the ADAM administrator, and password represents the corresponding password.

  • The following represents a sample answer file for use with adamuninstall:

    Administrator=cohovineyard\administrator
AdministratorPassword=adminpassword
  • For both installs and uninstalls, ADAM uses a registry key to return error codes and messages back to the caller, for example, an .msi package. ADAM Setup creates this registry key and associated values only if errors or warnings occur. This registry key is HKLM\Software\Microsoft\Windows\CurrentVersion\ADAM_Installer_Results, and it includes the possible values in the following table.

    Key Contents

    ADAMInstallErrorCode

    The numeric error code that caused the installer to fail

    ADAMInstallErrorMessage

    A message that is associated with the install error code

    ADAMInstallWarnings

    Messages that are associated with the install warnings

    ADAMUninstallErrorCode

    The numeric error code that caused the uninstall to fail

    ADAMUninstallErrorMessage

    A message that is associated with the uninstall error code

    ADAMUninstallWarnings

    Messages that are associated with the uninstall warnings

See Also

  • Remove an ADAM instance
  • Manually remove ADAM service principal names from Active Directory
  • Adamuninstall


Manage an ADAM Instance

Manage an ADAM instance

  • Connect and bind to an ADAM instance using ADAM ADSI Edit

  • Connect and bind to an ADAM instance using Ldp.exe

  • Browse the directory tree using ADAM ADSI Edit

  • Browse the directory tree using Ldp.exe

  • List the directory partitions, or naming contexts, of an ADAM instance or configuration set

  • List the ADAM instances installed on a computer

  • Start, stop, pause, resume, or restart an ADAM instance

  • Add the Log on as a service right to an account

  • Modify the communication ports used by an ADAM instance

  • Modify the service account used by an ADAM instance

  • View or modify the service display name of an ADAM instance

  • View or modify the service description of an ADAM instance

  • Enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup

  • Allow anonymous LDAP binding to an ADAM instance

  • Manually register ADAM service principal names in Active Directory

  • Manually remove ADAM service principal names from Active Directory


Connect and bind to an ADAM instance using ADAM ADSI Edit

To connect and bind to an ADAM instance using ADAM ADSI Edit

  1. Click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  2. In the console tree, click ADAM ADSI Edit.

  3. On the Action menu, click Connect to.

  4. In Connection name, type a name for this connection.

  5. In Server name, type the DNS name, network basic input/output system (NetBIOS) name, or Internet Protocol (IP) address of the computer on which the ADAM instance is running.

  6. In Port, type the Lightweight Directory Access Protocol (LDAP) communication port in use by the ADAM instance to which you want to connect.

  7. Under Connect to the following node, do one of the following:

    • Click Distinguished name (DN) or naming context, and then specify the distinguished name to which you want to connect.

    • Click Well-known naming context, and then click Configuration, RootDSE, or Schema.

  8. Under Connect using these credentials, do one of the following:

    • Click The account of the currently logged on user.

    • Click This account, and then specify the user name and password of the account with which you want to connect.

Notes

  • To create additional connections to ADAM instances, on the Action menu, click Connect to for each new connection.

  • When you run ADAM on computers running Windows XP Professional, you cannot set or modify the password for any principal in ADAM using ADAM ADSI Edit.

  • The default communication port for LDAP is 389.

  • ADAM ADSI Edit does not support Secure Sockets Layer (SSL) connections to ADAM.

  • To connect to an ADAM instance running on the local computer, type localhost as the server name.


Connect and bind to an ADAM instance using Ldp.exe

To connect and bind to an ADAM instance using Ldp.exe

  1. Open Ldp.

  2. On the Connection menu, click Connect.

  3. In Server, type the DNS name, network basic input/output system (NetBIOS) name, or Internet Protocol (IP) address of the computer on which the ADAM instance is running.

  4. In Port, type the Lightweight Directory Access Protocol (LDAP) or Secure Sockets Layer (SSL) communication port number in use by the ADAM instance to which you want to connect, and then click OK.

  5. On the Connection menu, click Bind.

  6. Do one of the following:

    • To bind using the credentials you logged on with, click Bind as currently logged on user.

    • To bind using a domain user account, click Bind using credentials, type the user name, password, and domain name (or the computer name, if you are using a local workstation account) of the account that you are using, and then click OK.

    • To bind using just a user name and password, click Simple bind, type the user name and password of the account that you are using, and then click OK.

    • To bind using an advanced method (NTLM, DPA, negotiate, or digest), click Advanced (method), click Advanced, in Method, select the desired method, set other options as needed, and then click OK.

  7. When you are finished specifying bind options, click OK.

Notes

  • To open Ldp, click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then type ldp at the command prompt.

  • The default communication port for LDAP is 389. The default communication port for SSL is 636.

  • To connect to an ADAM instance running on the local computer, type localhost as the server name.

See Also

  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using Ldp.exe
  • Ldp


Browse the directory tree using ADAM ADSI Edit

To browse the directory tree using ADAM ADSI Edit

  1. Connect and bind to a directory partition using ADAM ADSI Edit.

  2. In the console tree, double-click connectionname[hostname], where connectionname is the name of the connection and hostname is the name of the computer on which the directory partition is stored.

  3. In the console tree, double-click a directory partition object to view its top-level containers.

  4. In the console tree, double-click a top-level container to view the next level of objects in that container.

  5. Do one of the following:

    • Continue double-clicking the next lowest container level to continue down a directory tree branch.

    • To view a directory object at the current directory level, in the details pane, double-click the directory object.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • To connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • ADAM ADSI Edit does not support Secure Sockets Layer (SSL) connections to ADAM.

  • For more information about ADAM ADSI Edit, see Related Topics.

See Also

  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using Ldp.exe
  • ADAM ADSI Edit


Browse the directory tree using Ldp.exe

To browse the directory tree using Ldp.exe

  1. Connect and bind to an ADAM instance using Ldp.exe.

  2. On the View menu, click Tree.

  3. In the Tree View dialog box, do one of the following:

    • To view all directory partitions on the ADAM instance, click OK.

    • To view only a specific directory partition on the ADAM instance, type the distinguished name of the directory partition in BaseDN, and then click OK.

  4. In the console tree, double-click a directory partition object to view its top-level containers.

  5. Double-click a top-level container to view the next level of objects in that container.

  6. Do one of the following:

    • Continue double-clicking the next lowest container level to continue down a directory tree branch.

    • To view a directory object at the current directory level, double-click the object in the console tree, and then, in the details pane, view object details.

Notes

  • To open Ldp.exe, click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then type ldp at the command prompt.

  • To connect and bind to an ADAM instance using Ldp.exe, see Related Topics.

  • For more information about Ldp, see Related Topics.

See Also

  • Connect and bind to an ADAM instance using Ldp.exe
  • Browse the directory tree using Ldp.exe
  • Browse the directory tree using ADAM ADSI Edit
  • Ldp


List the directory partitions, or naming contexts, of an ADAM instance or configuration set

To list the directory partitions of an ADAM instance or configuration set

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    dsmgmt

  3. At the dsmgmt: prompt, type:

    partition management

  4. At the partition management: prompt, type:

    connections

  5. At the server connections: prompt, type:

    connect to server computername:portnumber

    where computername is the computer on which the ADAM instance is running and portnumber is the Lightweight Directory Access Protocol (LDAP) or Secure Sockets Layer (SSL) communications port used by the ADAM instance.

  6. At the server connections: prompt, type:

    quit

  7. At the partition management: prompt, type:

    list

  8. After viewing the list of directory partitions, at the partition management: prompt, type:

    quit

    and then at the dsmgmt: prompt, type:

    quit

Note

  • To open an ADAM Tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • For help with dsmgmt, type ? at a dsmgmt prompt.

See Also

  • Dsmgmt
  • Administering directory partitions


List the ADAM instances installed on a computer

To list the ADAM instances installed on a computer

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    dsdbutil

  3. At the dsdbutil: prompt, type:

    list instances

  4. To exit the dsdbutil administration tool, at the dsdbutil: prompt, type:

    quit

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • The information about the ADAM instances that are listed by this procedure includes the following: ADAM instance name, Lightweight Directory Access Protocol (LDAP) port, Secure Sockets Layer (SSL) port, installation directory, database file, log file directory, and service state.

See Also

  • Dsdbutil
  • Administering an ADAM instance
  • List the directory partitions, or naming contexts, of an ADAM instance or configuration set


Start, stop, pause, resume, or restart an ADAM instance

Start, stop, pause, resume, or restart an ADAM instance

  • Using the graphical user interface

  • Using the command prompt

Using the graphical user interface

To start, stop, pause, resume, or restart an ADAM instance

  1. Open Services.

  2. In the details pane, do one of the following:

    • Click the ADAM instance that you want to manage. On the Action menu, click Start, Stop, Pause, Resume, or Restart.

    • Right-click the service, and then click Start, Stop, Pause, Resume, or Restart.

Notes

  • To open Services, click Start, click Run, type services.msc, and then click OK.

  • By default, an ADAM instance is configured to start automatically.

Using the command prompt

To start, stop, pause, resume, or restart an ADAM instance

  1. Open a Command Prompt.

  2. Do one of the following:

    • To start an ADAM instance, type the following at the command prompt:

      net start instance_name

      where instance_name represents the ADAM instance that you want to start.

    • To stop an ADAM instance, type the following at the command prompt:

      net stop instance_name

      where instance_name represents the ADAM instance that you want to stop.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • You cannot pause or resume an ADAM instance from a command prompt.

  • By default, an ADAM instance is configured to start automatically.

  • For more information about the net command, type net /? at a command prompt, or see Help and Support Center in Windows Server 2003.


Add the Log on as a service right to an account

Add the Log on as a service right to an account

To add the "Log on as a service" right to an account on your local computer

  1. Open Local Security Policy.

  2. In the console tree, double-click Local Policies, and then click User Rights Assignments.

  3. In the details pane, double-click Log on as a service.

  4. Click Add User or Group, and then add the appropriate account to the list of accounts that possess the Log on as a service right.
To add the "Log on as a service" right to an account for a Group Policy object, when you are on a workstation or server that is joined to a domain

  1. Click Start, point to Run, type mmc, and then click OK.

  2. On the File menu, click Add/Remove Snap-in.

  3. In Add/Remove Snap-in, click Add, and then, in Add Standalone Snap-in, double-click Group Policy Object Editor.

  4. In Select Group Policy Object, click Browse, browse to the Group Policy object (GPO) that you want to modify, click OK, and then click Finish.

  5. Click Close, and then click OK.

  6. In the console tree, click User Rights Assignment.

    Where?

    • GroupPolicyObject [ComputerName] Policy

    • Computer Configuration

    • Windows Settings

    • Security Settings

    • Local Policies

    • User Rights Assignment

  7. In the details pane, double-click Log on as a service.

  8. If the security setting has not yet been defined, select the Define these policy settings check box.

  9. Click Add User or Group, and then add the appropriate account to the list of accounts that possess the Log on as a service right.
To add the "Log on as a service" right to an account for a Group Policy object, when you are on a domain controller or on a computer that has the Windows Server 2003 Administration Tools Pack installed

  1. Open Active Directory Users and Computers.

  2. In the console tree, right-click the domain or organizational unit (OU) for which you want to edit security settings.

  3. Click Properties, and then click the Group Policy tab.

  4. In Group Policy Object Links, click the Group Policy object for the domain or OU for which you want to edit security settings, and then click Edit.

  5. In the console tree, click User Rights Assignment.

    Where?

    • GroupPolicyObject [ComputerName] Policy

    • Computer Configuration

    • Windows Settings

    • Security Settings

    • Local Policies

    • User Rights Assignment

  6. Double-click Log on as a service in the details pane.

  7. If this security setting has not yet been defined, select the Define these policy settings check box.

  8. Click Add User or Group, and then add the appropriate account to the list of accounts that possess the Log on as a service right.
To add the "Log on as a service" right to an account for only domain controllers, when you are on a domain controller

  1. Open Domain Controller Security Policy.

  2. In the console tree, click User Rights Assignment.

    Where?

    • Security Settings

    • Local Policies

    • User Rights Assignment

  3. In the details pane, double-click Log on as a service.

  4. If this security setting has not yet been defined, select the Define these policy settings check box.

  5. Click Add User or Group, and then add the appropriate account to the list of accounts that possess the Log on as a service right.

Notes

  • To open Local Security Policy, click Start, point to Control Panel, point to Administrative Tools, and then double-click Local Security Policy.

  • To open Domain Controller Security Policy, click Start, point to All Programs, point to Administrative Tools, and then click Domain Controller Security Policy.

  • When you change a security setting, that setting will take effect in the next refresh of settings.

  • The security settings are refreshed every 90 minutes on a workstation or server and every 5 minutes on a domain controller. The settings are also refreshed every 16 hours, whether or not there are any changes.


Modify the communication ports used by an ADAM instance

To modify the communications ports used by an ADAM instance

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    net stop instancename

    where instancename represents the service name of the ADAM instance on which you want to change the communication port.

  3. At the command prompt, type:

    dsdbutil

  4. At the dsdbutil: prompt, type:

    activate instance instancename

    where instancename represents the service name of the ADAM instance on which you want to modify the communication port.

  5. At the dsdbutil: prompt, do one of the following:

    • To change the Lightweight Directory Access Protocol (LDAP) communication port, type:

      LDAP port portnumber

      where portnumber represents a communication port (either 389 or in the range of 1025 through 65535) that you want to assign to LDAP.

    • To change the Secure Sockets Layer (SSL) communication port, type:

      SSL port portnumber

      where portnumber represents the communication port (either 636 or in the range of 1025 through 65535) that you want to assign to SSL.

  6. To exit dsdbutil, at the dsdbutil: prompt, type:

    quit

  7. At the command prompt, type:

    net start instancename

    to restart the ADAM instance.

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • Allowable communication port numbers in ADAM include 389, 636, and any port number in the range of 1025 through 65535.

See Also

  • Using ADAM administration tools
  • Running ADAM on Windows XP Professional
  • Administering computers running ADAM


Modify the service account used by an ADAM instance

To modify the service account used by an ADAM instance

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    net stop instancename

    where instancename represents the service name of the ADAM instance on which you want to change the service account.

  3. At the command prompt, type:

    dsdbutil

  4. At the dsdbutil: prompt, type:

    activate instance instancename

    where instancename represents the service name of the ADAM instance on which you want to change the service account.

  5. At the dsdbutil: prompt, type:

    change service account accountname password

    where accountname passwordrepresents the account name and password of the account to be used as the ADAM service account.

  6. To exit dsdbutil, at the dsdbutil: prompt, type:

    quit

  7. At the command prompt, type:

    net start instancename

    to restart the ADAM instance.

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • When you specify a workstation or domain user account as the service account, the specified account must possess the Log on as a service right. To assign the Log on as a service right to an account, you must edit the security setting on the appropriate Group Policy object (GPO). For more information, see Related Topics.

  • The service account that you select may depend on whether the ADAM instance participates in a configuration set and also on the replication security level. For more information, see Related Topics.

See Also

  • Add the Log on as a service right to an account
  • Administering replication and configuration sets
  • Understanding ADAM replication and configuration sets
  • Selecting an ADAM service account


View or modify the service display name of an ADAM instance

To view or modify the service display name of an ADAM instance

  1. Open Command Prompt.

  2. Do one of the following:

    • To view the service display name, type:

      sc \\servername getdisplayname servicename

      where servername represents the name of the computer on which the ADAM instance is running, and servicename represents the service name of the ADAM instance.

    • To modify the service display name, type:

      sc \\servername config servicename displayname= "display_name"

      where servername represents the name of the computer on which the ADAM instance is running, servicename represents the service name of the ADAM instance that you want to modify, and display_name represents the new service display name that you want to assign. (A space character (" ") is required after the equal sign (=) and before display_name).

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • If the ADAM instance is running on the local computer, you can omit the servername parameter.

  • By default, the ADAM instance name is instancename, where instancename is the name that you provided during ADAM installation.

  • By default, the ADAM service name is ADAM_instancename, where instancename is the name that you provided during ADAM installation.

See Also

  • Administering an ADAM instance
  • View or modify the service description of an ADAM instance


View or modify the service description of an ADAM instance

To view or modify the service description of an ADAM instance

  1. Open Command Prompt.

  2. Do one of the following:

    • To view the service description, type:

      sc \\servername qdescription serviceename

      where servername represents the name of the computer on which the ADAM instance is running, and servicename represents the service name of the ADAM instance.

    • To modify the service description, type:

      sc \\servername description servicename "service_description"

      where servername represents the name of the computer on which the ADAM service is running, servicename represents the service name of the ADAM instance, and service_description represents the new description.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • By default, the ADAM service description is empty.

  • By default, the ADAM service name is ADAM_instancename, where instancename is the name that you provided during ADAM setup.

See Also

  • Administering an ADAM instance
  • View or modify the service display name of an ADAM instance


Enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup

To enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup

  1. Open Registry Editor.

  2. In Registry Editor, navigate to the registry subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

    Where?

    • HKEY_LOCAL_MACHINE

    • System

    • CurrentControlSet

    • Control

    • LSA

  3. In the details pane, right-click forceguest, and then click Modify.

  4. In Value data, type 0, and then click OK.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.

Note

  • To open Registry Editor, click Start, click Run, type regedit, and then click OK.

See Also

  • View or modify the service display name of an ADAM instance
  • View or modify the service description of an ADAM instance
  • Start, stop, pause, resume, or restart an ADAM instance
  • Administering an ADAM instance


Allow anonymous LDAP binding to an ADAM instance

To allow anonymous LDAP binding to an ADAM instance

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of the ADAM instance on which you want to allow anonymous Lightweight Directory Access Protocol (LDAP) binding.

  3. In the console tree, double-click the configuration directory partition (CN=Configuration,CN={GUID}), double-click the services container (CN=Services), double-click the Windows NT container (CN=Windows NT), right-click the directory service container (CN=Directory Service), and then click Properties.

  4. In Attributes, click dsHeuristics, and then click Edit.

  5. In Value, modify the value of the seventh character in the attribute (counting from the left) to 2, as follows:

    0000002001001

  6. Click OK twice.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • To connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • ADAM does not allow anonymous LDAP binding by default.

See Also

  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Administering an ADAM instance
  • ADAM ADSI Edit
  • ADAM troubleshooting and frequently asked questions (FAQs)


Manually register ADAM service principal names in Active Directory

To manually register ADAM service principal names in Active Directory

  1. Do one of the following:

    • Log on as a member of the Domain Admins group, and then open a command prompt.

    • Using run as, open a command prompt as a member of the Domain Admins group.

  2. Change the current directory to:

    Program Files\Microsoft ADAM\instancename\data

    where instancename represents the name of the ADAM instance.

  3. At the command prompt, type:

    dnsdomainname

    where dnsdomainname represents the name of the dnsdomainname.bat script file that ADAM Setup created for manually registering service principal names (SPNs) in Active Directory. ADAM uses the DNS domain name of the computer on which ADAM is running to name this file.

Notes

  • To open a command prompt, click Start, point to All programs, point to Accessories, and then click Command prompt.

  • SPN registration does not apply to ADAM instances running on computers that are joined to a workgroup, rather than to a domain.

  • If you do not register the SPNs for an ADAM instance running on a computer that is joined to a domain, you can still run the ADAM instance, but you will not be able to run the ADAM instance as part of a configuration set for which the replication security level has been set to 2. For more information about replication security levels, see Related Topics.

  • The dnsdomainname.bat file appears in the directory approximately one minute after ADAM installation is complete.

  • If the dnsdomainname.bat file does not appear after approximately one minute, the attempt of ADAM setup to register SPNs for the ADAM instance completed successfully.

  • The dnsdomainname.bat file contains repadmin /writespn commands, similar to the commands in the following table.

    repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com"
E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM/netbioshostname:389

repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com"
E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM/dnshostname:389

repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com" ldap/netbioshostname:389

repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com" ldap/dnshostname:389

See Also

  • Administering ADAM service principal names
  • Manually remove ADAM service principal names from Active Directory
  • Repadmin
  • Understanding ADAM replication and configuration sets


Manually remove ADAM service principal names from Active Directory

To manually remove ADAM service principal names from Active Directory

  1. Do one of the following:

    • Log on as a member of the Domain Admins group, and then open ADAM ADSI Edit.

    • Using run as, open ADAM ADSI Edit as a member of the Domain Admins group.

  2. Connect and bind to the domain directory partition of the Active Directory domain in which the ADAM instance resides.

  3. Do one of the following:

    • If the Network Service account is specified as the ADAM service account, navigate to the computer object on the computer on which ADAM is installed.

    • If a domain user account is specified as the ADAM service account, navigate to the domain user object of the domain user account.

  4. Right-click the computer object or the domain user object, and then click Properties.

  5. In Attributes, click ServicePrincipalName, and then click Edit.

  6. For each ADAM value that is listed in Values, click the value, and then click Remove.

Note

  • If service principal names (SPN) in Active Directory exist for the ADAM instance being uninstalled, and adamuninstall cannot remove the SPNs automatically, adamuninstall creates a .bat file that can be used to remove the SPNs manually. This .bat file is located at %windir%\Debug\domain-servicename.bat, where domain represents the Active Directory domain in which the ADAM instance resides, and servicename represents the service name of the ADAM instance being removed. (By default, the service name of an ADAM instance is ADAM_instancename, where instancename is the instance name that you provide during ADAM setup.)

See Also

  • Administering ADAM service principal names
  • Manually register ADAM service principal names in Active Directory
  • Repadmin
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


Manage Replication, Sites, and Configuration Sets

Manage replication, sites, and configuration sets

  • Configure replication frequency within a site

  • Configure replication availability on a site link

  • Add a site object and servers container

  • Move an ADAM instance to a site object

  • Add a site link object

  • Add a site object to a site link object

  • Set the cost on a site link object

  • Delete a site object

  • Identify or transfer the naming master role

  • Modify the replication security level of a configuration set


Configure replication frequency within a site

To configure replication frequency within a site

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of the ADAM instance for which you want to configure the replication schedule.

  3. In the console tree, double-click the connection, double-click the configuration partition, double-click the sites container (CN=Sites), and then click the site container in which the instance resides.

  4. In the details pane, right-click CN=NTDS Site Settings, and then click Schedule.

  5. In the Schedule dialog box, select the block of time that you want to schedule, and then click None, Once per Hour, Twice per Hour, or Four Times per Hour as the replication frequency.

  6. When you are finished updating the schedule, click OK.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to a directory partition on an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • The replication frequency schedule ensures that ADAM instances within a site periodically check with one another to determine if any changes have occurred. Regardless of the replication frequency that is specified, ADAM instances continue to replicate changes through update notifications. For more information, see Related Topics.

See Also

  • Understanding ADAM sites and replication
  • Administering replication and configuration sets
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


Configure replication availability on a site link

To configure replication availability on a site link

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance belonging to the site link for which you want to configure replication availability.

  3. In the console tree, click the configuration directory partition, double-click the sites container (CN=Sites), double-click the Inter-site Transports container (CN=Inter-site Transports), and then click the IP container (CN=IP).

  4. In the details pane, right-click the site link object (by default, CN=DEFAULTIPSITELINK) for which you want to schedule availability, and then click Schedule.

  5. In the Schedule dialog box, select the block of time that you want to schedule, and then click Replication Not Available or Replication Available.

  6. When you are finished updating the schedule, click OK.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to the configuration partition of an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • By default, replication is always available on a given site link.

  • By default, all sites belong to the default site link object (CN=DEFAULTIPSITELINK).

See Also

  • Understanding ADAM sites and replication
  • Administering replication and configuration sets
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


Add a site object and servers container

To add a site object and servers container

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set for which you want to create a site.

  3. In the console tree, double-click the configuration directory partition (CN=Configuration,CN={GUID}), right-click the sites container (CN=Sites), point to New, and then click Object.

  4. In Select a class, click site, and then click Next.

  5. In Value, type a common name (CN) for the new site, and then click Next.

  6. To set values for additional attributes, click More attributes, set any additional attribute values, and then click Finish.

  7. In the console tree, double-click the sites container (CN=Sites).

  8. In the console tree, right-click the new site, point to New, and then click Object.

  9. In Select a class, click serversContainer, and then click Next.

  10. In Value, type a common name (CN) for the server container, and then click Next.

  11. To set values for additional attributes, click More attributes, and then set any additional attribute values.

  12. After setting all desired attributes for the servers container, click Finish.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • To add ADAM instances to a site, the site must have a servers container into which the ADAM instances can be added.

See Also

  • Understanding ADAM sites
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering sites
  • Move an ADAM instance to a site object
  • Add a site object to a site link object


Move an ADAM instance to a site object

To move an ADAM instance to a site object

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set that contains the site object.

  3. In the console tree, double-click the connection, double-click the configuration directory partition, and then double-click the sites container (CN=Sites).

  4. In the sites container, double-click the site containing the ADAM instance that you want to move, and then double-click the servers container of the site.

  5. In the servers container, right-click the ADAM instance that you want to move, and then click Move.

  6. In the Move dialog box, double-click Sites, double-click the site to which you want to move the ADAM instance, click the servers container of the site, and then click OK.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • Before you can move an ADAM instance to a site, the site must have a servers container to which you can move the ADAM instance.

  • The ADAM instance does not appear in its new location until you right-click the destination servers container and then click Refresh.

See Also

  • Understanding ADAM sites
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Add a site object and servers container


Add a site link object

To add a site link object

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set for which you want to create a site link.

  3. In the console tree, double-click the configuration directory partition, double-click the sites container (CN=Sites), and then double-click the Inter-Site Transports container (CN=Inter-Site Transports).

  4. In the Inter-Site Transports container, right-click the IP container (CN=IP), point to New, and then click Object.

  5. In Select a class, click siteLink, and then click Next.

  6. In Value, type a name for the common name (CN) of the new site link object, and then click Next.

  7. In Value, type a distinguished name of a site to be placed in the site link object, and then click Next.

  8. To set more attributes on the site link object, click More attributes.

  9. To create the new site link object, click Finish.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

See Also

  • Understanding ADAM sites
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering sites


Add a site object to a site link object

To add a site object to a site link object

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set in which the site and the site link reside.

  3. In the console tree, double-click the configuration directory partition, double-click the sites container (CN=Sites), and then double-click the Inter-Site Transports container (CN=Inter-Site Transports).

  4. In the console tree, click the IP container (CN=IP).

  5. In the details pane, right-click the site link to which you want to add a site, and then click Properties.

  6. In Attributes, click SiteList, and then click Edit.

  7. In Value to add, type the distinguished name of the site that you want to add to the site link, click Add, and then click OK.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

See Also

  • Understanding ADAM sites
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering sites


Set the cost on a site link object

To set the cost on a site link object

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set in which the site link object that you want to modify resides.

  3. In the console tree, double-click the configuration directory partition, double-click the sites container (CN=Sites), and then double-click the Inter-Site Transports container (CN=Inter-Site Transports).

  4. In the console tree, click the IP container (CN=IP).

  5. In the details pane, right-click the site link for which you want to set the cost, and then click Properties.

  6. In the Properties dialog box, in Attributes, click cost, and then click Edit.

  7. In Value, type a cost for the site link.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • The default cost for a site link is 100.

  • The cost of a site link represents the relative cost of using the site link for replication. The higher the cost of a site link, the lower the preference in ADAM for using the site link for replication.

See Also

  • Understanding ADAM sites
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering sites
  • Add a site link object


Delete a site object

To delete a site object

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set in which the site object resides.

  3. In the console tree, double-click the configuration directory partition, double-click the sites container (CN=Sites), right-click the site that you want to delete, and then click Delete.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

See Also

  • Understanding ADAM sites
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Understanding ADAM sites and replication
  • Administering sites


Identify or transfer the naming master role

To identify or transfer the naming master role

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    dsmgmt

  3. At the dsmgmt: command prompt, type:

    roles

  4. At the fsmo maintenance: command prompt, type:

    connections

  5. At the server connections: command prompt, type:

    connect to server servername:portnumber

    where servername:portnumber is the computer name and communications port number of the ADAM instance that you want to use as the new naming master.

  6. At the server connections: command prompt, type:

    quit

  7. At the fsmo maintenance: command prompt, type:

    transfer naming master

Note

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • For help with dsmgmt, type ? at a dsmgmt prompt.

See Also

  • Administering an ADAM instance
  • Dsmgmt


Modify the replication security level of a configuration set

To modify the replication security level of a configuration set

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the configuration directory partition of an ADAM instance in the configuration set that you want to modify.

  3. In the console tree, double-click the connection.

  4. In the console tree, right-click the configuration directory partition, and then click Properties.

  5. In Attributes, click msDS-ReplAuthenticationMode, click Edit, and then, in the Value box, set the appropriate value (2, 1, or 0).

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to the configuration directory partition of an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • The default replication security level for a new ADAM instance is 1, unless a local workstation user account is specified as the ADAM service account, in which case the replication security level defaults to 0.

  • If the replication security level is set to 2, all replicating ADAM instances must register service principal names (SPNs) in Active Directory. For more information, see Related Topics.

  • The values for msDS-ReplAuthenticationMode and their corresponding replication security levels are described in the following table.

    Replication security level Value Description Default environment

    Mutual authentication required

    2

    Kerberos authentication (using SPNs) is required. If Kerberos authentication fails, the ADAM instances will not replicate.

    The configuration set is fully contained within an Active Directory domain, forest, or forest trust.

    Negotiated

    1

    Kerberos authentication (using SPNs) is attempted first. If Kerberos fails, NTLM authentication is attempted. If NTLM fails, the ADAM instances will not replicate.

    The configuration set contains Windows NT 4.0 member servers.

    Negotiated pass-through

    0

    All ADAM instances in the configuration set must use identical service account names and passwords.

    The configuration set includes computers that are joined to one or more workgroups or to multiple domains or forests without trust relationships.

See Also

  • Understanding ADAM replication and configuration sets
  • Browse the directory tree using ADAM ADSI Edit
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Administering ADAM service principal names


Manage Schemas and Directory Partitions

Manage schemas and directory partitions

  • Install the ADAM Schema snap-in

  • Import or export directory objects using ldifde

  • Import or export directory objects using csvde

  • Manually configure the replication authentication method

  • Deactivate a schema object class or attribute

  • Identify or transfer the schema master role

  • Seize the ADAM schema master role

  • Add a new schema class or attribute definition in ADAM

  • Add an application directory partition

  • Delete an application directory partition


Install the ADAM Schema snap-in

To install the ADAM Schema snap-in

  1. Click Start, click Run, type mmc /a, and then click OK.

  2. On the File menu, click Add/Remove Snap-in, and then click Add.

  3. In Available Standalone Snap-ins, click ADAM Schema, click Add, click Close, and then click OK.

  4. To save this console, on the File menu, click Save.

  5. In Save in, point to the %systemroot%\system32 directory.

  6. In File name, type adamschmmgmt.msc, and then click Save.

  7. To create a shortcut on your Start menu:

    1. Right-click Start, click Open All Users, double-click the Programs folder, and then double-click the ADAM folder.

    2. On the File menu, point to New, and then click Shortcut.

    3. In Type the location of the item, type adamschmmgmt.msc, and then click Next.

    4. In Type a name for this shortcut, type ADAM Schema, and then click Finish.

Caution

  • Modifying the schema is an advanced operation that is best performed by experienced programmers and system administrators. For detailed information about modifying the schema, see the "Active Directory Programmer's Guide" at the Microsoft MSDN Web site.


Import or export directory objects using ldifde

To import or export directory objects using ldifde

  1. Open an ADAM tools command prompt.

  2. Do one of the following:

    • To import directory objects, at the command prompt, type:

      ldifde -i -f filename -s servername:port -m -a username domain password

    • To export directory objects, at the command prompt, type:

      ldifde -e -f filename -s servername:port -m -a username domain password

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • The following table contains the parameters in step 2 and other commonly used ldifde parameters. For more information about ldifde parameters, type ldifde /? at a command prompt, or see Related Topics.

    Parameter Description

    -i

    Perform an import.

    -e

    Perform an export.

    -f

    File to import or export.

    -s

    Host name and port of the ADAM instance.

    -m

    Ignore (that is, do not import or export) attributes that are only used by Active Directory.

    You can use this parameter when exporting directory objects from an existing Active Directory forest and importing them into ADAM.

    -a

    Account credentials. If they are not provided, ldifde uses the credentials of the currently logged on user.

    -h

    Allows importing of passwords using simple authentication and security layer (SASL) encryption.

    -c String1 String2

    Replaces all occurrences of String1 with String2. With ADAM, you can use the constants #schemaNamingContext and #configurationNamingContext in place of the distinguished names of the schema directory partition and configuration directory partitions when replacing strings in .ldf files.

  • For specific information about importing the user class definitions that are supplied with ADAM, see Related Topics.

  • For complete syntax information for the ldifde command, see Related Topics.

See Also

  • Import the user classes supplied with ADAM
  • ADAM Ldifde
  • ADAM Csvde


Import or export directory objects using csvde

To import or export directory objects using csvde

  1. Open an ADAM tools command prompt.

  2. Do one of the following:

    • To import directory objects, at the command prompt, type:

      csvde -i -f filename -s servername:port -m -a username domain password

    • To export directory objects, at the command prompt, type:

      csvde -e -f filename -s servername:port -m -a username domain password

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • The following table contains the parameters in step 2 and other commonly used csvde parameters. For more information about csvde parameters, type csvde /? at a command prompt, or see Related Topics.

    Parameter Description

    -i

    Perform an import.

    -e

    Perform an export.

    -f

    File to import.

    -s

    Host name and port of the ADAM instance.

    -m

    Ignore (that is, do not import or export) attributes that are only used by Active Directory.

    You can use this parameter when exporting directory objects from an existing Active Directory forest and importing them into ADAM.

    -a

    Account credentials. If they are not provided, ldifde uses the credentials of the currently logged on user.

    -h

    Allows importing of passwords using simple authentication security layer (SASL) encryption.

    -c String1 String2

    Replaces all occurrences of String1 with String2. With ADAM, you can use the constants #schemaNamingContext and #configurationNamingContext in place of the distinguished names of the schema directory partition and configuration directory partitions when replacing strings within .ldf files.

  • For specific information about importing the user class definitions that are supplied with ADAM, see Related Topics.

  • For complete syntax information for the csvde command, see Related Topics.

See Also

  • Import the user classes supplied with ADAM
  • ADAM Ldifde
  • ADAM Csvde


Manually configure the replication authentication method

To manually configure the replication authentication method

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the ADAM instance in the configuration set that you want to configure.

  3. In the console tree, double-click the configuration directory partition.

  4. In the console tree, right-click the configuration directory partition, and then click Properties.

  5. In Attributes, click msDS-ReplAuthenticationMode, click Edit, and then do one of the following:

    • To force the use of service accounts for replication authentication between configuration set members, type 1 in the Value box, and then click OK.

    • To allow ADAM to automatically determine how replication authentication occurs between configuration set members, type 0 in the Value box, and then click OK.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • For information about how ADAM configures replication authentication between configuration set members, see Related Topics.

See Also

  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering replication and configuration sets


Deactivate a schema object class or attribute

To deactivate a schema object class or attribute

  1. Open ADAM Schema.

  2. In the console tree, click ADAM Schema.

  3. On the Action menu, click Change ADAM Server.

  4. In ADAM server, specify the DNS name, network basic input/output system (NetBIOS) name, or Internet Protocol (IP) address of the computer on which the ADAM instance that you want to configure is running.

  5. In Port, type the Lightweight Directory Access Protocol (LDAP) or Secure Sockets Layer (SSL) port number of the ADAM instance to which you want to connect.

  6. Under Connect using these credentials, do one of the following, and then click OK:

    • Click The account of the currently logged on user.

    • Click This account, and then select or type the user name and password of the account with which you want to connect.

  7. Do one of the following, depending on whether you want to deactivate an object class or an attribute:

    • To deactivate an object class, in the console tree, double-click ADAM Schema, and then click Classes. In the details pane, right-click the class that you want to deactivate, and then click Properties.

    • To deactivate an attribute, in the console tree, double-click ADAM Schema, and then click Attributes. In the details pane, right-click the attribute that you want to deactivate, and then click Properties.

  8. On the General tab, clear the Class is active check box or the Attribute is active check box, click Yes to confirm that you want to deactivate the class or attribute, and then click OK.

Notes

  • To open the ADAM Schema snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM Schema.

  • If the ADAM Schema snap-in is not installed, see Related Topics.

See Also

  • Install the ADAM Schema snap-in
  • Understanding ADAM schema
  • Administering the ADAM schema


Identify or transfer the schema master role

To identify or transfer the schema master role

  1. Open ADAM Schema.

  2. On the Action menu, click Change ADAM Server.

  3. In ADAM server, specify the DNS name, network basic input/output system (NetBIOS) name, or Internet Protocol (IP) address of an ADAM instance in the configuration set for which you want to identify or transfer the schema master role.

  4. In Port, type the Lightweight Directory Access Protocol (LDAP) port number of the ADAM instance to which you want to connect.

  5. Under Connect using these credentials, do one of the following, and then click OK:

    • Click The account of the currently logged on user.

    • Click This account, and then select or type the user name and password of the account with which you want to connect.

  6. In the console tree, right-click ADAM Schema, and then click Operations Master.

  7. Do one of the following:

    • To identify the current schema master, note the ADAM instance that is listed in Current Schema Master.

    • To transfer the schema master role to the currently targeted ADAM instance, click Change.

Notes

  • To open the ADAM Schema snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM Schema. If the ADAM Schema snap-in is not installed, see Related Topics.

  • Each configuration set has only one schema master. To identify the schema master in a different configuration set, target the appropriate configuration set before clicking Operations Master.

  • For help with dsmgmt, type ? at a dsmgmt prompt.

See Also

  • Install the ADAM Schema snap-in
  • Understanding ADAM schema
  • Dsmgmt
  • Administering an ADAM instance
  • Administering the ADAM schema


Seize the ADAM schema master role

To seize the schema master role

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    dsmgmt

  3. At the dsmgmt: command prompt, type:

    roles

  4. At the fsmo maintenance: command prompt, type:

    connections

  5. At the server connections: command prompt, type:

    connect to server computername:portnumber

    where computername:portnumber is the computer name and communications port number of the ADAM instance that you want to use as the new schema master.

  6. At the server connections: command prompt, type:

    quit

  7. At the fsmo maintenance: command prompt, type:

    seize schema master

Caution

  • Do not seize the schema master role if you can transfer it instead. Seizing the schema master role is a drastic step that should be considered only if the current operations master will never be available again. For more information about transferring operations master roles, see Related Topics.

Note

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • For help with dsmgmt, type ? at a dsmgmt prompt.

See Also

  • Install the ADAM Schema snap-in
  • Understanding ADAM schema
  • Dsmgmt
  • Administering an ADAM instance
  • Identify or transfer the schema master role
  • Administering the ADAM schema


Add a new schema class or attribute definition in ADAM

To add a new schema class or attribute definition

  1. Open ADAM Schema.

  2. In the console tree, double-click ADAM Schema.

  3. Do one of the following:

    • To add a class definition, in the console tree, right-click Classes, click Create Class, and then provide the requested information.

    • To add an attribute definition, in the console tree, right-click Attributes, click Create Attribute, and then provide the requested information.

Notes

  • To open the ADAM Schema snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM Schema.

  • If the ADAM Schema snap-in is not installed, see Related Topics.

See Also

  • Install the ADAM Schema snap-in
  • Understanding ADAM schema


Add an application directory partition

To add an application directory partition

  1. Connect and bind to an ADAM instance with ADAM Ldp.exe.

  2. On the Browse menu, click Add child.

  3. In Dn, type a distinguished name for the application partition.

  4. Under Edit entry, type ObjectClass in the Attribute box and container in the Values box, and then click Enter.

  5. Under Edit entry, type instanceType in the Attribute box and 5 in the Values box, and then click Enter.

  6. Click Run.

    After the new application directory partition is added, the following appears in the results pane:

    Added {distinguished name}

    where distinguished name is the distinguished name that you typed in step 3.

  7. Click Close.

Notes

  • To connect and bind to an ADAM instance with Ldp.exe, see Related Topics.

  • Application directory partitions can be of any object class, but they must have a value of 5 for the instanceType attribute.

See Also

  • Connect and bind to an ADAM instance using Ldp.exe
  • Understanding ADAM data and data stores
  • Ldp


Delete an application directory partition

To delete an application directory partition

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the ADAM instance.

  3. Double-click the configuration directory partition (CN=Configuration,CN={GUID}).

  4. In the console tree, click the partitions container (CN=Partitions).

  5. In the details pane, right-click the application directory partition that you want to delete, and then click Delete.

Caution

  • The only way to retrieve a deleted application directory partition is to restore the entire ADAM instance from a backup copy that was made before the deletion of the partition.

Notes

  • To start the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

See Also

  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


Manage Users and Groups

Manage users and groups

  • Import the user classes supplied with ADAM

  • Add an ADAM user to the directory

  • Add an ADAM group to the directory

  • Add or remove members to or from an ADAM group

  • Disable or enable an ADAM user

  • Set or modify the password of an ADAM user

  • Add an organizational unit to the directory

  • Allow ADAM users to be created in the configuration partition


Import the user classes supplied with ADAM

To import the user classes supplied with ADAM

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    ldifde -i -f filename -s computername:port [-b username domain password] -k -j . -c "CN=Schema,CN=Configuration,DC=X" #schemaNamingContext

    where filename represents the name of one of the .ldf files that is supplied with ADAM (ms-User.ldf, ms-InetOrgPerson.ldf, or ms-UserProxy.ldf), computername:port represents the computer name and port number of an ADAM instance, and username domain password represents the account with which to run the command.

    You should see results similar to the following:

    Connecting to "localhost"
Logging in as current user using SSPI
Importing directory from file "ms-user.ldf"
Loading entries................................
65 entries modified successfully.

The command has completed successfully

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • The following table contains the parameters in step 2 and other commonly used ldifde parameters. For more information about ldifde parameters, type ldifde /? at a command prompt, or see Related Topics.

    Parameter Description

    -i

    Perform an import.

    -f

    File to import or export.

    -s

    Host name and port of the ADAM instance.

    -b

    Security credentials to use during the operation.

    -k

    Continue the operation in the event of errors.

    -j

    Create a log file in the specified directory. In this case, the current (".") directory.

    -c "CN=Schema,CN=Configuration,DC=X" #schemaNamingContext

    Do not modify this string.

    The -c parameter replaces a specified string in the .ldf file with a different string during import. The distinguished name that is specified in the .ldf file (for example, CN=Schema,CN=Configuration,DC=X) is replaced with the distinguished name of the schema directory partition for your particular ADAM instance, as passed by the #schemaNamingContext constant.

    Replace ... With ...

    computername:port

    The host name and port number of your ADAM instance. You can use "localhost" for computername if you are administering the local computer.

    username domain password

    The account, domain, and password of an account being used as an ADAM administrator account.
  • ADAM includes three .ldf files containing user classes that you can import. These files are ms-User.ldf, ms-InetOrgPerson.ldf, and ms-UserProxy.ldf, and they are located in the %windir%\adam directory.

  • As an alternative to using ldifde, you can import the optional ADAM user classes during ADAM setup. For more information, see Related Topics.

  • If you do not specify user credentials using the -b parameter, ldifde uses the credentials of the currently logged on user.

  • For complete syntax information for the ldifde command, see Related Topics.

See Also

  • Understanding ADAM users and groups
  • ADAM Ldifde
  • Importing LDIF files during setup


Add an ADAM user to the directory

To add an ADAM user to the directory

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the ADAM instance and directory partition to which you want to add the user.

  3. In the console tree, double-click the directory partition to which you want to add the user.

  4. In the console tree, right-click the container to which you want to add a user, point to New, and then click Object.

  5. In Select a class, click the class that you want to use (user, inetOrgPerson, person, or OrganizationalPerson), and then click Next.

  6. In Value, type a value for the common name (CN) attribute of the new user, and then click Next.

  7. If you want to set values for additional attributes, click More attributes.

  8. After setting any additional attributes for the new user, click Finish.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • By default, an ADAM user account is enabled when the user account is created. However, no initial password is set on an ADAM user account that is created using ADAM ADSI Edit. On ADAM instances running on Windows Server 2003, where local or domain password policy restrictions are in effect, the ADAM user account is disabled by default. Before you can enable the user account, you must set a password for it that meets the password policy restrictions that are in effect. This does not apply to ADAM instances running on Windows XP Professional. For more information, see Related Topics.

  • Any object class can be used as a security principal in ADAM, if the object class definition contains the SecurityPrincipal static auxiliary class and the unicodePwd attribute. For more information, see Related Topics.

  • The user, inetOrgPerson, and OrganizationalPerson object classes are not available until you import the ADAM user class definitions into the schema. For more information, see Related Topics.

See Also

  • Import the user classes supplied with ADAM
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering users and groups
  • Set or modify the password of an ADAM user


Add an ADAM group to the directory

To add an ADAM group to the directory

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the ADAM instance to which you want to add a group.

  3. In the console tree, double-click the directory partition to which you want to add the group.

  4. In the console tree, right-click the container to which you want to add the group, point to New, and then click Object.

  5. In Select a class, click Group, and then click Next.

  6. In Value, type a common name (CN) for the new group, and then click Next.

  7. In groupType, type 2147483650 (representing an account group) for the new group, and then click Next.

  8. If you want to set values for additional attributes, click More attributes.

  9. After setting all desired attributes for the new group, click Finish.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • When you type a value for the groupType attribute, 2147483650 (equivalent to 0x80000002 hexidecimal) represents a group type of "account."

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

See Also

  • Understanding ADAM users and groups
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


Add or remove members to or from an ADAM group

To add or remove members to or from an ADAM group

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the ADAM instance containing the group that you want to modify.

  3. In the console tree, double-click the directory partition containing the group that you want to modify.

  4. Right-click the group that you want to modify, and then click Properties.

  5. In Attributes, click Member, and then click Edit.

  6. For each ADAM security principal that you want to add to the group, click Add ADAM account, type the distinguished name of the new member, and then click OK.

  7. For each Windows security principal you want to add to the group, click Add Windows account, type the account name of the new member, and then click OK.

  8. For each group member that you want to remove from the group, click the member that you want to remove, and then click Remove.

  9. After making the changes that you want to the group, click OK twice.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

See Also

  • Understanding ADAM users and groups
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • ADAM ADSI Edit


Disable or enable an ADAM user

To disable or enable an ADAM user

  1. Open ADAM ADSI Edit.

  2. Connect and bind to an ADAM instance.

  3. Browse to the ADAM user that you want to disable or enable, right-click that user, and then click Properties.

  4. In Attributes, click msDS-UserAccountDisabled, and then click Edit.

  5. Do one of the following, and then click OK:

    • To disable the ADAM user, click True.

    • To enable the ADAM user, click either False or Not set.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • To connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • By default, an ADAM user is enabled when the user is created. However, if you assign a new ADAM user a password that does not meet the password policy restrictions in effect on the local server or domain, that ADAM user will be disabled by default. This note does not apply to ADAM instances running on Windows XP Professional. For more information, see Related Topics.

  • If the ADAM user that you want to disable or enable is currently logged on to the ADAM instance, that user must log off for the new setting to take effect.

See Also

  • Understanding ADAM users and groups
  • Import the user classes supplied with ADAM
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit
  • Administering users and groups


Set or modify the password of an ADAM user

Set or modify the password of an ADAM user

  • Using ADAM ADSI Edit

  • Using Ldp over an encrypted, non-SSL connection

  • Using Ldp over an SSL connection

Using ADAM ADSI Edit

To set or modify the password of an ADAM user

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the directory partition containing the ADAM user for whom you want to set or modify the password.

  3. Browse to the directory object representing the ADAM user, and then right-click the directory object.

  4. Click Reset password, and then type a password for the user in New password and in Confirm password.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • For information about how to connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

Using Ldp over an encrypted, non-SSL connection

To set or modify the password of an ADAM user

  1. Open Ldp.

  2. On the Options menu, click Connection Options.

  3. In Option Name, click LDAP_OPT_ENCRYPT.

  4. In Value, type 1, click Set, and then click Close.

  5. Connect and bind to the ADAM instance, and then view the directory partition containing the ADAM user for whom you want to set a password.

  6. Right-click the ADAM user, and then click Modify.

  7. In Attribute, type userpassword, and then in Value, type a password for the account.

  8. Click Enter, and then click Run. The details pane displays a message similar to the following:

    ***Call Modify...
ldap_modify_s(ld, 'CN=Mary Baker,O=Microsoft,C=US',[1] attrs);
Modified "CN=Mary Baker,O=Microsoft,C=US".

Notes

  • To open Ldp, click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then type ldp at the command prompt.

  • You can also use ADAM ADSI Edit to set or modify passwords: right-click the directory object representing the ADAM security principal in ADAM ADSI Edit, and then click Reset Password.

  • For information about how to connect and bind to an ADAM instance using Ldp, see Related Topics.

  • By default, an ADAM instance running on Windows Server 2003 automatically enforces any local or domain password policies. If you set a password for an ADAM user that does not meet the requirements of the password policy in effect, the user account will be disabled.

  • The ADAM user for whom you set or modify the password must use the new password the next time that the user logs on.

  • This procedure applies to any object class that is used as a security principal in ADAM. Any object class in ADAM can be used as a security principal, as long as the object class definition contains the msDS-bindableobject auxiliary class and the unicodePwd attribute. For more information, see Related Topics.

  • The user, person, inetOrgPerson, and OrganizationalPerson object classes are not available by default in the ADAM schema. You must first import them. For more information, see Related Topics.

Using Ldp over an SSL connection

To set or modify the password of an ADAM user

  1. Install a server certificate on the computer where the ADAM instance is running, and install a matching client certificate on the computer from which you administer the ADAM instance.

  2. Open Ldp.

  3. Connect and bind to the ADAM instance (selecting SSL in the Connect dialog box) containing the user for whom you want to set or modify a password.

  4. Right-click the ADAM user, and then click Modify.

  5. In Attribute, type userpassword, and then in Value, type a password for the account.

  6. Click Enter, and then click Run. The details pane displays a message similar to the following:

    ***Call Modify...
ldap_modify_s(ld, 'CN=Mary Baker,OU=Beta
users,O=Microsoft,C=US',[1] attrs);
Modified "CN=Mary Baker,OU=Beta users,O=Microsoft,C=US".

Notes

  • To open Ldp, click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then type ldp at the command prompt.

  • For information about how to connect and bind to an ADAM instance using Ldp, see Related Topics.

  • Establishing Secure Sockets Layer (SSL) connections requires the presence of certificates on the server and clients. For information about installing certificates, see Related Topics.

  • By default, an ADAM instance running on Windows Server 2003 automatically enforces any local or domain password policies. If you set a password for an ADAM user that does not meet the requirements of the password policy in effect, the user account will be disabled.

  • If the ADAM user is currently logged on, that user must log off for the new password to take effect.

  • This procedure applies to any object class that is used as a security principal in ADAM. Any object class in ADAM can be used as a security principal, as long as the object class definition contains the SecurityPrincipal static auxiliary class and the unicodePwd attribute. For more information, see Related Topics.

  • The user, person, inetOrgPerson, and OrganizationalPerson object types are not available by default in the ADAM schema. You must first import them. For more information, see Related Topics.

See Also

  • Understanding ADAM users and groups
  • Import the user classes supplied with ADAM
  • Administering an ADAM instance
  • Connect and bind to an ADAM instance using Ldp.exe
  • Connect and bind to an ADAM instance using ADAM ADSI Edit


Add an organizational unit to the directory

To add an organizational unit to the directory

  1. Open ADAM ADSI Edit.

  2. Connect and bind to the directory partition of the ADAM instance to which you want to add an organizational unit (OU).

  3. In the console tree, double-click the directory partition, right-click the container to which you want to add the OU, point to New, and then click Object.

  4. In Select a class, click organizationalUnit, and then click Next.

  5. In Value, type a name for the new OU, and then click Next.

  6. If you want to set values for additional attributes, click More attributes.

  7. After you set all desired attributes for the new OU, click Finish.

Notes

  • To open the ADAM ADSI Edit snap-in, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

  • To connect and bind to an ADAM instance using ADAM ADSI Edit, see Related Topics.

  • By default, OUs can only be added under OU (OU=), country/region (C=), organization (O=) or domain-DNS (DC=) object classes. For example, you can add an OU to o=Microsoft,c=US. You cannot add an OU to cn=test,o=Microsoft,c=US. You can, however, update the schema definition of the OU object class to allow other superiors.

See Also

  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


Allow ADAM users to be created in the configuration partition

You can use this procedure to allow users to be created in the configuration partition so that Active Directory Application Mode (ADAM) users can be ADAM administrators.

To allow ADAM users to be created in the configuration partition

  1. Click Start, point to Programs, point to ADAM, and then click ADAM ADSI Edit.

  2. Double-click the CN=Configuration,CN=Guid container.

  3. Double-click the CN=Services object, and then double-click the CN=Windows NT object.

  4. Right-click CN=Directory Service, and then click Properties.

  5. In the Attributes list, click msDS-Other-Settings, and then click Edit.

  6. In the Values list, click each value that contains the text ADAMAllowADAMSecurityPrincipalsInConfigPartition=0, and then click Remove.

  7. In the Value to add box, type the following:

    ADAMAllowADAMSecurityPrincipalsInConfigPartition=1, and then click Add.

  8. Click OK two times, and then close ADAM ADSI Edit.


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

Manage Access Control

Manage access control

  • View or set permissions on a directory object


View or set permissions on a directory object

To view or set permissions on a directory object

  1. Open an ADAM tools command prompt.

  2. At the command prompt, do one of the following:

    • To list the effective permissions on a directory object, type:

      dsacls \\ hostname:portnumber\object_dn

      where hostname represents the name of the computer on which the ADAM instance that holds the directory object is running, portnumber represents the communications port number on which the ADAM instance communicates, and object_dn represents the distinguished name of the directory object.

      Example:

      dsacls \\localhost:389\O=Microsoft,C=US

    • To grant permissions on a directory object, type:

      dsacls \\ hostname:portnumber \ object_dn /G user_or_group:Permissions

      where hostname represents the name of the computer on which the ADAM instance that holds the directory object is running, portnumber represents the communications port number on which the ADAM instance communicates, object_dn represents the distinguished name of the directory object, user_or_group represents the user or group for whom the permissions apply, and Permissions represents the permissions to grant.

      Example:

      dsacls \\localhost:389\cn=Object1, cn=container1,O=Microsoft,C=US /G CN=inetuser1,O=Microsoft,C=US:SD

    • To deny permissions on a directory object, type:

      dsacls \\ hostname:portnumber \ object_dn /D user_or_group:PermissionStatement

      where hostname represents the name of the computer on which the ADAM instance that holds the directory object is running, portnumber represents the communications port number on which the ADAM instance communicates, object_dn represents the distinguished name of the directory object, user_or_group represents the user or group for whom the permissions apply, and PermissionStatement represents the permissions to deny.

      Example:

      dsacls \\localhost:389\cn=Object1, cn=container1,O=Microsoft,C=US /D CN=inetuser1,O=Microsoft,C=US:SD

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • For a complete description of all parameters that apply to dsacls, including the setting of inheritance, type dsacls /? at the ADAM tools command prompt, or see Related Topics.

  • A directory object residing on multiple replicas of a given directory partition possesses the same permissions on all of the replica partitions.

See Also

  • Understanding ADAM access control
  • Understanding ADAM users and groups
  • Dsacls


Monitor and Maintain ADAM

Monitor and maintain ADAM

  • Back up an ADAM instance to a file or a tape

  • Restore an ADAM instance

  • View an ADAM event log


Back up an ADAM instance to a file or a tape

Back up an ADAM instance to a file or a tape

  • Using the graphical user interface

  • Using the command prompt

Using the graphical user interface

To back up an ADAM instance to a file or a tape

  1. Open Backup.

    The Backup or Restore Wizard starts by default, unless it is disabled. You can use this wizard, or you can go to the next step to work in Advanced Mode.

  2. In the Backup or Restore Wizard, click the link for Advanced Mode.

  3. Click the Backup tab, and then, on the Job menu, click New.

  4. To select the ADAM instance folders that you want to back up, select the check box to the left of the folders. By default, ADAM files are located in the directories in the following table.

    Directory Contents

    \%ProgramFiles%\Microsoft ADAM\instancename

    where instancename equals the ADAM instance name

    Database files and log files

    \%windir%\ADAM

    Program files and administration tools

  5. In Backup destination, do one of the following:

    • If you want to back up files and folders to a file, click File.

    • If you want to back up files and folders to a tape, select a tape device.

    If no tape drive exists, the Backup destination option is unavailable, and it is automatically set to File.

  6. In Backup media or file name, do one of the following:

    • If you are backing up files and folders to a file, type a path and file name for the backup (.bkf) file, or click the Browse button to find a file.

    • If you are backing up files and folders to a tape, select the tape that you want to use.

  7. To select any other backup options that you want, such as the backup type and the backup log type, on the Tools menu, click Options.

  8. Click Start Backup, and then make any changes in the Backup Job Information dialog box.

  9. If you want to set advanced backup options, such as data verification or hardware compression, click Advanced.

  10. Click Start Backup to start the backup operation.

Caution

  • If you have backed up data from an NTFS volume, it is recommended that you restore the data to an NTFS volume of the same version to prevent losing data.

Notes

  • To start Backup, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.

  • If Backup does not start in wizard mode by default, you can start the wizard by clicking Wizard Mode on the Welcome tab.

  • Some tape drives may not support hardware compression.

  • Backup does not support the use of backup media such as CD-RW (compact disc rewritable), CD-R (compact disc recordable), and DVD-R (digital video disc recordable). To save backups to this type of media, back up to a file, and then copy that file to the CD. You can use Backup to restore from a CD.

  • Backup files usually have the file name extension .bkf. You can use any extension you like, but it is highly recommended that you use .bkf, which has file associations that ensure that the backup file is recognizable.

  • Backup operators and administrators can back up and restore encrypted files and folders without decrypting the files or folders.

  • When you back up ADAM instances on Windows XP Professional, you can back up only one ADAM instance at a time.

Using the command prompt

To back up an ADAM instance to a file or a tape

  1. Open Command Prompt.

  2. To back up to a file or tape, type:

    ntbackup backup @bks file name /J {"backup job name"} /F {"file name"} /T {"tape name"} /P {"pool name"} /G {"guid name"} /N {"media name"} /A

Value | Description
@bks file name | The name of the backup selection file (.bks file) to be used for this backup operation. The @ character must precede the name of the backup selection file. A backup selection file contains information about the files and folders that you have selected for backup. You have to create the file using the graphical user interface (GUI) version of Backup. As an alternative, you can supply the path to the drive or file to back up, for example, D:\.
/J {"backup job name"} | The job name to be used in the backup report. The job name usually describes the files and folders that you are backing up in the current backup job.
/F {"file name"} | The logical disk path and file name of the backup file. Do not use in conjunction with /P /G /T.
/T {"tape name"} | Overwrites or appends to this tape.
/P {"pool name"} | The media pool from which you want to use media. This is usually a subpool of the Backup media pool, such as 4mm DDS. Do not use in conjunction with /A /G /F /T
/G {"guid name"} | Overwrites or appends to this tape. Do not use in conjunction with /P.
/N {"media name"} | The new tape name. Do not use in conjunction with /A.
/A | Performs an append operation. Either /G or /T must be used in conjunction with this switch. Do not use in conjunction with /P.

For information about additional file and tape backup options, see the Help topic on the ntbackup command-line utility in Help and Support Center in Windows Server 2003.

Examples:

To back up the files and folders that are listed in the backup selection file C:\adaminstance.bks to file C:\backup.bkf, with the job name "Backup Job 1," type the following at the command line:

ntbackup backup @C:\adaminstance.bks /j "Backup Job 1" /f "C:\Backup.bkf"

For a tape backup, to create a backup job named "Backup Job 1" that backs up all the files and folders that are listed in the backup selection file C:\backup.bks to a tape drive, type:

ntbackup backup @C:\backup.bks /n "Media created 11/5/2003 at 1:25 PM" /d "Set created 11/5/2003 at 1:25 PM" /j "Backup Job 1" /p "4mm DDS"

Important

  • If you do not specify options at the command prompt, the options default to the values that are specified in the Backup application.

  • Before you use the command line to perform backup operations, it is recommended that you use the Backup GUI to create the initial backup selection file and settings and a scheduled task. You can then use that scheduled task to view the command syntax. Copy the information from the scheduled task, make any changes that are necessary to create a script or command-line syntax, and then delete the scheduled task if it is not needed.

  • Some tape drives may not support hardware compression.

Notes

  • To view the complete syntax for this command, at a command prompt, type:

    ntbackup /?

  • If you do not specify the other Backup options, ntbackup uses the default values of the Backup program for the backup type, verification setting, logging level, hardware compression, and any other settings.

  • Backup files usually have the file name extension .bkf. You can use any extension that you want, but it is highly recommended that you use .bkf, which has file associations that ensure that the backup file is recognizable.

  • Backup operators and administrators can back up and restore encrypted files and folders without decrypting the files or folders.


Restore an ADAM instance

Restore an ADAM instance

  • Restore ADAM data on an ADAM instance that belongs to a configuration set

  • Restore a corrupted database that is preventing the ADAM instance from starting

  • Restore an ADAM instance that does not belong to a configuration set

  • Restore an ADAM instance that belongs to a configuration set

Restore ADAM data on an ADAM instance that belongs to a configuration set

To authoritatively restore ADAM data on an ADAM instance that belongs to a configuration set

  1. If it is running, stop the ADAM instance for which data will be restored.

  2. Open Backup.

    The Backup or Restore Wizard starts by default, unless it is disabled. You can use this wizard, or click the Advanced Mode link to work in advanced mode.

  3. Click the Restore and Manage Media tab.

  4. In the details pane, select the ADAM instance that you want to restore by selecting the check box to the left of the folder that represents the ADAM instance that you want to restore.

  5. In Restore files to, click Original location.

  6. On the Tools menu, click Options, click the Restore tab, click Always replace the file on my computer, and then click OK.

  7. Click Start Restore.

  8. After the restore is complete, close Backup.

  9. Open an ADAM tools command prompt.

  10. At the command prompt, type:

    dsdbutil

  11. At the dsdbutil: prompt, type:

    activate instance instancename

    where instancename represents the service name of the ADAM instance on which you want to restore data.

  12. At the dsdbutil: prompt, type:

    authoritative restore

  13. At the authoritative restore: prompt, type one of the commands in the following table.

    Command Meaning

    restore database

    Performs authoritative restore of the entire directory database

    restore object dn

    Performs authoritative restore of the directory object whose distinguished name is represented by dn

    restore subtree dn

    Performs authoritative restore of the directory subtree whose distinguished name is represented by dn

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • To start Backup, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.

  • If Backup does not start in wizard mode by default, you can start the wizard by clicking Wizard Mode on the Welcome tab.

  • For information about stopping an ADAM instance, see Related Topics.

  • This procedure can be used if you want the data being restored to authoritatively override existing data in the configuration set.

  • For more information about the authoritative restore command in dsdbutil, at the authoritative restore: prompt, type ?.

  • When you restore ADAM instances on Windows XP Professional, you can restore only one ADAM instance at a time.

  • If you accidentally start a restore of an ADAM instance over a currently running ADAM instance, it is recommended that you immediately restart the computer, stop the ADAM instance, and then perform the restoration again.

Restore a corrupted database that is preventing the ADAM instance from starting

To restore a corrupted database that is preventing the ADAM instance from starting

  1. If it is running, stop the ADAM instance for which data will be restored.

  2. Open Backup.

    The Backup or Restore Wizard starts by default, unless it is disabled. You can use this wizard, or click the Advanced Mode link to work in advanced mode.

  3. Click the Restore and Manage Media tab.

  4. In the details pane, select the ADAM instance that you want to restore by selecting the check box to the left of the folder that represents the ADAM instance that you want to restore.

  5. In Restore files to, click Original location.

  6. On the Tools menu, click Options, click the Restore tab, click Always replace the file on my computer, and then click OK.

  7. Click Start Restore.

  8. After the restore is complete, close Backup.

  9. Restart the ADAM instance.

Notes

  • To start Backup, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.

  • If Backup does not start in wizard mode by default, you can start the wizard by clicking Wizard Mode on the Welcome tab.

  • If the ADAM instance fails to start after you perform this procedure, perform the appropriate procedure for completely restoring an ADAM instance, depending on whether your ADAM instance belongs to a configuration set or is unique.

  • When you restore ADAM instances to Windows XP Professional, you can restore only one ADAM instance at a time.

  • If you accidentally start a restore of an ADAM instance over a currently running ADAM instance, it is recommended that you immediately restart the computer, stop the ADAM instance, and then perform the restoration again.

Restore an ADAM instance that does not belong to a configuration set

To completely restore an ADAM instance that does not belong to a configuration set

  1. Using the Active Directory Application Mode Setup Wizard or an ADAM unattended install, reinstall the ADAM program files, specifying the same settings that you used during your original ADAM installation. However, do not create an application directory partition during setup.

  2. Open Backup.

    The Backup or Restore Wizard starts by default, unless it is disabled. You can use this wizard, or click the Advanced Mode link to work in advanced mode.

  3. Click the Restore and Manage Media tab.

  4. In the details pane, select the ADAM instance that you want to restore by selecting the check box to the left of the folder that represents the ADAM instance that you want to restore.

  5. In Restore files to, click Original location.

  6. On the Tools menu, click Options, click the Restore tab, click Always replace the file on my computer, and then click OK.

  7. Click Start Restore.

  8. After the restore is complete, close Backup.

Notes

  • To start Backup, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.

  • If Backup does not start in wizard mode by default, you can start the wizard by clicking Wizard Mode on the Welcome tab.

  • For information about backing up an ADAM instance, see Related Topics.

  • When you restore ADAM instances to Windows XP Professional, you can restore only one ADAM instance at a time.

  • If you accidentally start a restore of an ADAM instance over a currently running ADAM instance, it is recommended that you immediately restart the computer, stop the ADAM instance, and then perform the restoration again.

Restore an ADAM instance that belongs to a configuration set

To completely restore an ADAM instance that belongs to a configuration set

  1. On one of the remaining ADAM instances in the configuration set, delete the server object representing the ADAM instance that you want to restore, as follows:

    1. Open an ADAM tools command prompt.

    2. At the command prompt, type dsmgmt.

    3. At the dsmgmt: prompt, type metadata cleanup.

    4. At the metadata cleanup: prompt, type select operation target.

    5. At the select operation target: prompt, type connections.

    6. At the server connections: prompt, type connect to server computername:portnumber, where computername:portnumber represents the ADAM instance to which you are connecting.

    7. At the server connections: prompt, type q.

    8. At the select operation target: prompt, type list sites, and identify the number corresponding to the site in which the server object that you want to delete resides.

    9. At the select operation target: prompt, type select site n, where n represents the number identified in the previous step.

    10. At the select operation target: prompt, type list naming contexts, and identify the number that corresponds to a naming context previously held by the server whose server object you want to delete.

    11. Type select naming context n, where n represents the number identified in the previous step.

    12. Type list servers in site, and identify the number that is associated with the server whose server object you want to delete.

    13. Type select server n, where n represents the number identified in the previous step.

    14. At the select operation target: prompt, type q.

    15. At the metadata cleanup: prompt, type remove selected server, and then click yes to confirm the deletion of the server object.

    16. In addition, you must delete the server object from the sites container:

      CN=Servers, CN=sitename, CN=Sites, CN=Configuration, CN={GUID}

      where sitename represents the name of the site in which the server object exists, and GUID represents the globally unique identifier (GUID) of the ADAM instance.

  2. When you complete the previous steps, install an ADAM replica from media.

Notes

  • To start Backup, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.

  • If Backup does not start in wizard mode by default, you can start the wizard by clicking Wizard Mode on the Welcome tab.

  • For information about backing up an ADAM instance, see Related Topics.

  • For help with dsmgmt, type ? at a dsmgmt prompt.

  • If you accidentally start a restore of an ADAM instance over a currently running ADAM instance, it is recommended that you immediately restart the computer, stop the ADAM instance, and then perform the restoration again.

  • For information about installing an ADAM replica from media, see Related Topics.

See Also

  • Back up an ADAM instance to a file or a tape
  • Install an ADAM replica from media
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Browse the directory tree using ADAM ADSI Edit


View an ADAM event log

To view an ADAM event log

  1. Open Event Viewer.

  2. In the console tree, click the ADAM log that you want to view.

  3. In the details pane, view the list of individual events.

  4. If you want to see more details about a specific event, in the details pane, double-click the event.

Notes

  • To open Event Viewer, click Start, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.

  • To refresh the view in Event Viewer, on the Action menu, click Refresh. When you open a log, Event Viewer displays the current information for the log. While you view the log, the display is not updated unless you refresh the Event Viewer window. If you switch to another log and then return to the first log, the display for the first log is automatically refreshed. When you refresh the view of an event log, only the view is updated; no changes are made to the log. The Refresh command is not available for archived logs, because those files can no longer be updated.

  • To enable auditing for an ADAM instance running under a service account other than the Network Service account, you must grant the Generate security audits right to the ADAM service account.

See Also

  • Administering an ADAM instance
  • Running ADAM on Windows XP Professional
  • Administering computers running ADAM


Synchronize Data from Active Directory to an ADAM Instance

Active Directory to ADAM Synchronizer is a command-line tool that synchronizes data from an Active Directory forest to a configuration set of an ADAM instance.

To synchronize data from Active Directory to an ADAM instance

  1. Open an ADAM tools command prompt.

  2. At the command prompt, type:

    adamsync /install server name:port .xml file name

Notes

  • To open an ADAM tools command prompt, click Start, point to All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

  • The following table contains the parameters in step 2 and other commonly used adamsync parameters. For more information about adamsync parameters, type adamsync /? at a command prompt, or see Related Topics.

    Parameter Description

    /?

    Displays command-line options.

    /l or /list

    Displays all available configurations of Active Directory to ADAM Synchronizer.

    /d or /delete configuration_dn

    Deletes the specified configuration.

    /i or /install input_file

    Installs the configuration that is contained in the specified input file.

    /download configuration_dn output_file

    Creates an output file in XML containing the specified configuration.

    /export configuration_dn output_file

    Saves the current configuration to the specified output file.

    /sync configuration_dn

    Synchronizes the specified configuration

    /reset configuration_dn

    Resets the replication cookie of the specified configuration.

    /mai configuration_dn

    Configures the specified configuration as the authoritative instance.

    /fs configuration_dn

    Performs a full replication synchronization for the specified configuration.

    /ageall configuration_dn

    Performs an aging run for the specified configuration.

    /so configuration_dn object DN

    Performs a replication synchronization for the specified object in the specified configuration. Use the distinguished name of the object.

    /passPrompt

    Prompts for user credentials.
  • For specific information about importing the user class definitions that are supplied with ADAM, see Related Topics.

  • For complete syntax information for the adamsync command, see Related Topics.

  • You must have Read or Dirsync access to the objects or partitions in the Active Directory forest that you want to synchronize.

  • You must have full control of an application directory partition on an ADAM instance to run this command.

See Also

  • Glossary
  • Adamsync


ADAM Concepts

ADAM Concepts

  • ADAM Overview

  • Understanding ADAM architecture

  • Understanding ADAM data and data stores

  • Understanding ADAM schema

  • Understanding ADAM replication and configuration sets

  • Understanding ADAM sites

  • Understanding ADAM sites and replication

  • Understanding ADAM service publication

  • Understanding ADAM LDAP referrals

  • Understanding ADAM bind redirection

  • Understanding ADAM users and groups

  • Understanding ADAM access control

  • ADAM resources


This content might have been updated. For the most recent version, see the Windows Server 2003 R2 TechCenter Web site

ADAM Overview

Getting started with ADAM

  • Introducing ADAM

  • ADAM requirements

  • Comparing ADAM to Active Directory


Introducing ADAM

Introducing ADAM

For organizations that require flexible support for directory-enabled applications, Microsoft has developed Active Directory Application Mode (ADAM). ADAM is a Lightweight Directory Access Protocol (LDAP) directory service. You can run ADAM on servers running Microsoft® Windows ServerTM 2003 and also on clients running Microsoft Windows® XP Professional.

Note

To run ADAM on clients running Windows XP Professional, you must install the latest service packs and hot fixes.

ADAM provides data storage and retrieval for directory-enabled applications, without the dependencies that are required for the Active Directory® directory service. ADAM provides much of the same functionality as Active Directory, but it does not require the deployment of domains or domain controllers. You can run multiple instances of ADAM concurrently on a single computer, with an independently managed schema for each ADAM instance.

What's new in ADAM

The following features are new to ADAM in Windows Server 2003 R2:

  • Users can be created in the configuration partition so that ADAM users can be ADAM administrators. For more information, see Allow ADAM users to be created in the configuration partition.

  • Active Directory to ADAM Synchronizer tool. This tool synchronizes objects from Active Directory to an ADAM instance. For more information, see Synchronize Data from Active Directory to an ADAM Instance and Adaminstall.

  • ADAM users can bind to an ADAM instance by using digest authentication. This authentication method uses the default credentials of the server applications and eliminates the need to keep a plaintext version of the application's password in memory. Digest bind is supported in Ldp.

  • Active Directory Schema Analyzer tool. This tool helps to migrate the Active Directory schema to ADAM. For more information, see ADSchemaAnalyzer.

  • Newer version of LDP tool with access control list (ACL) editor. For more information about Ldp, see Ldp.

  • ADAM can now chain user password requests in ADAM to the user object in Active Directory so that a password is changed in both directory services. When a user in ADAM who is also a user in Active Directory attempts to change the user password in ADAM, that change is treated the same as a user password change in Active Directory. Both the old and new password must be provided (except for Active Directory administrators, who only need to supply the new password), and the new password must meet any password policies that are set in Active Directory. Active Directory performs all policy checking.

Microsoft directory technologies

With the introduction of Active Directory Application Mode, Microsoft provides a choice of directory services. Both ADAM and Active Directory build on the same core Microsoft directory service technologies, but they address different needs within an organization.

Active Directory. Active Directory provides directory services for both the Windows network operating system (NOS) and for directory-enabled applications. For the NOS, Active Directory stores critical information about the network infrastructure, users and groups, network services, and so on. In this role, Active Directory must adhere to a single schema throughout an entire forest.

ADAM. ADAM provides directory services specifically for directory-enabled applications. ADAM does not require or rely on Active Directory domains or forests. However, in environments where Active Directory exists, ADAM can use Active Directory for the authentication of Windows security principals.

Notes

  • Directory services (such as ADAM and Active Directory) and relational databases both provide data storage and retrieval, but they differ in their optimization. Directory services are optimized for read processing, while relational databases are optimized for transaction processing. In general, consider implementing a directory service if your application reads data more frequently than it writes data. Consider implementing a relational database if your application writes or modifies data more frequently than it reads data, such as with transactional applications.

  • ADAM and Active Directory can run concurrently in the same network. In addition, ADAM can support both domain and workgroup users simultaneously, as shown in the figure below. For a comparison between ADAM and Active Directory, see Comparing ADAM to Active Directory.

ADAM and Active Directory running concurrently

Directory-enabled applications

A directory-enabled application uses a directory, rather than a database, flat file, or other data storage structure, to hold its data. Many off-the-shelf applications, as well as many custom applications, use a directory-enabled design. Examples of types of applications that often use a directory-enabled design include Customer Relationship Management (CRM) applications, Human Resource (HR) applications, and global address book applications.

For information about developing directory-enabled applications for ADAM, see the ADAM Software Developer's Kit (SDK) and ADAM resources.


ADAM requirements

Requirements

The following requirements apply to Active Directory Application Mode (ADAM).

Platform requirements

ADAM requires one the following platforms:

  • Microsoft® Windows ServerTM 2003, Standard Edition

  • Microsoft Windows ServerTM 2003, Enterprise Edition

  • Microsoft Windows ServerTM 2003, Datacenter Edition

  • The 64-bit version of Windows Server 2003, Enterprise Edition

  • The 64-bit version of Windows Server 2003, Datacenter Edition

  • Microsoft Windows® XP Professional Service Pack 1 (SP1)

  • Microsoft Windows® XP 64-Bit Edition Service Pack 1 (SP1)

Note

There are some functional considerations for running ADAM on Windows XP Professional. For more information, see Running ADAM on Windows XP Professional. In addition, you must also install the latest service packs and hot fixes to run ADAM on Windows XP Professional. For more information, see Windows Update at the Microsoft Web site.

Workgroup and domain requirements

ADAM does not require a forest, domain, or domain controller. You can install ADAM on computers that are configured as any of the following:

  • Domain controllers

  • Domain members

  • Stand-alone computers

Support for LDAP clients

ADAM supports any Lightweight Directory Access Protocol (LDAP) client that is written to the LDAP v3 technical specification.

Support for ADSI clients

ADAM supports Active Directory Service Interfaces (ADSI) for clients running the following:

  • Windows XP Professional

  • Microsoft Windows® XP Home Edition

  • Windows Server 2003 family

  • Microsoft Windows® 2000

Note

For complete ADSI functionality with Windows XP Professional, you must install hotfix 817583. For more information about this hotfix, see article 817583 in the Microsoft Knowledge Base.


Comparing ADAM to Active Directory

Comparing ADAM to Active Directory

The following table illustrates the functional differences and similarities between Active Directory Application Mode (ADAM) and Active Directory.

Feature | ADAM | Active Directory
Supports multiple schemas per server | Yes | No
Supports multiple directory instances per server | Yes | No
Runs on Windows XP Professional | Yes | No
Runs on member servers | Yes | No
Supports X.500 naming for top-level directory partitions | Yes | No
Supports installing, starting, and stopping without a reboot | Yes | No
Group Policy | No | Yes
Global catalog | No | Yes
IntelliMirror desktop management | No | Yes
Automated software distribution | No | Yes
Domain trusts and forest trusts | No | Yes
Public key infrastructure (PKI)/X.509 | No | Yes
Supports DNS service (SRV) resource records | No | Yes
Supports Lightweight Directory Access Protocol (LDAP) application programming interface (API) | Yes | Yes
Supports Active Directory Service Interfaces (ADSI) API | Yes | Yes
Supports Messaging API (MAPI) | No | Yes
Delegated administration | Yes | Yes
Multimaster replication | Yes | Yes
InetOrgPerson | Yes | Yes
LDAP over Secure Sockets Layer (SSL) | Yes | Yes
Attribute-level security | Yes | Yes
LDAP access control list (ACL) support | Yes | Yes
Microsoft Identity Integration Server 2003 compatibility | Yes | Yes
Extensible schema | Yes | Yes
Supports application directory partitions | Yes | Yes
Supports installation of a replica from media | Yes | Yes
Supports 64-bit servers | Yes | Yes
Supports concurrent LDAP binding | Yes | Yes


Understanding ADAM architecture

Architecture

Active Directory Application Mode (ADAM) uses the same architecture—and even the same code base—as Active Directory. ADAM provides a hierarchical data store, a directory service component, and interfaces that clients can use to communicate with the directory service. ADAM can run on any computer running Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; Windows Server 2003, Datacenter Edition; or Windows XP Professional. ADAM does not require a domain controller or a DNS server. For information about considerations when running ADAM on Windows XP Professional, see Running ADAM on Windows XP Professional.

The following table lists the basic ADAM components, along with their Active Directory counterparts.

Component | ADAM | Active Directory | Purpose
Directory data store | Adamntds.dit | Ntds.dit | Provides a hierarchical data store for directory data.
Directory service | Dsamain.exe, Adamdsa.dll | Ntdsa.dll (Runs within Lsass.exe) | Processes requests from directory clients and other directory services.
Directory service interfaces | Lightweight Directory Access Protocol (LDAP), replication | LDAP, replication, Messaging API (MAPI) | Provide interfaces to the directory service for making directory-related requests.
Directory server | Windows Server 2003, Windows XP Professional | Microsoft® Windows® 2000 Server or Windows Server 2003 domain controller | Provides the platform on which the directory service runs.

The following illustration shows the relationship between the components of ADAM. For information about the ADAM directory data store, see Understanding ADAM data and data stores.

Directory service

The ADAM directory service manages the directory data store. It responds to directory requests from directory clients, as well as from other directory services. The ADAM directory service runs in the security context of the account that is specified as the ADAM service account. The ADAM directory service provides all of the following functions:

  • Authentication of directory users

  • Fulfillment of data requests

  • Data synchronization between directory servers (through multimaster replication)

  • Data management

Notes

  • ADAM manages replication by grouping ADAM instances into configuration sets. For more information about ADAM replication, see Understanding ADAM replication and configuration sets.

  • The ADAM directory service allows or denies access to clients based on credentials that are provided by the clients. ADAM supports all the same authentication, or binding methods, as Active Directory. For more information about authentication and data security, see Understanding ADAM access control.

  • ADAM service account requirements vary, depending on the computer on which ADAM is installed and also on the replication scenario. For more information, see Selecting an ADAM service account.

ADAM instances

In ADAM, a service instance (or, simply, instance) refers to a single running copy of the ADAM directory service. Unlike Active Directory, multiple copies of the ADAM directory service can run simultaneously on the same computer. Each instance of the ADAM directory service has a separate directory data store, a unique service name, and a unique service description that is assigned during installation. For more information about ADAM instances, see Administering an ADAM instance.

Directory service interfaces

ADAM provides directory service interfaces for communication with directory clients and other ADAM instances. ADAM provides a Lightweight Directory Access Protocol (LDAP) interface for clients for authentication and for making directory service requests. ADAM provides a remote procedure call (RPC) interface for replication with other ADAM servers and for administration.

Service dependencies

ADAM does not require the DNS service or the File Replication service (FRS). Clients address ADAM directly, using the name or Internet Protocol (IP) address of the computer on which ADAM is running, along with the communication port number used by the ADAM instance. Because ADAM does not require or rely on domains or domain controllers, ADAM replication does not require FRS.


Understanding ADAM data and data stores

Data and data stores

Active Directory Application Mode (ADAM) stores directory data in a hierarchical, file-based directory store. By default, the directory store for a given ADAM instance is located in the following:

%ProgramFiles%\Microsoft ADAM\instancename\data\adamntds.dit

Each ADAM instance has a separate directory store. Any data operation that you perform in ADAM, including searches, reads, imports, exports, indexing, replication, backups, and restores, uses the ADAM directory store in some way. The directory store is organized into logical directory partitions, also called naming contexts.

Note

Like Active Directory, Active Directory Application Mode uses the Extensible Storage Engine (ESE) to manage its directory store.

Directory partitions

The ADAM directory store is organized into logical directory partitions, or naming contexts. Three different types of directory partitions exist: configuration, schema, and application. Each ADAM directory store must contain a single configuration directory partition and a single schema directory partition, and it can contain zero or more application directory partitions. The following table summarizes these partition types, their contents, and ADAM requirements.

Partition type | Distinguished name | Required/optional | Contents
Configuration | CN=Configuration,CN={GUID} | Required | ADAM configuration information
Schema | CN=Schema,CN=Configuration,CN={GUID} | Required | Class and attribute definitions
Application | Assigned during partition creation | Optional | Application data

Configuration directory partition

The configuration directory partition holds information about ADAM replication scheduling and replica sets, information that defines the other partitions in the replication set, information about the users and groups in the replica set, and other information.

Schema directory partition

The schema directory partition holds the definitions for the type of data that can be held by the directory store. The ADAM directory service relies on the definitions in the schema partition for maintaining data consistency. In addition, applications can refer to the schema partition to determine the type of data that the ADAM instance allows. You can extend the schema to allow ADAM to hold data that is specific to a particular application. For more information about ADAM schemas, see Understanding ADAM schema.

Note

A common configuration partition and a common schema partition are replicated to ADAM service instances that belong to the same configuration set. For more information about replication, see Understanding ADAM replication and configuration sets.

Application directory partitions

Application directory partitions hold the data that is used by your applications. You can create an application partition during ADAM setup or at any time after installation. Depending on your application, you might extend the schema manually or your application might automatically extend the schema for you. Typically, you manage data in a given application directory partition through your application. After the application directory partition is created, ADAM holds the application partition reference objects in CN=Partitions,CN=Configuration.


Understanding ADAM schema

Schema

An Active Directory Application Mode (ADAM) schema defines, using object classes and attributes, the kinds of objects and data that can be created and stored in an ADAM directory. Each ADAM configuration set has its own independently manageable schema, which is stored in the schema directory partition. In keeping with the ADAM design concepts of simplicity and flexibility, the base (or default) ADAM schema contains only the classes and attributes that are needed to start an ADAM instance. The schema can be extended with new classes and attributes, either by administrators or by the applications themselves. In addition, unneeded schema classes and attributes can be deactivated. As with all objects in the directory, access control lists (ACLs) protect schema objects, so that only authorized users can alter the schema. Every object in an ADAM directory is an instance of an object class that is defined in a schema, as shown in the following illustration.

ADAM schema directory objects

Object classes

An object class represents a category of objects, such as users, printers, or application programs, that share a set of common characteristics. The definition for each object class contains a list of the attributes that can be used to describe instances of the class. For example, the User class has attributes such as givenName, surname, and streetAddress. The list of attributes for a class is divided into those attributes that an object of that class must contain and additional attributes that an object may contain. The definition of each class also lists the classes whose objects can be parents of objects of a given class.

For example, the following table shows the definition for the ADAM user class.

Attribute | Value
Dn | CN=User,CN=Schema,CN=Configuration
objectClass | top; classSchema;
cn | User;
distinguishedName | CN=User,CN=Schema,CN=Configuration;
subClassOf | organizationalPerson;
mayContain | audio; carLicense; departmentNumber; displayName; employeeNumber; employeeType; givenName; homePostalAddress; jpegPhoto; labeledURI; photo; preferredLanguage; roomNumber; secretary; uid; userPKCS12; userSMIMECertificate; x500uniqueIdentifier;
rDNAttID | cn;
adminDisplayName | User;
adminDescription | User;
objectClassCategory | 1;
lDAPDisplayName | user;
name | User;
objectGUID | dac9093a-d2aa-408a-81bb-0fe8179165da;
schemaIDGUID | bf967aba-0de6-11d0-a285-00aa003049e2;
objectCategory | CN=Class-Schema,CN=Schema,CN=Configuration;
defaultObjectCategory | CN=Person,CN=Schema,CN=Configuration;

Attributes

The schema also defines each attribute. The definition for each attribute includes unique identifiers for the attribute, the syntax for the attribute, optional range limits for the attribute values, whether the attribute can have only one value or multiple values, and whether the attribute is indexed. The directory schema defines each attribute exactly once. Each attribute can then be referenced by multiple object classes. For example, the description attribute is defined once and then referenced by many object classes.

The following table shows the attribute definition for telephone number, a representative schema attribute.

Attribute | Value
objectClass | top; attributeSchema;
cn | Telephone-Number;
distinguishedName | CN=Telephone-Number,CN=Schema,CN=Configuration;
instanceType | 0x4 = ( IT_WRITE );
whenCreated | 11/12/2002 13
22 | 14 Pacific Standard Time Pacific Daylight Time;
whenChanged | 11/12/2002 13
22 | 14 Pacific Standard Time Pacific Daylight Time;
uSNCreated | 217;
attributeID | 2.5.4.20;
attributeSyntax | 2.5.5.12;
isSingleValued | TRUE;
rangeLower | 1;
rangeUpper | 64;
uSNChanged | 217;
showInAdvancedViewOnly | TRUE;
adminDisplayName | Telephone-Number;
adminDescription | Telephone-Number;
oMSyntax | 64;
searchFlags | 0;
lDAPDisplayName | telephoneNumber;
name | Telephone-Number;
objectGUID | bf19d7eb-ea0f-4f2d-af67-f439a037d8a4;
schemaIDGUID | bf967a49-0de6-11d0-a285-00aa003049e2;
attributeSecurityGUID | 77b5b886-944a-11d1-aebd-0000f80367c1;
systemOnly | FALSE;
systemFlags | 0x10 = ( FLAG_SCHEMA_BASE_OBJECT );
isMemberOfPartialAttributeSet | TRUE;
objectCategory | CN=Attribute-Schema,CN=Schema,CN=Configuration;

Single-valued and multivalued attributes

Attributes can be single-valued or multivalued. An instance of a single-valued attribute can contain only a single value. An instance of a multivalued attribute can contain multiple values, which must all use the same syntax. Each value of a multivalued attribute must be unique.

Note

A multivalued attribute stores its values in random order. Therefore, you should not make any directory decisions—programmatic or manual—based on the order of the values in a multivalued attribute.

Indexed attributes

Indexing attributes helps to improve the performance of queries that are based on the indexed attribute. Both single-valued and multivalued attributes can be indexed; classes cannot be indexed. Attributes can be marked for indexing through their schema definition. Indexing an attribute also makes it possible for users to use wildcards (*) as prefixes and suffixes when they specify a search string. When you mark an attribute as indexed, all instances of the attribute are added to the index, not just the instances that are members of a particular class. Indexing attributes, particularly multivalued attributes, can negatively affect replication and object creation time, as well as directory database size. Therefore, you should only index commonly used attributes.

For general information about schemas, see "Active Directory Schema" at the Microsoft MSDN Web site.


Understanding ADAM replication and configuration sets

Replication and configuration sets

Active Directory Application Mode (ADAM) uses replication to provide fault tolerance and load balancing for directory services. ADAM uses a type of replication called multimaster replication. Through replication, ADAM copies directory data updates that are made to a directory partition on one ADAM instance to other ADAM instances that hold copies of the same directory partition. ADAM instances that hold copies of the same directory partition or partitions form a logical grouping called a configuration set.

Multimaster replication

Multimaster replication simply means that you can make changes to directory data on any ADAM instance. ADAM replicates these changes to other members of the configuration set automatically. Multimaster replication is characterized by loose data consistency with convergence. When you make changes to data on a given directory partition at one ADAM instance, replicas of that directory partition that are stored on other ADAM instances become inconsistent with the most up-to-date replica of the directory partition (the partition where the changes were made). However, as changes get replicated through the configuration set, all partition replicas once again become identical; that is, they converge to the most recent data.

Configuration sets

ADAM instances replicate data based on participation in a configuration set. All ADAM instances that are joined to the same a configuration set must replicate a common configuration directory partition and a common schema directory partition. ADAM instances in a configuration set can also replicate any number of application directory partitions. ADAM instances in a configuration set are not required to replicate all application directory partitions in the configuration set. A single ADAM instance can replicate all—or any subset of—the application directory partitions in its configuration set. An ADAM instance cannot, however, replicate an application directory partition from a different configuration set. For more information about the types of directory partitions in ADAM, see Understanding ADAM data and data stores.

The following illustration shows an example of two ADAM configuration sets, each with two ADAM instances. As shown in the illustration, a single computer can run multiple ADAM instances, each in a different configuration set.

ADAM configuration set
Note

An ADAM instance can be joined to a configuration set only during installation of the instance.

Preventing replication conflicts

What if two different users make changes to the same data on replicas of the same directory partition on two different ADAM instances? In such a case, each ADAM instance attempts to replicate the changes, creating a conflict. To resolve this conflict, replication partners that receive these conflicting changes examine the attribute data that is contained in the changes, each of which holds a version and a time stamp. ADAM instances accept the change with the higher version and discard the other change. If the versions are identical, ADAM instances accept the change with the more recent time stamp.

If two or more values in a multivalued attribute on an object are updated simultaneously on two different ADAM instances, only one of the updated values will be replicated. In other words, simultaneous updates to a multivalued attribute that occur on two different ADAM instances are considered in conflict, even if the updates apply to different values within the multivalued attribute. The only exception to this rule is for linked value attributes (such as group memberships), which do allow for simultaneous updates to different values within the linked value attribute.

Replication topology

Knowledge Consistency Checker (KCC), a process that runs as part of each ADAM instance, automatically constructs the most efficient topology for replication traffic to follow, based on the network. The KCC regularly recalculates the replication topology to adjust for any network changes that occur in the environment.

Note

An ADAM configuration set maintains its own replication topology, separate from any Active Directory replication topology that might also exist. Directory partitions cannot be replicated between ADAM instances and Active Directory domain controllers.

Ensuring replication security

To ensure replication security, ADAM authenticates replication partners before replication, and replication authentication always occurs over a secure channel. ADAM uses Security Support Provider Interface (SSPI) to establish the appropriate authentication security level between replication partners. The method used for replication authentication within a configuration set depends on the value of the msDS-ReplAuthenticationMode attribute on the configuration directory partition. After replication partners have successfully authenticated, all replication traffic between the two partners is encrypted.

The following table describes the security levels for replication authentication and the corresponding msDS-ReplAuthenticationMode attribute value for each security level. The default replication security level for a new, unique ADAM instance is 1, unless a local workstation user account is specified as the ADAM service account. If a local workstation account is specified as the ADAM service account, the replication security level is set to 0.

Replication security level | Authentication mode | Description | Supported environments
Mutual authentication with Kerberos | 2 | Kerberos authentication, using service principal names (SPNs), required. If Kerberos authentication fails, the ADAM instances will not replicate. | Configuration set must be fully contained in an Active Directory domain, forest, or forest trust.
Negotiated | 1 | Kerberos authentication (using SPNs) is attempted first. If Kerberos fails, NTLM authentication is attempted. If NTLM fails, the ADAM instances will not replicate. | Configuration set can contain Microsoft® Windows NT® 4.0 member servers.
Negotiated pass-through | 0 | All ADAM instances in the configuration set use an identical account name and password as the ADAM service account. | Configuration set can include computers that are joined to one or more workgroups or that are joined to multiple domains or forests without trust relationships.

For information about modifying the replication security level of a configuration set, see Modify the replication security level of a configuration set.

To help maintain ADAM replication security, the following best practices are recommended:

  • Use the highest level of replication security that your environment can support.

  • In Active Directory environments, run ADAM on member servers, rather than on domain controllers, whenever possible.

  • If you run ADAM on a domain controller in an Active Directory environment, do not use the Network Service account as the ADAM service account. Instead, use a domain user account that does not have administrative privileges.

  • In workgroup and Windows NT 4.0 environments, do not use an account with administrative privileges as an ADAM service account.

  • Use separate configuration sets for applications with strict isolation requirements.

For more information about ADAM replication requirements for service accounts, see Selecting an ADAM service account. For more information about service principal names (SPNs) and replication security, see Administering ADAM service principal names.


Understanding ADAM sites

Sites

Active Directory Application Mode (ADAM) uses topology information, which is stored as site objects and site link objects in the configuration directory partition, to build the most efficient replication topology for a configuration set. You can use sites in ADAM to represent the physical structure, or topology, of your network. You can use ADAM ADSI Edit to define site objects and site link objects.

Site objects

You can create a site object in ADAM to represent each area of your network (typically, a building or a group of buildings) in which all computers are connected by high-speed bandwidth. You can then move the directory objects of ADAM instances that are located in each area of the network into the corresponding site object. By default, the directory objects of each ADAM instance that you create belong to a single default site (CN=Default-First-Site-Name,CN=Sites,CN=Configuration,CN={GUID}).

For information about establishing single or multiple sites, see Administering sites.

Site link objects

You can use site link objects in the directory to represent low-speed bandwidth connections between the sites on your network. Site link objects help you tune replication on your network; you can use them to determine the relative cost of replication across each site link. By default, the default site (CN=Default-First-Site-Name) belongs to the default site link object (CN=DEFAULTIPSITELINK,CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,CN={GUID} ). You can add new sites that you create to the default site link object. You can also create additional site link objects to represent each of the actual site links on your network.

Site link costs

Each site link object in the directory has an associated cost. You can edit the cost attribute on a site link object to specify the relative cost of replication across that site link. ADAM takes into consideration site link costs when it builds the replication topology. ADAM considers a site link with a higher cost to be less desirable than a site link with a lower cost. When multiple paths for replication are available, ADAM prefers the site link with the lower cost.

For more information about how sites affect replication, see Understanding ADAM sites and replication.


Understanding ADAM sites and replication

Sites and replication

In Active Directory Application Mode (ADAM), the replication topology is the set of physical connections that is used to replicate directory updates among ADAM instances in a configuration set. ADAM builds the most efficient replication topology for a configuration set based on the site or sites in which members of the configuration set reside. ADAM treats replication within a site differently than replication between sites.

Building the intersite replication topology

One ADAM server in each site, called the intersite topology generator, is assigned to build the topology. Together, these intersite topology generators build a least-cost spanning tree algorithm that eliminates redundant replication paths between sites. The intersite replication topology is updated regularly to respond to any changes that occur in the network. You can control intersite replication through the information that you provide when you create your site links.

Determining when intersite replication occurs

Active Directory preserves bandwidth between sites by minimizing the frequency of replication and by allowing you to schedule the availability of site links for replication. By default, intersite replication across each site link occurs every 180 minutes (3 hours). You can adjust this frequency to match your specific needs. Be aware that increasing this frequency increases the amount of bandwidth that is used by replication. In addition, you can schedule the availability of site links for use by replication. By default, a site link is available to carry replication traffic 24 hours a day, 7 days a week. You can limit this schedule to specific days of the week and times of day. You can, for example, schedule intersite replication so that it only occurs after normal business hours. For more information, see Configure replication availability on a site link.

Building the intrasite replication topology

The Knowledge Consistency Checker (KCC) on each ADAM instance automatically builds the most efficient replication topology for intrasite replication, using a bidirectional ring design. This bidirectional ring topology attempts to create at least two connections to each ADAM instance (for fault tolerance) and no more than three hops between any two ADAM instances (to reduce replication latency). To help prevent connections of more than three hops, the topology can include shortcut connections across the ring. The KCC updates the replication topology regularly.

Determining when intrasite replication occurs

Intrasite replication is optimized for speed, rather than bandwidth, because bandwidth within a site is assumed to be high-speed. Replication within a site occurs automatically on the basis of change notification. Intrasite replication begins when a directory update occurs. By default, the source ADAM instance waits 15 seconds and then sends an update notification to its closest replication partner. If the source ADAM instance has more than one replication partner, subsequent notifications go out by default at 3-second intervals to each partner. After receiving notification of a change, a partner ADAM instance sends a directory update request to the source ADAM instance. The source ADAM instance responds to the request with a replication operation. The 3-second notification interval prevents the source ADAM instance from being overwhelmed with simultaneous update requests from its replication partners.

If no directory updates have occurred within a given time period, intrasite replication still occurs, based on a scheduled interval. By default, this scheduled interval is once per hour. For information about modifying this time period, see Configure replication frequency within a site.


Understanding ADAM service publication

ADAM service publication

In Active Directory environments, service publication refers to the ability of a service to publish information about itself in the directory and to the ability of clients to discover that information and locate the service. When a computer on which Active Directory Application Mode (ADAM) is running is joined to an Active Directory domain, ADAM attempts to create service connection point (SCP) objects in Active Directory.

Active Directory and service connection points

In Active Directory network environments, services can publish information about their existence using serviceConnectionPoint objects in the directory. These objects contain binding information that client applications use to find and connect to instances of the service. To access a service, a client does not have to know about specific computers; the objects in Active Directory include this information.

When an ADAM instance is running in an Active Directory environment, it makes a best-effort attempt to publish updated information about itself in Active Directory. This attempt is a "best-effort" attempt because the attempt to create SCPs does not always succeed, and failure to create SCPs does not prevent the ADAM instance from running or accepting client connections.

The attempt to create SCPs succeeds if:

  • The computer on which the ADAM service is running is joined to a domain, and

  • The ADAM service account possesses Create Child rights on the computer object where the serviceConnectionPoint object is to be created.

By default, ADAM runs as NetworkService, and the serviceConnectionPoint object is created under the computer object that represents the computer on which ADAM is running. If the SCP object already exists, ADAM updates the object with any new information about the ADAM instance.

A serviceConnectionPoint object contains the information in the following table.

serviceConnectionPoint attribute Attribute contents

Keywords

  • Windows 2000 Lightweight Directory Access Protocol (LDAP) object identifier (also known as OID)

  • ADAM LDAP object identifier

  • Globally unique identifier (GUID) of the NTDS Settings object under the computer object of the ADAM instance

  • Site of the ADAM instance

  • Instance name of the ADAM instance

  • Operation master role (schema or naming), if held by the ADAM instance

  • Distinguished name and GUID of the configuration directory partition of the ADAM instance

  • Distinguished name and GUIDs of all application directory partitions on the ADAM instance

serviceBindingInformation

  • LDAP connection point (in the form of ldap:\\computername:ldapport)

  • Secure Sockets Layer (SSL) connection point (in the form of ldaps:\\computername:sslport)
Note

The Keywords attribute is a multivalued attribute.

By default, the global catalog in Active Directory contains the contents of the Keywords attribute of an SCP object. As a result, a client can locate an object on which an SCP is created, even if the object is located in a different domain than the client.

Client searches

Client applications can find ADAM instances by searching the SCP attributes that are contained in the global catalog. For information about performing this search programmatically, see "How Clients Find and Use a Service Connection Point" at the Microsoft MSDN Web site. (Unlike the example shown at the Microsoft MSDN Web site, client applications need to perform only one search to retrieve the information necessary for ADAM binding.) Client applications can search for the ADAM object identifier, configuration partition GUID, ADAM instance GUID, ADAM instance name, or any directory partition. Client applications may also perform load balancing by selecting an ADAM instance at random when a search returns more than one applicable ADAM instance.

Service publication and discovery without SCPs

ADAM does not require that SCPs be published to run successfully. ADAM operates successfully with or without SCPs. Examples of environments without SCPs include workgroup environments and ADAM instances running under service accounts that do not possess sufficient privileges to create SCPs. In these cases, client applications can rely on Domain Name System (DNS) to resolve the host name of a computer on which ADAM is running. Note, however, that ADAM instances, unlike domain controllers in Active Directory, do not create service (SRV) records in DNS.


Understanding ADAM LDAP referrals

ADAM LDAP referrals

In accordance with RFC 2251, Active Directory Application Mode (ADAM) supports the use of referrals. With referrals you can use ADAM to direct LDAP clients to a more appropriate location in response to a query from the client. Also in accordance with RFC 2251, ADAM can return referrals in response to any LDAP operation request, except "unbind" and "abandon" requests, which have no responses. ADAM maintains referral data in crossRef objects that are stored in the partitions container of the configuration directory partition.

ADAM creates and maintains crossRef objects for all directory partitions in the configuration set, including the configuration and schema partitions. These crossRef objects are used to generate referrals in response to queries that request data about objects that exist in the configuration set but that are not contained in the ADAM instance handling the request.

At a minimum, at least one Uniform Resource Locator (URL) must be present in the referral. When possible, ADAM returns at least three referrals, to provide referral redundancy to clients in distributed environments. A referral is not returned for a singleLevel or wholeSubtree search in which the search scope spans multiple naming contexts and several different servers must be contacted to complete the operation. Instead, continuation references are returned.

If a crossRef object with a matching directory partition exists, ADAM uses it for referrals. However, if a crossRef object does not exist, but the queried namespace uses DNS-style (DC=) naming, ADAM constructs a DNS name to be used as a referral. If the queried namespace does not use DNS-style naming, a superior reference is used, if one exists. A superior reference can be configured by setting the superiorDnsRoot attribute on the configuration partition crossRef object. If a superior reference is not configured (it is not configured by default), an operational error is returned.

Generating referrals from a crossRef object

If the dNSRoot attribute has been set on the crossRef object (dNSRoot is not set by default), ADAM returns the DNS name as the referral for the queried namespace. (By default, the dNSRoot attribute is set to NULL.) Then, the client can chase the referral through registered DNS records for each host that contains the queried namespace.

If the dNSRoot attribute is NULL, the referral is generated based on other information about the crossRef, as follows:

  • ADAM refers to the msDS-NC-Replica-Locations attribute to find the NTDS Settings objects representing the instances hosting this partition (for example: CN=NTDS Settings,CN=Machine1$instance1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,CN={<GUID>}). If more than three ADAM instances host the directory partition, a randomly selected set of three instances is chosen.

  • From the NTDS Settings object (the authoritative source within the directory for communications port information), ADAM retrieves the msDS-PortLDAP attribute for the communications port.

  • From the parent (Server Object), ADAM retrieves the dNSHostName attribute (instance1.machine1.example.com). dNSHostName is the authoritative source for the server host name, and it can either be a DNS host name or a host Internet Protocol (IP) address. If the server name changes, this object can be relied on to have the updated information.

  • ADAM then constructs the referral based on the server and communications port information. ADAM returns multiple referrals for each request to ensure that the client can pursue the request, even if one or more hosts represented in the referrals cannot be reached. ADAM selects a random number of locations (three by default) and continues to use those defaults for five minutes, after which another three hosts are selected. Both the number of hosts and number of minutes are configurable. If the number of hosts specified is greater than the actual number of instances holding the directory partition, all of the hosts are returned as referrals, and they will continue to be used indefinitely. This information is kept in the crossref cache, and it is refreshed anytime the crossref cache is rebuilt. The crossref cache is automatically rebuilt when msds-nc-replica-locations changes, that is, when an ADAM instance is added or removed.

Note

You can modify the values in the following table on the msDS-Other-Settings attribute of the directory service object, or on a crossRef object, to configure the referral behavior of an ADAM instance.

Value name | Default | Meaning
MaxReferrals | 3 | Maximum number of referrals returned by ADAM
ReferralRefreshInterval | 5 minutes | Time interval at which referral information is updated
SelfReferralOnly | 0 | Setting the value to 1 prevents ADAM from providing referral information

Generating referrals without crossRef objects

If a crossRef does not exist for the search base, ADAM determines the DNS name if the distinguished name that is presented in the request uses DNS-style (DC=) syntax. Otherwise, ADAM uses the supref attribute of the configuration directory partition to generate a referral to the Superior Referral, if one is configured. This attribute is NULL by default, and it must be configured explicitly. Otherwise, no referrals are generated.


Understanding ADAM bind redirection

ADAM bind redirection

Active Directory Application Mode (ADAM) bind redirection is designed for use primarily with legacy applications that are unable to authenticate directly against Active Directory but still need to use ADAM as the application data store. Through bind redirection, ADAM can accept a bind request from an application and redirect this bind request to Active Directory, based on the contents of a proxy object. A proxy object in ADAM represents an Active Directory security principal, and it can be augmented to store additional data related to that security principal that is specific to the application. Through bind redirection, applications can take advantage of the identity store of Active Directory without any additional overhead. For example, if an administrator disables an account in Active Directory, that account can no longer be used to bind to ADAM. In addition, applications retain the flexibility of using ADAM as an application data store.

Proxy objects for bind redirection

Bind redirection relies on the existence of stub, or proxy, objects in ADAM, each of which represents an Active Directory security principal. To implement bind redirection, you first create a proxy object schema definition to store data that is specific to your application. In this definition, you include the msDS-bindProxy auxiliary class. The msds-BindProxy class possesses a single "must contain" attribute, ObjectSid, which holds the security ID (SID) of the associated Active Directory security principal. You can initially populate ADAM with proxy objects representing Active Directory users through a synchronization mechanism, such as Microsoft Identity Integration Server 2003, or through the construction and importation of .ldf files into ADAM.

Processing bind requests

When a user sends a bind request to ADAM, ADAM does the following based on the type of request:

For simple bind requests:

  • If the object class to which the user requests a bind possesses msDS-bindableObject as a static auxiliary class, ADAM processes the bind request directly, generating a security context that is based on the ADAM user's SID.

  • If, instead, the object class to which the user requests a bind possesses the msDS-bindProxy as an auxiliary class, ADAM redirects the bind request to Active Directory. ADAM then generates a security context that includes the token that is returned by Active Directory in response to the redirection, along with the ADAM groups in which the principal is a member.

For simple authentication and security layer (SASL) bind requests:

  • The bind request goes directly to the AcceptSecurityContext application programming interface (API) call. ADAM generates a security context that is based on the token that is returned from AcceptSecurityContext.

Designing applications for bind redirection

Although bind redirection is intended for preexisting, legacy applications, it can also be used with new applications. However, for new and modifiable applications, it is recommended that you write the application to use Windows security principals, rather than proxy objects, for authentication. With this type of design, you can maintain a single sign on (SSO) solution and prevent the duplication of accounts.

New and modifiable applications

For applications that are currently in development, and for applications that can be updated, it is recommended that you write your applications to authenticate directly against Active Directory, using Windows security principals. This type of design provides the highest degree of security, because passwords flow directly from the client to Active Directory, rather than through ADAM. ADAM can then be used simply as an application-specific data store. Proxy objects in ADAM can hold application data that is specific to each Windows security principal, and an attribute on the ADAM proxy object can be used to uniquely link each proxy object to a particular Windows security principal. A unique identifier on a Windows security principal, such as a security ID (SID) or a globally unique identifier (GUID), can be used for this linking. If your application is unable to authenticate against Active Directory, and you need to synchronize directory contents between ADAM and Active Directory, you can use a synchronization service, such as Microsoft Identity Integration Server (MIIS). However, this option introduces a delay between the originating update and the synchronization of the update.

Legacy applications

In some cases, you may be running already deployed, directory-enabled applications that cannot be modified. In these cases, your application may send a flat string to the directory, expecting the return of a distinguished name string with which to bind. For this scenario, the ADAM proxy object can support a unique distinguished name, and it can also contain a flag indicating that the object represents a security principal in Active Directory. Based on the presence of the flag, when a user attempts to bind to the proxy object, ADAM redirects the bind request to Active Directory, rather than processing the request locally.

Password security

Because bind redirection can only be used in conjunction with simple bind requests, any password that is sent to ADAM as part of a bind redirection is sent in a plaintext, unencrypted format. Therefore, it is strongly recommended that you implement bind redirection only when using an encrypted connection, for example, Secure Sockets Layer (SSL), which is the default setting in ADAM.

Notes

  • ADAM should be used to store data that is specific to a particular application, while Active Directory should be used to hold more widely used data.

  • Only simple bind requests can be redirected.

  • You cannot modify the password of an Active Directory security principal through a bind redirection.

  • Bind direction only supports security principals from the forest to which the computer is joined or to a trusted domain or forest.

  • If both msDS-bindProxy and msDS-bindableObject are specified as auxiliary classes on a single object, msDS-bindableObject takes precedence.


Understanding ADAM users and groups

Users and groups

Active Directory Application Mode (ADAM) relies on users and groups to provide and control access to directory data. ADAM supports the simultaneous use of both Windows users and ADAM users. ADAM provides four default, role-based groups. You can create additional ADAM groups as necessary. Both Windows users and ADAM users can be members of ADAM groups. To create ADAM users in ADAM, you must first import the user object class definitions that are provided with ADAM, or you can supply your own user object definitions.

Default groups

ADAM provides four default, role-based groups: Administrators, Instances, Readers, and Users. These groups reside in the configuration partition and in each application partition, but not in the schema partition. Within a configuration set, ADAM replicates these groups, along with all other directory data.

The following three groups reside in the CN=Roles container of each directory partition:

  • Administrators (CN=Administrators, CN=Roles)

  • Readers (CN=Readers, CN=Roles)

  • Users (CN=Users, CN=Roles)

The following group resides only in the CN=Roles container of the configuration directory partition:

  • Instances (CN=Instances, CN=Roles)

The following table lists the default ADAM groups, along with the default members and default access assigned to each group.

Group | Default members | Default access
Administrators (CN=Administrators, CN=Roles) | Configuration partition: ADAM administrators assigned during ADAM setup Application partitions: Administrators group from the configuration partition | Full access to all partitions
Instances (CN=Instances, CN=Roles) | All instances |
Readers (CN=Readers, CN=Roles) | None | Read access to the partition
Users (CN=Users, CN=Roles) | Configuration partition: Transitively, all ADAM users Application partitions: Transitively, all ADAM users created in the partition | None

Groups from the configuration partition can be assigned permissions in any partition of an ADAM instance or configuration set. Groups from an application partition can be assigned permissions only in that application partition. Windows security principals can be assigned permissions in any application partition.

Security principals

The term security principal refers to any object that has a security identifier (SID) and that can be assigned permissions to directory objects. In ADAM, security principals can reside in ADAM, on a local computer, or in an Active Directory domain.

Note

You can retrieve an active user's individual and group SIDs by explicitly querying the tokenGroups attribute on the rootDSE.

ADAM security principals

ADAM does not include any default security principals. However, ADAM does provide importable schema extensions that you can use to create users in ADAM. Users created from these user classes can be used as security principals. In addition, you can make any object class in the ADAM schema a security principal by adding the msDS-bindableobject auxiliary class and the unicodePwd attribute to the schema definition of an object class. Each ADAM security principal must be assigned an account and password, which ADAM uses for authentication.

For more information about authentication in ADAM, see Understanding ADAM access control. For information about the optional user classes provided with ADAM, see Administering users and groups.

Windows security principals

ADAM allows the use of Windows security principals for authentication and access control. Local Windows users and groups, as well as domain users and groups, can be used with ADAM. In addition, you can add Windows security principals membership to ADAM groups as members. By default, the security principal that you specify as the ADAM administrator during ADAM setup becomes a member of the Administrators group in the configuration partition. For Windows security principals, ADAM relies on the Local Security Authority (LSA) on the local computer (for local accounts) or the LSA on a domain controller (for domain accounts) for authentication.

For more information about authentication in ADAM, see Understanding ADAM access control.


Understanding ADAM access control

Access control

The term access control describes how a directory service provides and secures access to directory data. Access control in Active Directory Application Mode (ADAM) consists of two parts. First, ADAM authenticates the identity of users requesting access to the directory, allowing only successfully authenticated users into the directory. Second, ADAM uses security descriptors, called access control lists (ACLs), on directory objects to determine to which objects an authenticated user has access.

Authentication

Users, or security principals, request directory data from ADAM through directory-enabled applications, which in turn make requests to ADAM using Lightweight Directory Access Protocol (LDAP). Before making a request for data, the directory-enabled application must present the user's credentials to ADAM for authentication, or binding. This request includes a user name, password, and—depending on the type of bind—a domain name or computer name.

ADAM can accept authentication, or bind, requests from both ADAM security principals and Windows (local and domain) security principals. ADAM security principals are authenticated directly by ADAM. Local Windows security principals are authenticated by the local computer. Domain security principals must authenticated by an Active Directory domain controller. The following table summarizes supported authentication methods in ADAM, based on the type of security principal.

Security principal Accepted credential formats Authenticated by

ADAM
  • Distinguished name

  • Canonical name

  • displayName attribute value

  • User principal name (UPN)

ADAM instance

Workstation account
  • Machine name\account

Local Security Authority (LSA) on the local computer

Domain account
  • Domain name\account

  • UPN

LSA on a domain controller from the user's domain
Note

A UPN that is used in ADAM does not require the use of the "@" symbol.

The possible authentication paths in ADAM are shown in the figure below.

For more information about binding to LDAP directories, see "Establishing an LDAP Session" at the Microsoft MSDN Web site.

ADAM security principals

ADAM security principals are users or other objects that are created and reside in the ADAM directory. ADAM security principals can be created based on the importable user classes (including inetOrgPerson) that are provided with ADAM. Or, ADAM security principals can be created from any object class in the schema that contains the SecurityPrincipal static auxclass and the unicodePwd attribute. ADAM assigns each ADAM security principal a unique security ID (SID), which is guaranteed to be unique across all ADAM naming contexts. For more information about ADAM security principals, see Understanding ADAM users and groups.

ACLs

Permissions on ADAM directory objects are assigned to users and groups using access control lists (ACLs). An ACL contains a list of users and groups that have been assigned permissions on a directory object, and it also contains the types of permissions (read, write, and so on) that they have been assigned. (Each individual entry in an ACL is called an access control entry (ACE).) If an ACL on a directory object does not explicitly assign permissions to a user, or to any groups that a user is a member of, the user will be denied access to that object.

For the most part, ACLs in ADAM function the same as in Active Directory. ACEs differ between ADAM and Active Directory in that ADAM validates SIDs as they are added to the ACE, while Active Directory allows all user SIDs. ADAM user SIDs are allowed only if one of the following conditions is true:

  • The ADAM user is in the same naming context as the object to which the ACE is added.

  • The object is in the schema naming context.

  • The object is in the configuration naming context.

Security context

After a user has been successfully authenticated, ADAM can construct the security context for the authenticated user. This security context specifies the SID of the user, along with a list of all of the groups to which the user belongs.

The security context for an authenticated Windows security principal includes:

  • The user's SID

  • The user's Windows group memberships

  • The user's ADAM group memberships (including those groups in which the user is a direct member and those groups in which the user is a member through recursive group expansion)

The security context for an authenticated ADAM security principal includes:

  • The user's SID

  • SIDs of each of the following ADAM groups:

    • Everyone

    • AuthUsers

    • Users group from the partition in which the ADAM user resides

    • Users group from the configuration partition

    • Groups in which the user is a member through recursive group expansion

By comparing an authenticated user's security context with the ACL on the directory object to which the user has requested access, ADAM can determine whether to grant the user access to the object.

Retrieving user SIDs

You can retrieve an active user's SIDs by explicitly querying the tokenGroups attribute on the rootDSE. The tokenGroups attribute is a multivalued attribute. The first value represents the user's individual SID, with the values following representing the user's ADAM and Windows group SIDs.

For more information about how access control is determined in Active Directory and ADAM, see "Controlling Access to Active Directory Objects" at the Microsoft MSDN Web site.


ADAM resources

Resources

Along with the Active Directory Application Mode Administrator's Guide, these additional resources can help you get the most out of your Active Directory Application Mode (ADAM) deployments.

Microsoft Web site

  • "Understanding LDAP" at the Microsoft Web site.

  • "Active Directory" at the Microsoft MSDN Web site.

  • "Lightweight Directory Access Protocol" at the Microsoft MSDN Web site.

  • For information about installing the latest service packs or hot fixes, see Windows Update at the Microsoft Web site. Also, see Using Windows Update.

  • For information about binding to Lightweight Directory Access Protocol (LDAP) directories, see "Establishing an LDAP Session" at the Microsoft MSDN Web site.

  • For information about access in Active Directory—and in ADAM, see "Controlling Access to Active Directory Objects" at the Microsoft MSDN Web site.

  • For information about the Active Directory schema, see "Active Directory Schema" at the Microsoft MSDN Web site.

  • For information about developing directory-enabled applications, see "Design Guide for Directory-Enabled Applications" at the Microsoft MSDN Web site.

  • For information about role-based authorization in Windows Server 2003, see "Dynamic Groups in Windows Server 2003 Authorization Manager" at the Microsoft MSDN Web site.

  • For information about setting up and using certificate services, see "Certificate Services" at the Microsoft TechNet Web site.

Other Web sites

  • RFC 2849: The LDAP Data Interchange Format (LDIF)—Technical Specification at the Internet Engineering Task Force (IETF) Web site.

  • RFC 3377: Lightweight Directory Access Protocol (v3): Technical Specification at the Internet Engineering Task Force (IETF) Web site.

Note

Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here.


Administering ADAM

Administering ADAM

  • Using ADAM administration tools

  • Administering computers running ADAM

  • Running ADAM on Windows XP Professional

  • Administering an ADAM instance

  • Administering directory partitions

  • Administering sites

  • Administering replication and configuration sets

  • Administering ADAM service publication

  • Administering ADAM service principal names

  • Administering the ADAM schema

  • Administering users and groups

  • Administering access control

  • Backing up and restoring ADAM

  • Selecting an ADAM service account


Using ADAM administration tools

Using ADAM administration tools

Active Directory Application Mode (ADAM) comes with several administration tools. The ADAM Setup Wizard installs ADAM administration tools when you install a new ADAM instance. In addition, you can use the ADAM Setup Wizard to install the ADAM administration tools only, without installing a new ADAM instance. For more information, see Selecting components to install.

To open a command prompt from which to run ADAM administration tools, click Start, click All Programs, point to ADAM, and then click ADAM Tools Command Prompt.

The following table describes ADAM administration tools and their purpose.

Tool | Purpose
ADAM ADSI Edit | Microsoft Management Console (MMC) snap-in for general ADAM administration, including replication scheduling.
ADAM Schema | MMC snap-in for administration of the ADAM schema.
Adamsetup | Command that launches the ADAM Setup Wizard and, through command-line parameters, that can be used to perform unattended ADAM installs.
Csvde | Command-line tool for importing and exporting directory contents, such as schema definitions and directory objects, that are stored as comma-separated value (.csv) files.
Dsmgmt | Command-line tool for general ADAM administration.
Dsacls | Command-line tool for displaying and changing permissions (access control entries (ACEs)) in the access control list (ACL) of objects in ADAM.
Dsdbutil | Command-line tool for managing ADAM database (.dit) files.
Dsdiag | Command-line tool for general ADAM monitoring.
Ldifde | Command-line tool for importing and exporting directory contents, such as schema definitions and directory objects, that are stored as LDAP Data Interchange Format (LDIF) files.
Ldp | Graphical user interface (GUI) tool for general administration of a Lightweight Directory Access Protocol (LDAP) directory service.
Repadmin | Command-line tool for monitoring replication.

For information about how to use the ADAM ADSI Edit snap-in, see Connect and bind to an ADAM instance using ADAM ADSI Edit and Browse the directory tree using ADAM ADSI Edit.

For information about how to use Ldp, see Connect and bind to an ADAM instance using Ldp.exe and Browse the directory tree using Ldp.exe.

For more information about ADAM administration tools, see ADAM Administration Tools.


Administering computers running ADAM

Administering computers running ADAM

Directory clients locate an Active Directory Application Mode (ADAM) instance using the name or Internet Protocol (IP) address of the computer running ADAM and the communications port in use by the ADAM instance. In addition, in Active Directory environments, clients can locate ADAM instances through service connection points (SCPs) that are published in Active Directory. Modifying the computer name, Domain Name System (DNS) name, network basic input/output system (NetBIOS) name, or IP address of a computer on which an ADAM instance is running may affect the directory clients' ability to locate that ADAM instance.

Note

ADAM can be installed on computers running Windows Server 2003 or Windows XP Professional. For considerations when running ADAM on Windows XP Professional, see Running ADAM on Windows XP Professional.

Locating ADAM instances

For a directory-enabled application to communicate with an ADAM instance, the application must specify the NetBIOS name, DNS name, or IP address of the computer on which ADAM is running. In addition, the application must specify the Lightweight Directory Access Protocol (LDAP) or Secure Sockets Layer (SSL) communication port being used by the ADAM instance. For example, a directory-enabled application referencing an ADAM instance running on a computer with a DNS name of ADAMSrv1.microsoft.com—with a NetBIOS name of ADAMSrv and an IP address of 192.168.0.1 and using communication port 389 for LDAP connections—can address the ADAM instance using one of the following:

  • ADAMSrv1.microsoft.com:389

  • ADAMSrv:389

  • 192.168.0.1:389

Locating ADAM instances in Active Directory environments

When you run ADAM in an Active Directory environment, each ADAM instance creates and maintains SCP objects about itself in Active Directory. For more information, see Administering ADAM service publication.

Server object names

By default, the relative distinguished name of a server object in ADAM is servername$instancename, where servername represents the computer on which the ADAM instance is running and instancename represents the service name of the ADAM instance.

Modifying settings on a computer running ADAM

You initially specify the computer name, DNS name, NetBIOS name, and IP address when you set up the computer. You initially specify the communication port numbers used by a given ADAM instance when you install the ADAM instance.

You can change these settings on a computer running ADAM at any time. However, when you update any of these settings, you may also need to reconfigure directory-enabled applications to properly address the ADAM instance. For example, if the host name of the computer on which ADAM is running changes, your directory-enabled application may need to be updated accordingly.


Running ADAM on Windows XP Professional

Running ADAM on Windows XP Professional

In addition to running Active Directory Application Mode (ADAM) on domain controllers, member servers, or workgroup servers running Windows Server 2003, you can also run ADAM on computers running Windows XP Professional. Running ADAM on Windows XP Professional introduces some functional considerations, as described in this topic.

Using ADAM on Windows XP Professional as a personal data store

For use on computers running Windows XP Professional, ADAM has been designed primarily as a personal data store. It is recommended that you run ADAM on Windows Server 2003 if you need scalability to support a growing number of simultaneously connected clients or if you intend to use ADAM on a centralized directory server.

Running ADAM on Windows XP Professional in a workgroup

When you install ADAM on a computer running Windows XP Professional that is joined to a workgroup, you must set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest to 0. (The default is 1.) Otherwise, users connecting to ADAM over the network are forced to a security context of Guest, and binds to ADAM fail. For more information, see Enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup.

Summary of functional considerations when running ADAM on Windows XP Professional

The following table summarizes all other functional considerations related to running ADAM on Windows XP Professional.

ADAM feature | Windows Server 2003 | Windows XP Professional
Support for multiple processors | Supported. | Not supported. When multiple-processor computers are present, ADAM uses only one process at a time to prevent resource monopolization.
Maximum cache value | No limit. | Limited to one half of physical RAM.
Data and log file locations | Data and log files can reside on different drives. | Data and log files must reside on the same drive.
Password policies | Supported. | Not supported.
Auditing | Supported. For more information, see Administering an ADAM instance. | Not supported.
ADAM service account requirements | See Selecting an ADAM service account. | See Selecting an ADAM service account.
Stopping and restarting an ADAM instance | An ADAM instance can be stopped and then restarted immediately. | If a Lightweight Directory Access Protocol (LDAP) client is connected when you shut down the ADAM instance, you may need to wait as long as two minutes before restarting the ADAM instance. This time is required to allow any existing connections to clear.
Backing up ADAM | Multiple ADAM instances running on the same computer can be backed up simultaneously. | For computers running multiple ADAM instances, only one ADAM instance can be backed up at a time.
Full ADSI functionality | No hotfixes are required. | For complete Active Directory Service Interfaces (ADSI) functionality with Windows XP Professional, you must install hotfix 817583. For more information about this hotfix, see article 817583 in the Microsoft Knowledge Base.

For information about general ADAM requirements, see ADAM requirements.


Administering an ADAM instance

Administering an ADAM instance

Each ADAM instance runs as an independent, and separately administered, service on a computer. You can configure the account under which an ADAM instance runs, stop and restart an ADAM instance, and change the ADAM instance service display name and service description. In addition, you can enable Secure Sockets Layer (SSL) connections in ADAM by installing certificates. In Active Directory environments, each ADAM instance attempts to create a service principal name (SPN) object in the directory to be used for replication authentication. Depending on the network environment into which you install Active Directory Application Mode, you may need to create SPNs manually.

For information about tasks related to ADAM instances, see Manage an ADAM Instance. For information about SPNs, see Administering ADAM service principal names.

ADAM service account

The service account that is used by an ADAM instance determines the access that the ADAM instance has on the local computer and on other computers in the network. ADAM instances also use the service account to authenticate other ADAM instances in their configuration set, to ensure replication security. You determine the ADAM service account during ADAM installation. For information about ADAM service account requirements, see Selecting an ADAM service account.

To modify the ADAM service account for an ADAM instance, you can use the change service account command within the Dsdbutil command line tool. For more information, see Dsdbutil.

In addition, you may need to assign the Log on as a service right to the account that you specify as the ADAM service account. For more information, see Add the Log on as a service right to an account.

To enable auditing for an ADAM instance for which the service account is something other than the Network Service account, you must assign the Generate security audits right to the ADAM service account.

ADAM instance name

During setup, you assign a name to the ADAM instance, which is used in the creation of the file directory structure and registry keys for ADAM. In addition, the name that you assign is used to create the service name, service display name, and service description, as shown in the example in the following table.

Name supplied during setup | Service name | Service display name | Service description
instance1 | ADAM_instance1 | instance1 | Blank (No default description provided.)

The name that you specify for an ADAM instance during setup must meet the following requirements:

  • It must be unique with respect to other ADAM instances running on the same computer.

  • It must be no longer than 44 characters.

  • It must use characters only from the ranges of a through z, A through Z, or 0 through 9.

  • The name "ntds" cannot be used.

The service display name appears in Add or Remove Programs and in the Services snap-in. The service description appears in the Services snap-in. You can modify the service display name and the service description at any time after installation.

For information about modifying the service display name, see View or modify the service display name of an ADAM instance. For information about modifying the service description, see View or modify the service description of an ADAM instance.

Starting and stopping an ADAM instance

The service for an ADAM instance can be stopped and restarted independently, without restarting the computer on which ADAM is running. In addition, the service for an ADAM instance can be configured to start either automatically or manually, and it can also be disabled.

For information about stopping and starting ADAM, see Start, stop, pause, resume, or restart an ADAM instance. For information about assigning the Log on as a service right, see Add the Log on as a service right to an account.

Note

When you run ADAM on a computer running Windows XP Professional, you may need to wait up to two minutes after stopping an ADAM instance before restarting the instance. ADAM requires this time to close any existing connections.

Event logs and auditing

Each ADAM instance running on a computer writes events to a separate event log. The ADAM event log, which has a display name that matches the name of the ADAM instance, can be viewed in Event Viewer.

To enable auditing for an ADAM instance running under a service account other than the Network Service account, you must grant the Generate security audits right to the ADAM service account.

To enable replication auditing for an ADAM instance, you must modify the registry key:

where instancename represents the name of the ADAM instance on which you want to audit replication. The following table describes the values in the registry key that control replication auditing. To enable replication auditing, set one or both of the values to 1.

Registry key value | Data type | Meaning
Audit Access in Replication | DWORD | Provides a summary of the replication operations that are occurring.
Audit Objects in Replication | DWORD | Audits the changes to individual objects and attributes.
Note

ADAM also creates setup and uninstall logs in the %systemroot%\debug directory. These log files are called Adamsetup.log and Adamuninstall.log.

Using certificates with ADAM

To enable Secure Sockets Layer (SSL) connections to ADAM, you must have certificates installed on the computer running ADAM and also on the clients connecting to ADAM. You can obtain certificates from a trusted certification authority (CA). Or, for internal use, you can issue certificates from your own internal CA, by installing and using certificate services on Windows 2000 Server or Windows Server 2003.

For information about setting up and using certificate services, see "Certificate Services" on the Microsoft TechNet Web site.

In addition, on computers running Windows XP Professional that need to establish SSL connections to an ADAM instance, you must install the hotfix described in article 817583 in the Microsoft Knowledge Base Web site.

Note

When using certificates with ADAM, you must assign the ADAM service account read access to the certificates that are installed on the computer where the ADAM instance is running. The certificate store is located in the following directory: Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys.


Administering directory partitions

Administering directory partitions

Three types of directory partition exist in Active Directory Application Mode (ADAM): configuration, schema, and application. Configuration and schema directory partitions are created automatically during installation. Application directory partitions can be created either during or after installation. Every ADAM directory partition has a unique distinguished name. Distinguished names for directory partitions in ADAM support both Domain Naming System (DNS)-style and X.500-style naming. An ADAM instance does not specify a naming context by default, but it can be configured to provide a default naming context to clients. ADAM configuration and schema directory partitions can be viewed and managed using ADAM administration tools, which are installed during ADAM setup. Application directory partitions are typically managed through directory-enabled applications.

For information about tasks related to directory partitions, see Manage Schemas and Directory Partitions. For more information about types of directory partitions, see Understanding ADAM data and data stores.

Creating directory partitions

The schema and configuration directory partitions are created automatically during installation of an ADAM instance. (Configuration and schema partitions can only be created during ADAM installation.) If you choose to join the ADAM instance being installed to an existing configuration set, the schema and configuration directory partitions from an ADAM instance in the configuration set are replicated to the new instance. If you install a new ADAM instance, the installation process creates default versions of the schema and configuration directory partitions for you. If you install an ADAM instance from media, the schema and configuration directory partitions for the new ADAM instance are replicas of the directory partitions from the media.

When you install a new ADAM instance, you can also choose to replicate one or more application directory partitions from an existing ADAM instance. Or, you can specify the creation of a new application partition. When you create a new application directory partition during installation, you must specify a unique distinguished name for the partition. The new application directory partition consists only of a partition container object with the distinguished name that you specify.

Naming directory partitions

Each ADAM directory partition has its own, unique distinguished name. ADAM supports both DNS-style and X.500-style names for top-level directory partitions, including the distinguished name components that are listed in the following table.

Distinguished name attribute | Meaning
C= | Country/region
CN= | Common name
DC= | Domain component
L= | Location
O= | Organization
OU= | Organizational unit

Specifying a default naming context

By default, an ADAM instance does not provide a default naming context. You can, however, configure ADAM to provide a default naming context, by specifying a value for the msDS-defaultNamingContext attribute on the NTDSA object, at:

This msDS-defaultNamingContext attribute contains no value by default. If a value is set in the attribute, that value is returned to a client through the defaultNamingContext attribute of the rootDse object when the rootDse object is read.

When a bind is requested on the rootDSE object, ADAM returns the value of defaultNamingContext, if the msDS-defaultNamingContext attribute on the NTDSA object is set to the distinguished name of a top-level container of an instantiated naming context. Otherwise, no value is returned.

Importing and exporting directory objects

You can use a number of methods to import and export directory objects, both to and from the schema directory partition, as well as to and from application directory partitions. You can use the ldifde command-line tool to import and export .ldf files. You can use the csvde command-line tool to import and export .csv (comma-delimited) files. For more information, see Import or export directory objects using ldifde and Import or export directory objects using csvde.

Administering application directory partitions

You can create an application directory partition during setup. You can also create application directory partitions at any time after installation, either through ADAM administration tools or through your directory-enabled application. In production environments, you typically manage your application directory partitions and the data that they contain through your directory-enabled applications.

For information about creating application directory partitions, see Add an application directory partition.


Administering sites

Administering sites

You can optimize the replication efficiency and reduce the administrative overhead of your network by establishing sites appropriately. The most effective number of sites depends on the physical design of your network. When you first create a new configuration set for Active Directory Application Mode (ADAM), a single, default site (called Default-First-Site-Name) is created that represents your entire network. A single site can be very efficient for a single location network that is completely connected by high-speed bandwidth. If your network contains multiple geographic locations that communicate over low-speed, wide area network (WAN) connections, establishing multiple sites gives you more detailed control of replication behavior, and it reduces network traffic on the WAN that connects the sites. You can administer site objects and site link objects through ADAM ADSI Edit.

For information about sites, see Understanding ADAM sites. For information about tasks related to sites, see Manage Replication, Sites, and Configuration Sets.

Bandwidth as an important consideration

Within a site, bandwidth affects how efficiently replication can work. The frequency with which intrasite replication occurs requires high-speed bandwidth to function most effectively. Before you create a new site, make sure that high-speed bandwidth connects all computers in the site candidate. Any area where domain controllers are connected by 10 megabits per second (Mbps) or more of bandwidth is a good site candidate.

When to establish a single site

If you have a single local area network (LAN) consisting of a single location, or if your network consists of a series of closely located locations (as in a campus), in which all locations are connected by a high-speed backbone, using the default site as the single site in replication topology can simplify replication management. In a single-site topology, all replication on your network occurs as intrasite replication, which requires no manual replication configuration. In a single-site design, all ADAM instances also remain very current with respect to directory changes, because directory updates are replicated almost immediately.

When to establish multiple sites

When your network consists of multiple geographic locations connected by a WAN, establishing separate sites for each location provides the following benefits:

  • Efficient use of WAN bandwidth for replication

  • Detailed control of replication behavior

Physically separate network locations typically communicate over WAN connections, which are most often characterized by low-speed bandwidth. By creating a separate site for each physical location on your network, you ensure that ADAM instances communicating over WAN connections use intersite replication, which is specifically designed for efficiency over low-bandwidth connections. When you create a site object, you also need to create a servers container within the site object. To move an ADAM instance to a new site object, you move the ADAM instance into the servers container of the site. For more information, see Add a site object and servers container and Move an ADAM instance to a site object.

Site link objects represent the network links between the sites on your network. When you create a new site object in ADAM, add the site object to a site link object. Until you add the new site to a site link object, any ADAM instances in the site will not be able to replicate to ADAM instances outside the site. You can add a new site object to the default site link object. Or, you can create additional site link objects, giving you more detailed control over the relative cost of replication over different WAN connections on your network.

With multiple sites, you have more detailed control of replication behavior through configurable intersite replication settings. These settings include the relative cost of different replication paths and the availability of connections for use by replication. For more information, see Configure replication availability on a site link and Set the cost on a site link object.


Administering replication and configuration sets

Administering replication and configuration sets

In Active Directory Application Mode (ADAM), replication within a site occurs automatically, and it does not require any configuration beyond the construction of configuration sets. For replication between sites, you can specify a schedule for replication. For example, you may want replication to occur only during the night, when your network is not busy. If the ADAM instance replication partners do not all belong to Active Directory domains, you must use identical local service account names and passwords to enable replication.

Notes

  • You can only join an ADAM instance to a configuration set using the ADAM Setup Wizard or during an unattended ADAM installation. After an ADAM instance is installed, it cannot be joined to a configuration set.

  • ADAM does not support replication using Simple Mail Transfer Protocol (SMTP).

Scheduling replication

For replication between ADAM instances within a site, you can schedule the amount of time that elapses after the last change notification before a default replication event occurs. For more information, see Configure replication frequency within a site.

For replication between ADAM instances in different sites, you can schedule the availability of the site link that exists between the two sites. For more information, see Configure replication availability on a site link.

For more information about replication within and between sites, see Understanding ADAM sites and replication.

Authenticating ADAM replication partners

Considerations for replication authentication in ADAM include the authentication level of the configuration set, which is determined by the domain, forest, or workgroup environment, and the service accounts that are in use by the ADAM instances in the configuration set. For information about authentication levels, see Understanding ADAM replication and configuration sets. For information about service account requirements, see Selecting an ADAM service account.

Operations master roles

Each ADAM instance belonging to a given configuration set operates with equal authority. However, certain activities that are performed with a given configuration set should only be performed by a single ADAM instance. These activities include schema management, to prevent conflicting schema changes, and instance naming management, to prevent conflicting directory partition names. The ADAM instances that are responsible for these activities are called, respectively, the schema master and the naming master. ADAM assigns these roles automatically. You can also reassign these roles, as may be required, for example, if an ADAM instance that holds one of the operations master roles stops responding or goes offline. For information about reassigning operations master roles, see Identify or transfer the schema master role and Identify or transfer the naming master role.

Schema master

The schema master instance controls all updates and modifications to the schema within a given configuration set. To update the schema, you must be a member of the ADAM Administrators group on the configuration set. You must also be able to connect successfully to the schema master. Each configuration set can contain only one schema master.

Naming master

The ADAM instance that holds the naming master role controls the addition and removal of directory partitions, or naming contexts, in a given configuration set. Each configuration set can contain only one naming master.


Administering ADAM service publication

Administering ADAM service publication

In Active Directory environments, Active Directory Application Mode (ADAM) uses service connection point (SCP) objects to publish ADAM service information in the Active Directory directory store. Considerations for administering ADAM SCP objects include the following:

  • Manually creating SCPs when necessary

  • Removing SCP objects when necessary

  • Modifying permissions on SCP objects when necessary

  • Checking the ADAM event log for SCP errors

Creating SCPs

By default in Active Directory environments, the ADAM service creates SCPs in Active Directory when the ADAM service starts. To successfully create SCPs, the ADAM service account must have sufficient rights in Active Directory. If SCP creation fails, ADAM writes an event to the ADAM event log regarding the failure.

Notes

  • The default location for the ADAM SCP object is under the computer object that represents the computer on which ADAM is running. This default location can be altered by specifying a different location on the SCPPublishingService object.

  • When it is used as the ADAM service account on a computer that is joined to a domain, the Network Service account usually has sufficient rights to create SCPs in Active Directory. However, when it is used on an ADAM instance running on a domain controller, the Network Service account does not have sufficient rights to create SCPs in Active Directory.

Removing SCPs

An ADAM instance deletes its SCP from Active Directory when you remove the ADAM instance from the computer. Removing the SCP requires sufficient administrative privileges. If SCP removal fails, client applications may be directed to a nonexistent ADAM instance.

Modifying SCPs

An ADAM instance checks and updates, if necessary, its SCP each time the ADAM instance starts. At startup, the ADAM instance searches the global catalog for its own globally unique identifier (GUID) and retrieves the distinguished name of the SCP object. The ADAM instance then binds to that distinguished name and updates the SCP object as necessary. In addition, the ADAM instance reviews the SCP object on an hourly basis by default to confirm its validity, particularly regarding any directory partitions that have been added to or removed from the ADAM instance since the SCP object was last updated.

Note

You can modify the default time interval at which ADAM reviews the SCP object, by adding a value named Server information update interval (mins) to the registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\instancename\Parameters, and setting this value to the time interval (in minutes) that you want to use.

For more information about publishing and using SCPs, see "About Service Publication" on the MSDN Web site at http://go.microsoft.com/fwlink/?LinkId=48288.

Managing ADAM SCPs

One efficient way to manage SCPs for ADAM is to create an SCP container for your ADAM configuration set in Active Directory. In this container, place the computer objects of the computers on which ADAM instances are running. In addition, create a group called, for example, "ADAM instances," and assign permissions on the SCP container to the group. Also, delegate control of the group to the assigned ADAM administrator. Then, each time the ADAM administrator installs a new ADAM instance under a new service account, the ADAM administrator can simply add the new service account to the "ADAM instances" group, and the ADAM instance creates and maintains its SCPs transparently.

Checking the ADAM event log

SCP-related errors do not prevent an ADAM instance from functioning properly. ADAM does, however, report SCP-related errors in the ADAM event log so that errors can be resolved. ADAM reports SCP-related errors as follows:

  • When an SCP creation or update fails, the ADAM instance reports the error and points to a .ldf file that can be used to manually resolve the problem. Using this .ldf file to create or update the SCPs requires administrator privileges in Active Directory.

  • When ADAM fails to remove an SCP object, ADAM reports this failure both in the audit log of the appropriate domain controller and in the ADAM event log.


Administering ADAM service principal names

Administering ADAM service principal names

When they run in an Active Directory domain or forest, Active Directory Application Mode (ADAM) instances attempt to register service principal names (SPNs) in Active Directory for use in Kerberos authentication during replication. Each ADAM instance—the first time that the instance starts—attempts to register values to the Service-Principal-Name attribute on the account object that represents the service account in use by the ADAM instance. Or, if the ADAM instance uses the Network Service account as the ADAM service account, the ADAM instance attempts to register values to the Service-Principal-Name attribute on the computer object that represents the computer on which the ADAM instance is running. The values that the ADAM instance attempts to register include the following:

  • E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM\netbiosname:port

  • E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM\dnshostname:port

  • Ldap\netbiosname:port

  • Ldap\dnshostname:port

In addition, if the ADAM instance uses a reserved communications port (LDAP_PORT, LDAP_GC_PORT, LDAP_SSL_PORT, or LDAP_SSL_GC_PORT), the instance attempts the following SPN registrations:

  • Ldap\netbiosname

  • Ldap\dnshostname

Wldap32.dll does not use a port-formatted SPN to establish a connection to an ADAM instance using a reserved port. For example, if ADAM instance1 on machine1 uses port 3268 for LDAP, the SPN that Wldap32.dll creates for the connection is ldap\machine1. However, if ADAM instance2 on machine2 uses port 1026 for LDAP, the SPN that Wldap32.dll creates for the connection is ldap\machine2:1026.

Note

When multiple ADAM instances are running on a single computer, and two or more of the instances each use a reserved port, those ADAM instances must run under the same ADAM service account for the SPNs to be registered correctly.

SPN registration attempts occur in the security context of the ADAM service account. If the ADAM service account that you specify is not the Network Service account, or if it is a domain user account that does not belong to the Domain Administrators group, this SPN registration fails. ADAM reports this failure as event ID 2516 in the event log for the ADAM instance. If this failure occurs, ADAM setup also reports event ID 2535, which describes how to register the SPNs for ADAM manually.

To register SPNs for ADAM manually in Active Directory, use the dnsdomainname.bat script file that ADAM setup creates in the data directory of the ADAM instance (Program Files\Microsoft ADAM\instancename\data), where dnsdomainname represents the name of the DNS domain in which the ADAM instance resides.

Notes

  • The *.bat file shows up in the directory about one minute after ADAM installation completes.

  • The *.bat file contains repadmin /writespn commands, similar to the following:

    repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com"
E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM/netbioshostname:389

repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com"
E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM/dnshostname:389

repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com" ldap/netbioshostname:389

repadmin.exe /writespn hostname.microsoft.com
ADD "CN=adam,CN=Users,DC=microsoft,DC=com" ldap/dnshostname:389

This script registers the appropriate SPNs in Active Directory, and it must be run by a member of the Domain Administrators group in the domain.

Note

When SPNs for ADAM instances in a configuration are registered in Active Directory, ADAM replication authentication uses Kerberos. Otherwise, ADAM uses negotiated replication authentication. For more information about replication authentication, see Understanding ADAM replication and configuration sets.

Removing ADAM SPNs from Active Directory

When you remove an ADAM instance, make sure that its associated SPNs are also removed from Active Directory. These SPNs reside on the computer object of the computer where the ADAM instance is installed (if the Network Service account is specified for the ADAM service account) or on the domain user object (if a domain user account is specified for the ADAM service account).

Forcing the use of SPNs in an Active Directory environment

To force the use of SPNs and Kerberos for replication authentication in a a configuration set, you can modify the replication security level of the configuration set to equal 2. For more information, see Modify the replication security level of a configuration set.

Caution

If you set replication security level equal to 2, and SPNs are not registered or properly configured, replication will fail.


Administering the ADAM schema

Administering the ADAM schema

You can administer the Active Directory Application Mode (ADAM) schema in a number of ways, including extending the schema with new classes and attributes, deactivating classes and attributes, and reactivating classes and attributes. You can use the ADAM Schema snap-in to administer the ADAM schema.

For information about tasks related to administering the schema, see Manage Schemas and Directory Partitions.

Extending the schema

Before you can use ADAM to support a particular directory-enabled application, you may need to modify the ADAM schema with classes and attributes that are required by that application. You can easily modify the ADAM schema by using a number of methods, including:

  • Automatically, through a directory-enabled application.

  • Semiautomatically, using Ldifde.exe and the importation of .ldf files.

  • Programmatically, through Active Directory Service Interfaces (ADSI).

  • Manually, through Ldp and the ADAM Schema snap-in.

Note

Before you can use the ADAM Schema snap-in, you must first install it. For more information, see Install the ADAM Schema snap-in.

For environments that require the ability to create users in the ADAM directory, ADAM includes an importable .ldf file that contains four user object classes. For information about importing the ADAM user .ldf file, see Import the user classes supplied with ADAM.

Deactivating classes and attributes

Before deactivating a class, consider the following:

  • You can deactivate a class only if that class is not specified as a subClassOf, auxiliaryClass, systemAuxiliaryClass, possSuperiors, or systemPossSuperiors of any existing active class.

  • You cannot use a defunct class in definitions of new classes, and you cannot add a defunct class to existing class definitions.

  • You cannot create objects that are instances of a defunct class or modify existing instances of a defunct class. However, the instances of the defunct class become available again for modification when the defunct class is reactivated.

Before deactivating an attribute, consider the following:

  • You can deactivate an attribute only if the attribute is not specified as a systemMustContain, mustContain, systemMayContain, mayContain, or rdnAttId of any existing active class.

  • You cannot use a defunct attribute in definitions of new classes, and you cannot add a defunct attribute to existing class definitions.

  • You cannot read, modify, or delete instances of a defunct attribute that are present in existing objects. However, the instances of the defunct attribute become available when the defunct attribute is reactivated.

  • To purge the directory of instances of an attribute, you must delete the instances before deactivating the attribute.


Administering users and groups

Administering users and groups

You can administer users and groups in Active Directory Application Mode (ADAM) through the ADAM ADSI Edit snap-in or through your directory-enabled applications. For information about how to perform tasks related to users and groups in ADAM, see Manage Users and Groups.

ADAM users

To create users in ADAM, you must first import the optional user classes that are provided with ADAM into the ADAM schema. These user classes are provided in importable .ldf files (ms-User.ldf, ms-InetOrgPerson.ldf, ms-UserProxy.ldf), which you can find in the directory %windir%\adam on the computer where ADAM is installed. The following table describes the contents of each of the optional .ldf files.

.ldf file User classes Import this file if ...

ms-user.ldf
  • Person

  • Organizational-Person

  • User

You want to create user objects in the ADAM directory, but you do not want to create users of the inetOrgPerson class (as defined in RFC 2798).

ms-inetorgperson.ldf
  • Person

  • Organizational-Person

  • User

  • inetOrgPerson

You want to create user objects in the ADAM directory, and you want to create users of the inetOrgPerson class (as defined in RFC 2798).

ms-userproxy.ldf
  • User-Proxy

You want to create proxy objects in ADAM for use in bind redirection. For more information about proxy objects and bind redirection, see Understanding ADAM bind redirection.

For information about the schema definitions for each of the user object classes, see "Active Directory Schema" on the Microsoft MSDN Web site.

For more information about importing user classes, see Import the user classes supplied with ADAM. For information about creating ADAM users, see Add an ADAM user to the directory.

You can also disable ADAM users. For more information about disabling ADAM users, see Disable or enable an ADAM user.

Setting and modifying passwords

You can set and modify passwords for ADAM security principals over Secure Sockets Layer (SSL) connections (using Ldp.exe) or over encrypted, non-SSL connections (using ADAM ADSI Edit or Ldp.exe). To establish an SSL connection to ADAM, you must install certificates on the computer running ADAM and on all the clients. For more information about certificates, see Administering an ADAM instance. To make SSL connections to an ADAM instance, you must use Ldp.exe; ADAM ADSI Edit does not support SSL connections.

For information about setting and modifying passwords, see Set or modify the password of an ADAM user.

Note

On computers running Windows XP Professional that need to establish SSL connections to an ADAM instance, you must install the hotfix described in article 817583 in the Microsoft Knowledge Base.

By default, an ADAM instance running on Windows Server 2003 automatically enforces any local or domain password policies that exist. If you create a new ADAM user, and if you assign a password to that user that does not meet the requirements of the password policy that is in effect, the user will be disabled.

Password policy settings and account lockouts

When ADAM runs on a computer running Windows Server 2003, it supports and enforces the password policy settings and account lockout settings that are provided by Windows Server 2003, including the following:

  • Minimum age

  • Maximum age

  • Complexity

  • History

  • Too many failed logon attempts

  • Disabling and enabling of accounts

If the server on which ADAM is running belongs to a workgroup, the server's local password policy settings and account lockout settings are implemented. If the server on which ADAM is running belongs to a domain, the password policy settings and account lockout settings from Active Directory are implemented. The enforcement of password policy settings in ADAM can be disabled. Password policy settings are not enforced on ADAM instances that run on a computer running Windows XP Professional.

For more information about password policy settings and account lockout settings in Windows Server 2003, see Help and Support Center in Windows Server 2003.

ADAM groups

In addition to the four role-based groups that are provided by default in each directory partition in ADAM, you can add your own groups. You can add both ADAM users and Windows users to the ADAM groups that you create.

For more information, see Add an ADAM group to the directory and Add or remove members to or from an ADAM group.

Note

In ADAM, it is possible for an ADAM administrator, or for a user with sufficient access to the Administrators group, to remove member accounts from the ADAM Administrators group, possibly leaving ADAM without any valid administrators. To recover from this scenario, the assigned ADAM administrator, as the owner of the Administrators group, can repopulate the ADAM Administrators group with the appropriate accounts.

Organizing ADAM users and groups with organizational units

To keep your ADAM users and groups organized, you may want to place users and groups in organizational units (OUs). In Active Directory and in ADAM, as well as in other Lightweight Directory Access Protocol (LDAP)-based directories, OUs are the most commonly used method for keeping users and groups organized. For information about creating OUs in ADAM, see Add an organizational unit to the directory.

Note

By default, OUs can only be added under other OU (OU=), country/region (C=), organization (O=), or domain-DNS (DC=) object classes. For example, you can add an OU to O=Microsoft,C=US. You cannot add an OU to CN=test,O=Microsoft,C=US. You can, however, update the schema definition of the OU object class to allow other superiors.


Administering access control

Administering access control

You can govern access control in Active Directory Application Mode (ADAM) at the directory partition level by assigning users memberships to the role-based groups that are located on each partition. You can customize access control in ADAM on an object-by-object basis using the dsacls command-line tool. Other considerations for administering access control in ADAM include the assignment of permissions to Windows security principals and the best practice of avoiding the assignment of permissions to built-in security principals.

For more information about the dsacls command-line tool, see Dsacls.

Default ACLs

By default, ADAM provides access control list (ACL) settings on each directory partition. Also by default, all objects on a given partition inherit these default ACLs. To customize access control, you can:

  • Modify the default ACLs on the partition objects.

  • Set new ACLs on individual objects.

  • Change inheritance settings on individual objects.

For a table describing the default access that is provided to each of the default ADAM groups, see Understanding ADAM users and groups.

For information about viewing and setting object permissions, see View or set permissions on a directory object.

Note

In ADAM, it is possible for an ADAM administrator, or for a user with sufficient access to the Administrators group, to remove member accounts from the ADAM Administrators group, possibly leaving ADAM without any valid administrators. To recover from this scenario, the assigned ADAM administrator, as the owner of the Administrators group, can repopulate the ADAM Administrators group with the appropriate accounts.

Custom authorization mechanisms

Depending on your applications, you may have applications that use a custom authorization scheme. With a custom authorization scheme, ADAM still performs the task of authenticating users, but the directory-enabled application manages its own set of authorization information. Even with a custom authorization scheme in place, ADAM continues to enforce the ACLs on ADAM objects. Therefore, if your application implements its own authorization scheme, you may want to assign more relaxed permissions on all ADAM objects, so that the ADAM permissions do not interfere with your application's authorization scheme. If you do relax permissions in ADAM in this way, be sure to prevent clients from gaining access to ADAM through Lightweight Directory Access Protocol (LDAP), thus bypassing your custom authorization mechanisms.

Role-based authorization

With Windows Server 2003, one way that a directory-enabled application can control access to directory objects is through role-based authorization, which is an alternative to ACL-based access control. In this scenario, a directory-enabled application does not expose LDAP but instead controls all access to the directory data. ADAM is used simply as a data store. For more information about role-based authorization in Windows Server 2003, see the Microsoft MSDN Web site.

Note

Using ADAM as an authorization store requires that you import ms-azman.ldf into the ADAM schema. You can import ms-azman.ldf through the ADAM Setup Wizard during installation or by using the ldifde command-line tool. For more information, see Importing LDIF files during setup.

Windows security principals

By default, authenticated Windows security principals in ADAM can only read objects in the schema directory partition. To enable authenticated Windows security principals to read any other objects, you can assign permissions on objects to the well-known security ID (SID) authenticated user. You can assign Read permissions for an entire directory partition by making authenticated user a member of the Readers group on that directory partition. Or, you can assign Read permissions on an object-by-object basis, using dsacls.

Best practices for assigning permissions

Although it is possible to assign permissions on objects to built-in security principals, it is recommended as a best practice that you avoid doing so. Built-in security principals represent user groups that are defined by the security system. These built-in groups take the form BUILTIN\groupname. For example, the Builtin Administrators group (SID S-1-5-32-544) exists on every computer. If permission assignments for a particular object are made to the Builtin Administrators group, the intent of this assignment cannot always be determined. In other words, ADAM cannot always tell whether a security principal requesting access to an object belongs to the Builtin Administrators group for which a permission assignment is intended.

It is also possible to assign permissions on objects to well-known security principals. Well-known security principals represent special identities that are defined within the security system, including Everyone, Local System, Principal Self, Authenticated User, Creator Owner, and so on. It is generally considered acceptable to assign permissions on objects to any of the following well-known security principals:

  • Anonymous Logon (after considering the possible security effects)

  • Authenticated Users (S-1-5-11)

  • Network (S-1-5-2)

  • Interactive (S-1-5-4)

  • Creator Owner (S-1-3-0)

  • Self (S-1-5-10)

As a best practice, avoid assigning permissions on objects to the following well-known security principals:

  • Network Service (S-1-5-20)

  • Local Service (S-1-5-19)

  • Local System (S-1-5-18)

The assignment of permissions on objects to any other well-known security principal should be made on a case-by-case basis, after considering the needs of the application.


Backing up and restoring ADAM

Backing up and restoring ADAM

Active Directory Application Mode (ADAM) data and log files should be backed up regularly to ensure the continued availability of data to applications and users in the event of a system failure.

Backing up ADAM

By default, each instance of ADAM running on an ADAM server stores its database file, Adamntds.dit, and the associated log files in %program files%\Microsoft adam\instancename\data. These files should be included as part of the regular backup plan of your organization. You can back up the directory stores using Backup or any Windows Logo Program, third-party backup utility. For information about backing up an ADAM instance, see Back up an ADAM instance to a file or a tape.

Note

You can use a restored backup of an ADAM instance to install an ADAM replica from media. For more information, see Install an ADAM replica from media.

Restoring ADAM

When you restore a database to an existing ADAM instance, you must stop the ADAM instance before you run the restore operation. In addition, it is recommended that you move (or delete) the existing database and log files from the ADAM instance before the restore operation.

Authoritative restore

If objects in the directory are inadvertently deleted or modified, and if those objects are replicated in a configuration set, you must authoritatively restore those objects so that the correct version of the objects are replicated. To authoritatively restore directory data, run the dsdbutil utility after you have restored the data but before you restart the ADAM instance. With dsdbutil, you can mark directory objects for authoritative restore. When an object is marked for authoritative restore, its update sequence number is changed so that the number is higher than any other update sequence number in the configuration set. This ensures that any data you restore is properly replicated throughout the configuration set.

For more information about restoring an ADAM instance, including authoritative restores, see Restore an ADAM instance.

Notes

  • If you restore an ADAM backup over a running ADAM instance, Backup leaves the restored files in a pending state, and it does not write the files to disk until the computer is rebooted. In this situation, any directory changes that are made to the running ADAM instance after Backup is run are lost.

  • If you accidentally start a restore of an ADAM instance over a currently running ADAM instance, it is recommended that you immediately restart the computer, stop the ADAM instance, and then perform the restoration again.


Selecting an ADAM service account

Selecting an ADAM service account

On the Service Account Selection page of the ADAM Setup Wizard, you must select a service account for use by the Active Directory Application Mode (ADAM) instance. The account that you select determines the security context in which the ADAM instance runs. Changing the service account after installation may require some additional configuration.

Note

The first ADAM instance in a configuration set determines the default replication authentication method.

Service account requirements

ADAM runs as a service, and it requires a service account. ADAM service account requirements depend on the Windows workgroup or domain environment into which you install ADAM, as well as the computer on which ADAM is running.

For ADAM instances that are joined to a configuration set, the service account is also used to authenticate against other ADAM instances in the configuration set for replication. The type of authentication that is used between replication partners is determined by the environment in which ADAM is running and by the service accounts in use. For more information, see Understanding ADAM replication and configuration sets.

The following table outlines ADAM service account requirements.

Security context | Service account for first ADAM instance | Service account for replica ADAM instances | Default replication authentication method**
Workgroup | Network Service | Replica ADAM instances not allowed | Not applicable
Workstation user | Workstation user | Negotiated pass-through* | Not applicable
Windows 2000 domain or forest -or- Windows Server 2003 domain or forest | Network Service -or- Domain user | Network Service -or- Domain user | Negotiated
Workstation user | Workstation user | Negotiated pass-through* | Not applicable
Domain user | Domain user -or- Network Service | Negotiated | Not applicable
Windows NT 4.0 domain | Workstation user Domain user | Workstation user Domain user | Negotiated pass-through* Negotiated

*When a workstation user account is used on the first ADAM instance in a configuration set, all subsequent ADAM instances in the same configuration set must use an identical local workstation account name and password as the ADAM service account.

**When the Network Service account is used as the ADAM service account, the replication authentication mode is set to Negotiated by default.

Notes

  • The Network Service account is a special, built-in account, with authority similar to that of an authenticated user account. The name of the account is NT AUTHORITY\NetworkService. The Network Service account has limited access to the local computer and authenticated access (as the computer account) to network resources. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Network Service account access network resources using the credentials of the computer account.

  • On Windows XP Professional, workstation and domain user accounts that are used as the ADAM service account must be members of the local Administrators group.

  • When you install ADAM on Windows XP Professional computers that are joined to a workgroup, you must edit the forceguest registry key to allow users to bind to ADAM successfully. For more information, see Enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup.

  • For additional considerations when running ADAM on Windows XP Professional, see Running ADAM on Windows XP Professional.

  • To enable auditing for an ADAM instance running under a service account other than the Network Service account, you must grant the Generate security audits right to the account that is used as the ADAM service account.

  • To enable a workstation or domain user account as a service account, you must grant the Log on as a service right to the account that is used as the ADAM service account. For more information, see Add the Log on as a service right to an account.

For more information, see Understanding ADAM architecture.


ADAM troubleshooting and frequently asked questions (FAQs)

Troubleshooting and frequently asked questions (FAQs)

The installation or removal of Active Directory Application Mode (ADAM) fails to complete successfully.

If no screen message appears and ADAM setup fails to complete successfully, you can view the setup log at:

  • %windir%\Debug\adamsetup.log

If no screen message appears and ADAM removal fails to complete successfully, you can view the uninstall log at:

  • %windir%\Debug\adamuninstall.log

A directory-enabled application cannot find an ADAM instance.

Be sure to reference the correct communications port number (that is, 389 or 636) when specifying an ADAM instance.

The ADAM service will not start.

If the service account that is specified for ADAM is a workstation or a domain user account, make sure that the account possesses the Run as a service right.

In an attempt to connect to an ADAM instance using the ADAM Schema snap-in, the following error message appears: "The schema FSMO holder could not be found. Schema modifications can only be made on the schema FSMO holder."

You can only modify the schema on the ADAM instance that holds the schema master role. To determine the holder of the schema master role for a configuration set, see Identify or transfer the schema master role.

How do I set or modify the password of an ADAM user?

For information about modifying passwords, see Set or modify the password of an ADAM user.

I can't bind to an ADAM instance that runs on a computer running Windows XP Professional.

When the computer that runs ADAM is joined to a workgroup, you must set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest to 0. (The default is 1.) Otherwise, users connecting to ADAM over the network are forced to a security context of Guest, and binds to ADAM fail. For more information, see Enable binding to ADAM instances running on Windows XP Professional computers joined to a workgroup.

For information about other functional considerations when running ADAM on Windows XP Professional, see Running ADAM on Windows XP Professional.

I can't connect to an ADAM instance over an SSL connection.

To enable SSL connections, you must first install certificates on the computer running ADAM and on all client computers. For information about setting up and using certificate services, see "Certificate Services" on the Microsoft TechNet Web site.

On computers running Windows XP Professional that need to establish SSL connections to an ADAM instance, you must install the hotfix that is described in article 817583 in the Microsoft Knowledge Base Web site.

For information about other functional considerations when running ADAM on Windows XP Professional, see Running ADAM on Windows XP Professional.

I can't create an organizational unit (OU) in my application directory partition.

OUs can only be created under the following objects:

  • OU (ou=)

  • country/region (c=)

  • organization (o=)

  • domain (dc=)

For example, you can create an OU in an application partition named O=Microsoft,C=US, but you cannot create an OU in an application partition named l=Microsoft,C=US.

I can't locate the security IDs (SIDs) for an ADAM or Windows security principal.

You can retrieve an active user's individual and group SIDs by explicitly querying the tokenGroups attribute on the rootDSE.

Can two ADAM instances running on the same computer belong to the same ADAM configuration set?

This configuration is not supported currently, and it is not recommended for production environments.

Do multivalued attributes in ADAM have a limit to the number of values that they can hold?

ADAM (as with Active Directory running at Windows Server 2003 forest functional level) places no limits on the number of linked attribute values that a multivalued attribute can hold. For nonlinked values, it is recommended that a multivalued attribute contain no more than 1,500 values.

For information about linked attributes, see "Linked Attributes" on the Microsoft MSDN Web site. For information about member as an example of a multivalued attribute in Active Directory, see "Enumerating Groups That Contain Many Members" on the Microsoft MSDN Web site.

How can ADAM be configured to support anonymous LDAP binds?

ADAM does not accept anonymous bind requests by default. To enable anonymous LDAP operations in ADAM, you must set the seventh character of the dsHeuristics value to 2.

You can find the dsHeuristics attribute on the Directory Service object in the configuration directory partition (CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,CN={GUID}).

Modify the attribute to the following value:

0000002001000

In addition, assign permissions so that anonymous users have access to the appropriate objects in the directory. To grant the Read permission on all objects in a given directory partition to anonymous users, you can simply add the built-in security principal Anonymous (from the local computer) to the Readers group on that directory partition.


ADAM Administration Tools

ADAM administration tools

  • ADAM ADSI Edit

  • ADAM Csvde

  • ADAM Ldifde

  • Adaminstall

  • Adamsync

  • Adamuninstall

  • ADSchemaAnalyzer

  • Dsacls

  • Dsdbutil

  • Dsdiag

  • Dsmgmt

  • Ldp

  • Repadmin


ADAM ADSI Edit

ADAM ADSI Edit

ADAM ADSI Edit runs as a Microsoft Management Console (MMC) snap-in. To start ADAM ADSI Edit, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.

The following sections describe user interface (UI) options in the ADAM ADSI Edit snap-in, depending on the node that you click in the console tree or the command that you click in the Action menu.

  • ADAM ADSI Edit Node

  • Connection Node

  • Object Node

ADAM ADSI Edit Node

To view the following UI options, in the console tree, click ADAM ADSI Edit, and then, on the Action menu, click:

Connect to

The following dialog box appears:

Connection Settings

You can use the following options in the Connection Settings dialog box to create a connection to a directory partition on an ADAM instance:

Connection name. Type a display name for the connection. The connection will be listed in the console tree using the connection name that you provide.

Server name. The computer name, or DNS host name, of the ADAM instance to which you want to connect.

Port. The Lightweight Directory Access Protocol (LDAP) communications port number in use by the ADAM instance to which you want to connect. The default LDAP port is 389.

Note

ADAM ADSI Edit does not support Secure Sockets Layer (SSL) connections.

Distinguished name (DN) or naming context. Click this option if you want to specify the distinguished name of the directory partition to which you want to connect.

Well-known naming context. Click this option if you want to connect to one of the well-known naming contexts, which include Configuration, RootDSE, and Schema.

The account of the currently logged on user. Click this option if you want to connect to the ADAM instance using the security context of the account that you are currently using.

This account. Click this option if you want to specify a different account to use when connecting to the ADAM instance.

Refresh

Updates the information about connections and objects that is displayed in ADAM ADSI Edit.

Connection node

To view the following commands, in the console tree, click a connection node for an already established connection, and then, on the Action menu, click:

Remove

Removes the currently selected connection node from ADAM ADSI Edit. This command only affects the contents of the ADAM ADSI Edit console tree; the command does not delete any objects from the ADAM instance.

Update Schema Now

Reloads the schema information from ADAM into the cache of the local computer.

New

Creates a new query when you point to New and then click Query.

Refresh

Updates the information about connections and objects that is displayed in ADAM ADSI Edit.

Object node

To view the following commands, in the console tree, click a directory object in a directory partition in an ADAM instance, and then, on the Action menu, click:

Move

Moves the object to another container in ADAM. Opens a dialog box that you can use to select the destination container.

New Connection from Here

Creates a new connection and adds the new connection to the console tree.

New

Creates a new child object in the selected container when you point to New and then click Object. Opens a set of chained dialog boxes that begins with the class of the object. If you do not have permission to create an object in the selected container, no classes are listed. After a class is selected, a dialog box opens for each required attribute. In the final dialog box, click More to view and edit any optional attributes.

Delete

Deletes the selected object from ADAM. A dialog box appears asking you to confirm the deletion. This command does not appear in the menu if you do not have permissions to delete the object from ADAM.

Rename

Changes the name of the object in ADAM.

Refresh

Updates the information that is displayed in ADAM ADSI Edit about connections and objects.

Properties

Opens a dialog box in which you can edit the attribute values of an object.

Reset Password

This option is available only for objects that contain a unicodePwd attribute. This option provides a dialog box in which the value of the unicodePwd attribute can be reset.


ADAM Csvde

Csvde

Imports and exports data from Active Directory using files that store data in the comma-separated value (CSV) format. You can also support batch operations based on the CSV file format standard.

Syntax

csvde [-i] [-f FileName] [-s ServerName] [-c String1 String2] [-v] [-j Path] [-t PortNumber] [-d BaseDN] [-r LDAPFilter] [-p Scope] [-l LDAPAttributeList] [-o LDAPAttributeList] [-g] [-m] [-n] [-k] [-a UserDistinguishedName Password] [-b UserName Domain Password]

Parameters

-i
Specifies the import mode. If the import mode is not specified, the default mode is export.
-f FileName
Identifies the import or export file name.
-s ServerName
Specifies the domain controller to perform the import or export operation.
-c String1 String2
Replaces all occurrences of String1 with String2. This is generally used when you are importing data from one domain to another and the distinguished name of the export domain (String1) needs to be replaced with the distinguished name of the import domain (String2).
-v
Sets verbose mode.
-j Path
Sets the log file location. The default is the current path.
-t PortNumber
Specifies a Lightweight Directory Access Protocol (LDAP) port number. The default LDAP port is 389. The global catalog port is 3268.
-d BaseDN
Sets the distinguished name of the search base for data export.
-r LDAPFilter
Creates an LDAP search filter for data export.
-p Scope
Sets the search scope. Search scope options are Base, OneLevel, or SubTree.
-l LDAPAttributeList
Sets the list of attributes to appear in the results of an export query. If this parameter is omitted, all attributes are returned.
-o LDAPAttributeList
Sets the list of attributes to be omitted from the results of an export query. This is typically used when exporting objects from Active Directory and then importing them into another LDAP-compliant directory. If the attributes are not supported by another directory, you can omit the attributes from the result set using this option.
-g
Omits paged searches.
-m
Omits attributes that cannot be written, such as the ObjectGUID and objectSID attributes.
-n
Omits export of binary values.
-k
Ignores errors during the import operation, and continues processing. The following is a complete list of ignored errors: "Object already exists," "Constraint violation," and "Attribute or value already exists."
-a UserDistinguishedName Password
Sets the command to run using the supplied UserDistinguishedName and Password. By default, the command runs using the credentials of the user who is currently logged on to the network.
-b UserName Domain Password
Sets the command to run as UserName Domain Password. By default, the command will run using the credentials of the user who is currently logged on to the network.
-?
Displays the command menu.

Remarks

  • Applications such as Microsoft Excel are capable of reading and saving data in the CSV format. In addition, Microsoft Exchange Server administration tools are also capable of importing and exporting data using the CSV format, as are many other non-Microsoft tools.

    The CSV format consists of one or more lines of data, with each value separated by a comma. The first line (sometimes referred to as the header) of the CSV file must contain the names of each attribute in the same order as the data in any line following the first line.

    Example:

    CN , FirstName , SurName , Description

    FirstUserLogonName , 1stUserFirstName , 1stUserSurName , Manager

    SecondUserLogonName , 2ndUserFirstName , 2ndUserSurName , President

  • You can use csvde -r to create an LDAP search filter for data export. For example, the following filter exports all users with a particular surname: csvde -r (and(objectClass=User)(sn=SurName))

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


ADAM Ldifde

Ldifde

Creates, modifies, and deletes directory objects. You can also use ldifde to extend the schema, export user and group information to other applications or services, and populate Active Directory Application Mode (ADAM) with data from other directory services.

Syntax

ldifde [-i] [-f FileName] [-s ServerName] [-c String1 String2] [-v] [-j Path] [-t PortNumber] [-d BaseDN] [-r LDAPFilter] [-p Scope] [-l LDAPAttributeList] [-o LDAPAttributeList] [-g] [-m] [-n] [-k] [-a UserDistinguishedName Password] [-b UserName Domain Password] [-?]

Parameters

-i
Specifies import mode. If not specified, the default mode is export.
-f FileName
Identifies the import or export file name.
-s ServerName
Specifies the computer on which to perform the import or export operation. By default, ldifde will run on the computer on which ldifde is installed.
-c String1 String2
Replaces all occurrences of String1 with String2. This is generally used when importing data from one domain to another and the distinguished name of the export domain (String1) needs to be replaced with that of the import domain (String2).
-v
Sets verbose mode.
-j Path
Sets the log file location. The default is the current path.
-t PortNumber
Specifies a Lightweight Directory Access Protocol (LDAP) port number. The default LDAP port is 389. The global catalog port is 3268.
-d BaseDN
Sets the distinguished name of the search base for data export.
-r LDAPFilter
Creates an LDAP search filter for data export. For example, to export all users with a particular surname, you can use the following filter: -r (and(objectClass=User)(sn=SurName))
-p Scope
Sets the search scope. Search scope options are Base, OneLevel, or SubTree.
-l LDAPAttributeList
Sets the list of attributes to return in the results of an export query. If this parameter is omitted, all attributes are returned.
-o LDAPAttributeList
Sets the list of attributes to omit from the results of an export query. This is typically used when exporting objects from Active Directory and then importing them into another LDAP-compliant directory. If attributes are not supported by another directory, you can omit the attributes from the result set using this option.
-g
Omits paged searches.
-m
Omits attributes that cannot be written, such as the ObjectGUID and objectSID attributes.
-n
Omits export of binary values.
-k
Ignores errors during the import operation, and continues processing. The following is a complete list of ignored errors:
  • Object is already a member of the group.

  • Object class violation (meaning that the specified object class does not exist), if the object being imported has no other attributes.

  • Object already exists.

  • Constraint violation.

  • Attribute or value already exists.

  • No such object.

-a UserDistinguishedName Password
Sets the command to run using the supplied UserDistinguishedName and Password. By default, the command will run using the credentials of the user who is currently logged on to the network. Cannot be used with the -b option.
-b UserName Domain Password
Sets the command to run using the supplied UserName Domain Password. By default, the command will run using the credentials of the user who is currently logged on to the network. Cannot be used with the -a option.
-?
Displays the command menu.

Remarks

  • With the -c parameter, you can use the constants #schemaNamingContext and #configurationNamingContext in place of the distinguished names of the schema directory partition and configuration directory partition.

  • When you create the import file to use with the ldifde command, use a changeType value to define the type of changes the import file will contain. The changeType values in the following table are available.

    Value Description

    add

    Specifies that new content is contained in the import file.

    modify

    Specifies that existing content has been modified in the import file.

    delete

    Specifies that content has been deleted in the import file.

The following is an example of an LDAP Data Interchange Format (LDIF) import file format using the add value:

DN: CN=SampleUser,DC=DomainName

changetype: add

CN: SampleUser

description: DescriptionOfFile

objectClass: User

userPrincipalName: SampleUser

Examples

To retrieve only the distinguished name, common name, first name, surname, and telephone number of the returned objects, type:

-l DistinguishedName, CN, GivenName, SN, Telephone

To omit the globally unique identifier (GUID) for an object, type:

-o whenCreated, whenChanged, objectGUID

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Adaminstall

Adaminstall

Performs an unattended installation of Active Directory Application Mode (ADAM) using a preconfigured setup script file.

Syntax

adaminstall [/q] [/answer:filename]

Parameters

/q
Runs adamsetup without displaying progress information on the screen.
/answer: filename
Specifies an unattended ADAM installation, using the answer file that is indicated by filename.
/?
Displays help at the command prompt.

Examples

The following example shows an unattended installation of ADAM using a setup script file called answer.txt:

adaminstall /answer: drive:\pathname\answer.txt

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output

See Also

  • Perform an unattended install of an ADAM instance
  • Adamuninstall


Adamsync

Adamsync

Synchronizes objects from Active Directory to an Active Directory Application Mode (ADAM) instance.

Syntax

adamsync [/?] [/l] [/d configuration_dn] [/i input_file] [/download configuration_dn output_file] [/export configuration_dn output_file] [/sync configuration_dn] [/reset configuration_dn] [/mai configuration_dn] [/fs configuration_dn] [/ageall configuration_dn] [/so configuration_dn object_dn] [/passPrompt]

Parameters

/?
Displays command-line options.
/l or /list
Displays all available configurations of Active Directory to ADAM Synchronizer.
/d or /delete configuration_dn
Deletes the specified configuration.
/i or /install input_file
Installs the configuration contained in the specified input file.
/download configuration_dn output_file
Creates an output file in XML containing the specified configuration.
/export configuration_dn output_file
Saves the current configuration to the specified output file.
/sync configuration_dn
Synchronizes the specified configuration.
/reset configuration_dn
Resets the replication cookie of the specified configuration.
/mai configuration_dn
Configures the specified configuration as the authoritative instance.
/fs configuration_dn
Performs a full replication synchronization for the specified configuration.
/ageall configuration_dn
Performs an aging run for the specified configuration.
/so configuration_dn object_dn
Performs a replication synchronization for the specified object in the specified configuration. Use the distinguished name of the object.
/passPrompt
Prompts for user credentials.

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output

See Also

  • Perform an unattended install of an ADAM instance
  • Adaminstall
  • Remove an ADAM instance


Adamsync Configuration File XML Reference

The following topics provide reference information for XML elements that are used in the configuration file for Active Directory to ADAM Synchronizer.

  • account-domain

  • aging

  • attributes

  • base-dn

  • configuration

  • description

  • exclude

  • frequency

  • include

  • num-objects

  • object-filter

  • query

  • schedule

  • schtasks-cmd

  • security-mode

  • source-ad-account

  • source-ad-name

  • source-ad-partition

  • source-object-class

  • synchronizer-state

  • target-dn

  • target-object-class

  • user-proxy


account-domain

Contains the domain name to use for authentication on the source forest.

Usage

<account-domain/>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes

Remarks

The <source-ad-account> element and the <account-domain> element combine to create the account domain and name to use for alternate credentials. For example, if the account to use is "fabrikam\jsmith", <account-domain> would contain "fabrikam" and <source-ad-account> would contain "jsmith".


aging

Contains elements that describe how often an aging search is performed and how many objects to search for in the aging run.

Usage

<aging/>

Attributes

None.

Child Elements

<frequency>

<num-objects>

Parent Elements

<schedule>

Child Element Sequence

The tree shows the ordering and number of child elements. Child elements in a Sequence must appear in the order given and child elements in a Choice are mutually exclusive. Sequences and Choices can be nested. Element names are followed by the minimum and maximum occurrences.

frequency (Minimum = 0; Maximum = 1)
num-objects

Element Information

Can be empty

No

Remarks

An aging search is performed to determine if the objects in ADAM have been deleted from Active Directory. This is accomplished by searching for the ADAM objects in Active Directory because this is the only consistent way to determine if an object has been deleted in Active Directory.


attributes

Contains elements to specify the attributes to include or exclude in a search.

Usage

<attributes/>

Attributes

None.

Child Elements

<include>

<exclude>

Parent Elements

<query>

Child Element Sequence

The tree shows the ordering and number of child elements. Child elements in a Sequence must appear in the order given and child elements in a Choice are mutually exclusive. Sequences and Choices can be nested. Element names are followed by the minimum and maximum occurrences.

Sequence
    include (Minimum = 0; Maximum = many)
    exclude (Minimum = 0; Maximum = many)
Sequence

Element Information

Can be empty

Yes

Remarks

If this element does not contain any child elements, then all attributes are included in the search.

Attributes can either be included or excluded, but not both. If one or more attributes are included, only those object attributes are included in the search. If one or more attributes are excluded, all attributes are included in the search except those that are specifically excluded.


base-dn

Contains the distinguished name of the base object where the search will begin. The search is performed only on this object and objects that exist below it in the directory tree.

Usage

<base-dn/>

Attributes

None.

Child Elements

None.

Parent Elements

<query>

Element Information

Can be empty

Yes


configuration

The <configuration> element is the root element that contains the configuration data that is required by Active Directory to ADAM Synchronizer.

Usage

<configuration/>

Attributes

None.

Child Elements

<description>

<security-mode>

<source-ad-name>

<source-ad-partition>

<source-ad-account>

<account-domain>

<target-dn>

<user-proxy>

<query>

<schedule>

<synchronizer-state>

Parent Elements

None.

Child Element Sequence

The tree shows the ordering and number of child elements. Child elements in a Sequence must appear in the order given and child elements in a Choice are mutually exclusive. Sequences and Choices can be nested. Element names are followed by the minimum and maximum occurrences.

description (Minimum = 0; Maximum = 1)
security-mode (Exactly 1)
source-ad-name (Exactly 1)
source-ad-partition (Exactly 1)
source-ad-account (Exactly 1)
account-domain (Minimum = 0; Maximum = 1)
target-dn (Minimum = 0; Maximum = 1)
user-proxy (Minimum = 0; Maximum = 1)
query (Exactly 1)
schedule (Minimum = 0; Maximum = 1)
synchronizer-state

Element Information

Can be empty

No


description

Contains a string that describes the configuration file. This string can be any length.

Usage

<description>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes


exclude

Contains the Lightweight Directory Access Protocol (LDAP) display name of an attribute to exclude in the query during synchronization.

Usage

<exclude/>

Attributes

None.

Child Elements

None.

Parent Elements

<attributes>

Element Information

Can be empty

Yes


frequency

Contains the number of synchronization runs that will occur before an aging search will be performed. This value must be a positive integer.

Usage

<frequency/>

Attributes

None.

Child Elements

None.

Parent Elements

<aging>

Element Information

Can be empty

Yes

Remarks

Setting this value to "1" will verify the objects on every synchronization run. Setting this value to "2" will verify the objects on every other synchronization run.


include

Contains the LDAP display name of an attribute to include in the query during synchronization.

Usage

<include/>

Attributes

None.

Child Elements

None.

Parent Elements

<attributes>

Element Information

Can be empty

Yes


num-objects

Contains the number of objects to search for in each aging search.

Usage

<num-objects/>

Attributes

None.

Child Elements

None.

Parent Elements

<aging>

Element Information

Can be empty

Yes


object-filter

Contains the Lightweight Directory Access Protocol (LDAP) query string.

Usage

<object-filter/>

Attributes

None.

Child Elements

None.

Parent Elements

<query>

Element Information

Can be empty

Yes

Remarks

Characters that are reserved for use by XML, such as "<", ">" and "&" must be properly formatted to prevent the XML from being invalidated. For example, the "&" character is replaced by the "&amp;" string. This is known is a character reference.


query

Contains child elements that describe the query that is used to search Active Directory for objects to synchronize.

Usage

<query/>

Attributes

None.

Child Elements

<base-dn>

<object-filter>

<attributes>

Parent Elements

None.

Child Element Sequence

The tree shows the ordering and number of child elements. Child elements in a Sequence must appear in the order given and child elements in a Choice are mutually exclusive. Sequences and Choices can be nested. Element names are followed by the minimum and maximum occurrences.

base-dn (Minimum = 1; Maximum = many)
object-filter
attributes (Minimum = 0; Maximum = 1)

Element Information

Can be empty

No

Remarks

All filtering is performed on the client side of the operation, not the server side.


schedule

Contains elements that describe how often to verify deleted objects and changed attribute values in Active Directory.

Usage

<schedule/>

Attributes

None.

Child Elements

<aging>

<schtasks-cmd>

Parent Elements

None.

Child Element Sequence

The tree shows the ordering and number of child elements. Child elements in a Sequence must appear in the order given and child elements in a Choice are mutually exclusive. Sequences and Choices can be nested. Element names are followed by the minimum and maximum occurrences.

aging (Minimum = 0; Maximum = 1)
schtasks-cmd (Minimum = 0; Maximum = 1)

Element Information

Can be empty

Yes


schtasks-cmd

Reserved for future use.

Usage

<schtasks-cmd/>

Attributes

None.

Child Elements

None.

Parent Elements

None.

Element Information

Can be empty

Yes


security-mode

Defines the security mode of the synchronization.

Usage

<security-mode/>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes

Remarks

This element can contain either "partition" or "object". Any other value is invalid.

If this element contains "partition", the user account must have Replicate Directory Changes permissions on the source partition to synchronize objects.

If this element contains "object", the user account requires only readaccess to the objects to be synchronized.


source-ad-account

Contains the account name to use for authentication on the source forest. If this element is empty, the synchronizer will use the credentials of the account that is currently logged on.

Usage

<source-ad-account/>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes

Remarks

The <source-ad-account> element and the <acocunt-domain> element combine to create the account domain and name to use for alternate credentials. For example, if the account to use is "fabrikam\jsmith", <account-domain> would contain "fabrikam" and <source-ad-account> would contain "jsmith".

Because passwords should never be stored as plain text in an XML file, the ADAM synchronizer will request the password from the user when the configuration is installed. This password will be encrypted and stored by the synchronizer for use when the synchronization is performed.


source-ad-name

Contains the name of the Active Directory forest that is the source of the synchronization.

Usage

<source-ad-name/>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes

Remarks

If this element contains a fully-qualified distinguished name, it will be resolved using the domain controller locator. If an LDAP bindable name is specified, such as a DNS name, this object will be bound to.


source-ad-partition

Contains the distinguished name of the Active Directory partition that is the source of the synchronization.

Usage

<source-ad-partition>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes


source-object-class

Contains the Lightweight Directory Access Protocol (LDAP) display name of the schema class on the source that should be converted when objects of this type are copied to Active Directory Application Mode (ADAM).

Usage

<source-object-class/>

Attributes

None.

Child Elements

None.

Parent Elements

<user-proxy>

Element Information

Can be empty

Yes

Remarks

These elements should be user principals only.

Object classes that are derived from this class are not converted. You must specify a separate <source-object-class> element for each object class to be converted.


synchronizer-state

Contains information that is reserved for use by the synchronizer. You should not modify any information in this element.

Usage

<synchronizer-state/>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes


target-dn

Contains the distinguished name of the Active Directory Application Mode (ADAM) partition that is the destination of the synchronization.

Usage

<target-dn/>

Attributes

None.

Child Elements

None.

Parent Elements

<configuration>

Element Information

Can be empty

Yes


target-object-class

Contains the Lightweight Directory Access Protocol (LDAP) display name of the schema class to which the objects will be converted.

Usage

<target-object-class/>

Attributes

None.

Child Elements

None.

Parent Elements

<user-proxy>

Element Information

Can be empty

Yes

Remarks

All objects of the classes that are specified by the preceding <source-object-class> elements will be converted to this type during the conversion.

This class should have all the necessary attributes for each <source-object-class> in its schema definition.


user-proxy

Contains the list of source object classes that should be converted during the synchronization.

Usage

<user-proxy/>

Attributes

None.

Child Elements

<source-object-class>

<target-object-class>

Parent Elements

<configuration.

Child Element Sequence

The tree shows the ordering and number of child elements. Child elements in a Sequence must appear in the order given and child elements in a Choice are mutually exclusive. Sequences and Choices can be nested. Element names are followed by the minimum and maximum occurrences.

Sequence
    source-object-class (Minimum = 1; Maximum = many)
    target-object-class (Exactly 1)
Sequence

Element Information

Can be empty

No

Remarks

This element contains one or more <source-object-class> elements, followed by a single <target-object-class> element. All objects of the class specified by the <source-object-class> elements will be converted into the type specified by the <target-object-class> element.

Object classes that are derived from the classes specified by the <source-object-class> elements are not converted. You must specify a separate <source-object-class> element for each object class to be converted.

The <source-object-class> elements should contain only user principles.

If no conversion is needed, it is recommended that you include a single, empty <source-object-class> element in this element.


Adamuninstall

Adamuninstall

Uninstalls an Active Directory Application Mode (ADAM) instance.

Syntax

adamuninstall [/q] [/answer:filename] [/force] {/i:instancename | /tools}

Parameters

/q
Runs adamuninstall without displaying progress information on the screen.
/answer: filename
Specifies the name of the answer file, represented by filename, that contains preconfigured values for ADAM uninstall. This answer file can be used to specify the account and password of the ADAM administrator, using the following syntax: Administrator= domain\account AdministratorPassword= password where domain\account represents the account of the ADAM administrator and password represents the corresponding password.
/force
Causes adamuninstall to ignore any warnings and continue the removal of a given ADAM instance. Adamuninstall automatically skips any operations that generate warnings.
/i: instancename
Uninstalls an ADAM instance named instancename, and also uninstalls the ADAM administration tools.
/tools
Uninstalls the ADAM administration tools only.

Remarks

  • If service principal names (SPN) in Active Directory exist for the ADAM instance that is being uninstalled, and adamuninstall cannot remove the SPNs automatically, adamuninstall creates a .bat file that can be used to remove the SPNs manually. This .bat file is located at %windir%\Debug\domain-servicename.bat, where domain represents the Active Directory domain in which the ADAM instance resides, and servicename represents the service name of the ADAM instance. (By default, the service name of an ADAM instance is ADAM_instancename, where instancename is the ADAM instance name that you provide during ADAM setup.)

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output

See Also

  • Perform an unattended install of an ADAM instance
  • Adaminstall
  • Remove an ADAM instance


ADSchemaAnalyzer

ADSchemaAnalyzer

You can use ADSchemaAnalyzer to help migrate the Active Directory schema to ADAM. To start ADSchemaAnalyzer, click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then at the command prompt type: adschemaanalyzer.

The following sections describe commands on the ADSchemaAnalyzer menus:

  • File

  • Schema

  • Tools

File

The following table describes commands on the File menu.

Command | Description
Load target schema | Opens a dialog box that you can use to authenticate to a specified Lightweight Directory Access Protocol (LDAP) server. Type a user name and password of an account that has permissions to the LDAP server. If you do a simple bind with an empty password, you are connected with anonymous credentials. Select the server type to load the target schema from. To select an LDAP Data Interchange Format (LDIF) file to load, click Load LDIF.
Load base schema | Opens a dialog box that you can use to authenticate to a specified LDAP server. Type a user name and password of an account that has permissions to the LDAP server. If you do a simple bind with an empty password, you are connected with anonymous credentials. Select the server type to load the base schema from. To select an LDIF file to load, click Load LDIF.
Create LDIF file | Produces an LDIF file that contains all selected schema elements.

Schema

The following table describes commands on the Schema menu.

Command | Description
Hide present elements | Hides all elements that are present on the target server.
Show present elements | Shows all elements that are present on the target server.
Mark all non-present elements as included | Marks all elements that are not present on the target server as included for export.

Tools

The following table describes commands on the Tools menu.

Options

Opens a dialog box that you can use to set options for ADSchemaAnalyzer. The following table describes options on the tabs in the Options dialog box.

Tab Description

Dependencies graph

The following table describes options on the Dependencies graph tab.

Option | Description
AttributeSecurityGUID (attribute to propset reference) | Select this option to display attributes that belong to a propset.
AppliesTo (propset to class reference) | Select this option to display classes that reference a given attribute or class.
Show Dependents node | Select this option to show the Dependents node in the tree for each element.

LDIF generation

The following table describes options on the LDIF generation tab.

Option | Description
Don't update present elements | Use this option if you do not want to update present elements in the LDIF file.
Update with references to new elements only | Use this option to update the LDIF file with references to new elements.
Update with references to new and present elements | Use this option to update the LDIF file with references to new and present elements.
Allowed to write systemPossSureriors and systemAuxClasses as possSuperiors and auxClasses, if schema circular dependencies exist | Use this option if there are schema circular dependencies and you want to import the schema by writing systemPossSuperiors as possSuperiors and systemAuxClasses as auxClasses.

Miscellaneous

The following table describes options on the Miscellaneous tab.

Option | Description
Marking an element as present marks all its subelements as present | Select this option to mark all subelements as present automatically when you mark an element as present in the tree.
Debug output | Select this option to debug the output of the LDIF file.

Right-click schema elements in the tree to mark them as Auto, Included, Excluded, or Present:

  • Auto automatically marks an element as included or excluded in the export. If an element is marked as Auto (included), you can right-click that element and then click Why auto included? to see the reverse dependency tree for the element.

  • Included marks the element so that it is included in the export. ADSchemaAnalyzer marks all related elements, such as superclasses, aux classes, must/may contains, defaultObjectCategory, and possSuperiors. ADSchemaAnalyzer includes propsets for included attributes and back-links for links.

  • Excluded marks the element so that it is not included in the export. You can block certain paths in the dependency graph. For example, you might want to import domainDns, but not samAccountDomain (which is an auxClass of domainDns). You can exclude a complete element, such as the samAccountDomain class, or you can exclude a relationship; for example, you can remove the auxClass reference from the domainDns class. If you exclude a relationship, any other classes that reference that element continue to include it.

  • Present means that the element is present on the target server. By default, the top class is marked as present.


Dsacls

Dsacls

Displays and changes permissions (access control entries (ACEs)) in the access control list (ACL) of objects in Active Directory Application Mode (ADAM).

The ACEs that you add by using dsacls must be object-specific permissions that override the default partition permissions that are defined in the ADAM schema. Do not add ACEs unless you are well informed about security for ADAM objects.

If you specify an object without additional parameters, dsacls displays the ACEs in the ACL.

Syntax

dsacls "[\\Computer\]ObjectDN" [/A] [/D PermissionStatement [PermissionStatement]...] [/G PermissionStatement [PermissionStatement]...] [/I:{T | S | P}] [/N] [/P:{Y | N}] [/R {User | Group} [{User | Group}]...] [/S [/T]] [/resetDefaultACL] [/resetDefaultSACL] [/takeOwnership] [/simple] [/domain: domain] [/user: username] [/passwd: {password | * }] [/?]

Parameters

"[\\Computer\]ObjectDN"
Identifies the Active Directory object to investigate. Type the distinguished name of the object. To specify an object on a remote computer, type the computer name followed by the distinguished name. This parameter must be enclosed in quotation marks. Example: "CN=Kim Akers,CN=Users,DC=domain,DC=test,DC=microsoft,DC=com" or "\\Server01\CN=Kim Akers,CN=Users,DC=domain,DC=test,DC=microsoft,DC=com"
/A
Adds ownership and auditing information to the display.
/D PermissionStatement [PermissionStatement]...
Denies the specified permissions to the user or group. You can deny permissions to multiple users in each /D command. Example: /D Domain1\User1:CCDC Domain1\User2:DC;computer
/G PermissionStatement [PermissionStatement]...
Grants specified permissions to the user or group. You can grant permissions to multiple users in each /G command Example: /G Domain1\User1:CCDC Domain1\User2:DC;computer
/I:{T | S | P}
Specifies the objects to which the permissions are applied. This parameter determines whether the permissions are inheritable. T is the default.

Value | Description
T | This object and subobjects
S | Subobjects only
P | Propagate inheritable permissions one level only
/N
Provides that the specified ACE replaces the ACEs in the ACL. By default, the ACE is added to the ACL.
/P:{Y | N}
Determines whether the object is protected so that it cannot inherit permissions from its parent objects. If you omit this parameter, the inheritance properties of the object are not changed.

Value | Description
Y | The object is protected, and it cannot inherit permissions.
N | The object is not protected, and it can inherit permissions.

Note

  • This parameter changes a property of the object, not of an ACE. To determine whether an ACE is inheritable, use the /I parameter.

/R {User | Group} [{User | Group}]...
Deletes all ACEs for the specified users or groups. User can be specified as User@Domain or as Domain\User. Group can be specified as Group@Domain or as Domain\Group. You can delete ACEs for multiple users and groups in a single /R parameter Example: /R Domain1\User1 Domain1\User2
/S
Restores the security on the object to the default for that object class, as defined in the Active Directory schema.
/T
Restores the security on the tree of objects to the default for each object class. This parameter is valid only with the /S parameter.
/resetDefaultDACL
Restores the DACL on the object to the default setting for the object, based on the schema definition for the object class.
/resetDefaultSACL
Restores the SACL on the object to the default setting, based on the schema definition for the object class.
/takeOwnership
Assigns object owernship to the account under which Dsacls is running.
/simple
Specifies to bind to the directory server using an LDAP simple bind.
/domain: domain
Specifies to bind to the directory server using an account from the domain represented by domain.
/user: username
Specifies to bind to the directory server using the account represented by username.
/passwd: password
Specifies to bind to the directory server using the password represented by password. If no password is specified, the user is prompted for a password.
/?
Displays help for dsacls.

Syntax for PermissionStatement

PermissionStatement values use the following format:

{User | Group}:Permissions[;{ObjectType | Property}][;InheritedObjectType]

Parameters

{User | Group}
Specifies the user or group to whom the rights apply. User can be specified as a distinguished name, User@Domain, or Domain\User. Group can be specified as a distinguished name, Group@Domain, or Domain\Group.
Permissions
Type one or more of the values in the following tables (without spaces).

Generic Permissions

Value | Description
GR | Generic Read
GE | Generic Execute
GW | Generic Write
GA | Generic All

Specific Permissions

Value Description

SD

Delete.

DT

Delete an object and all of its children.

RC

Read security information.

WD

Change security information.

WO

Change owner information.

LC

List the children of an object.

CC

Create a child object.

If {ObjectType | Property} is not specified to define a specific child-object type, this applies to all types of child objects; otherwise, it applies to the specified child-object type.

DC

Delete a child object.

If {ObjectType | Property} is not specified to define a specific child-object type, this applies to all types of child objects; otherwise, it applies to the specified child-object type.

WS

Write to self object.

This is meaningful only on Group objects and when {ObjectType | Property} is a "member."

RP

Read property.

If {ObjectType | Property} is not specified to define a specific property, this applies to all properties of the object; otherwise, it applies to the specified property of the object.

WP

Write property.

If {ObjectType | Property} is not specified to define a specific property, this applies to all properties of the object; otherwise, it applies to the specified property of the object.

CA

Control access right.

If {ObjectType | Property} is not specified to define the specific extended right for control access, this applies to all meaningful control accesses on the object; otherwise, it applies to the specific extended right for that object.

LO

List the object access.

Can be used to grant list access to a specific object if List Children (LC) is not granted to the parent as well. Can also be denied on specific objects to hide those objects if the user/group has LC permission on the parent.

Note

  • Active Directory does not enforce this permission by default. Active Directory must be configured to check for this permission.
{ObjectType | Property}
Limits the permission to the specified object type or property. Type the display name of the object type or the property. If an object type or property is not specified, the permission applies to all object types and properties. For example, the following command permits the user to create all types of child objects: /G Domain\User:CC However, the following command permits the user to create only child computer objects: /G Domain\User:CC;computer
InheritedObjectType
Limits inheritance of the permission to the specified type of object. Type the display name of the object type. If an object type is not specified, the permission can be inherited by all object types. This parameter is used only when permissions are inheritable. For example, the following command permits all types of objects to inherit the permission: /G Domain\User:CC However, the following command permits only user objects to inherit the permission: /G Domain\User:CC;;user

Examples

SDRCWDWO;;user

Delete, read security information. Change security information and change ownership permissions on objects of the type "user."

CCDC;group;

Create child and delete child permissions to create or delete objects of the type "group."

RPWP;telephonenumber;

Read property and write property permissions on the telephone number property.

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Dsdbutil

Dsdbutil

Provides management facilities for Active Directory Application Mode (ADAM). This tool is intended for use by experienced administrators.

Note

Some dsdbutil commands can be used only against ADAM instances that are not currently running.

The syntax for each command is listed below.

  • activate instance

  • authoritative restore

  • change service account

  • files

  • LDAP port

  • list instances

  • popups

  • quit

  • semantic database analysis

  • set DSRM Password

  • SSL port

activate instance

Specifies the ADAM instance to be managed. At the dsdbutil: prompt, type the command using the syntax below. You cannot activate an ADAM instance if that ADAM instance is currently running.

Syntax

activate instance instancename

Instancename
Specifies the name of an ADAM instance to be managed.

authoritative restore

Restores an ADAM instance to a specific point in time by marking objects in ADAM as being authoritative with respect to their replication partners. At the authoritative restore: prompt, type any of the parameters listed under "Syntax."

Syntax

{restore database|restore database verinc %d|restore subtree %s|restore subtree %s verinc %d|restore object %s|restore object %s verinc %d}

Parameters

restore database
Marks all of Adamntds.dit (all directory partitions that are held by the ADAM instance) as authoritative. The schema cannot be authoritatively restored.
restore database verinc %d
Marks all of Adamntds.dit (all directory partitions that are held by the ADAM instance) as authoritative, and increments the version number as follows. If verinc is not provided, the version number is increased by the age (in days) of the object being restored, multiplied by 100,000. If verinc is provided, the version number is increased by the age (in days) of the object being restored, multiplied by %d. Use this option only to authoritatively restore over a previous, incorrect, authoritative restore, such as an authoritative restore completed using a backup that contains incorrect data.
%d
A numeric variable, such as the replication delay time period.
restore subtree %s
Marks the subtree and all children of the subtree as being authoritative. The subtree is defined by using the full distinguished name of the object.
restore subtree %s verinc %d
Marks the subtree and all children of the subtree as being authoritative, and increments the version number as follows. If verinc is not provided, the version number is increased by the age (in days) of the object being restored, multiplied by 100,000. If verinc is provided, the version number is increased by the age (in days) of the object being restored, multiplied by %d. The subtree is defined by using the full distinguished name of the object. Use this option only to authoritatively restore over a previous, incorrect, authoritative restore, such as an authoritative restore completed using a backup that contains incorrect data.
restore object %s
Marks the object as being authoritative. The object is specified by using the full distinguished name of the object.
restore object %s verinc %d
Marks the object as being authoritative, and increments the version number as follows. If verinc is not provided, the version number is increased by the age (in days) of the object being restored, multiplied by 100,000. If verinc is provided, the version number is increased by the age (in days) of the object being restored, multiplied by %d. The object is specified by using the full distinguished name of the object. Use this option only to authoritatively restore over a previous, incorrect, authoritative restore, such as an authoritative restore completed using a backup that contains incorrect data.
%s
An alphanumeric variable, such as the name of an ADAM instance.
Quit
Takes you back to the previous menu, or exits the utility.
? or help
Displays help at the command prompt.

change service account

Sets the service account for the ADAM instance. At the dsdbutil: prompt, type the command using the syntax listed below.

Syntax

change service account account password

account
The account to be used as the new ADAM service account.
password
The password for the account to be used as the new ADAM service account.

files

Provides commands for managing directory service data and log files. The data file is called Adamntds.dit. At the files: prompt, type any of the parameters listed under "Syntax."

Syntax

{compact to %s|header| info|integrity|move DB to %s|move logs to %s|recover|set path backup %s|set path db %s|set path logs %s|set path working dir %s

Parameters

compact to %s (where %s identifies an empty target directory)
Compacts the existing data file, and writes the compacted file to the specified directory. The directory can be remote; that is, it can be mapped by means of the net use command or by similar means. After compaction is complete, archive the old data file, and move the newly compacted file back to the original location of the data file.
header
Writes the header of the Adamntds.dit data file to the screen. This command can help you analyze database problems.
info
Analyzes and reports the free space for the disks that are installed in the system, reads the registry, and then reports the sizes of the data and log files. The directory service maintains the registry, which identifies the location of the data files, log files, and directory service working directory.
integrity
Performs an integrity check on the data file, which can detect any kind of low-level database corruption. It reads every byte of the data file; therefore, it can take a long time to process large databases. Note that you should always run recover before performing an integrity check.
move DB to %s (where %s identifies a target directory)
Moves the Adamntds.dit data file to the new directory that is specified by %s, and updates the registry so that, upon service restart, the directory service uses the new location.
move logs to %s (where %s identifies a target directory)
Moves the directory service log files to the new directory that is specified by %s, and updates the registry so that, upon service restart, the directory service uses the new location.
recover
Performs a soft recovery of the database. Soft recovery scans the log files and ensures that all committed transactions in the log files are also reflected in the data file. The ntbackup program truncates the log files appropriately. Logs are used to ensure that committed transactions are not lost if the system fails or if there is an unexpected power loss. Essentially, transaction data is written first to a log file and then to the data file. When you restart after failure, you can rerun the log to reproduce the transactions that are committed but that have not been written to the data file.
set path backup %s (where %s identifies a target directory)
Sets the disk-to-disk backup target to the directory that is specified by %s. The directory service can be configured to perform an online, disk-to-disk backup at scheduled intervals.
set path db %s (where %s identifies a target directory)
Updates the part of the registry that identifies the location and file name of the data file. Use this command only to rebuild an ADAM instance that has lost its data file and that is not being restored by means of normal restoration procedures.
set path logs %s (where %s identifies a target directory)
Updates the part of the registry that identifies the location of the log files. Use this command only to rebuild an ADAM instance that has lost its log files and that is not being restored by means of normal restoration procedures.
set path working dir %s (where %s identifies a target directory)
Sets the part of the registry that identifies the directory service's working directory to the directory that is specified by %s.
%s
An alphanumeric variable, such as a domain or ADAM instance name.
quit
Takes you back to the previous menu, or exits the utility.
? or help
Displays help at the command prompt.
Caution

Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Note

Active Directory Application Mode is implemented on top of an indexed sequential access method (ISAM) table manager. This is the same table manager that is used by Microsoft Exchange Server, the file replication service, the security configuration editor, the certificate server, Windows Internet Name Service (WINS), and other Windows components. The version of the database that Windows Server 2003 uses is called extensible storage engine (ESENT). ESENT is a transacted database system that uses log files to support rollback semantics to ensure that transactions are committed to the database. Ideally, data and log files should be located on separate drives to improve performance and support recovery of the data if a disk fails.

LDAP port

Sets the Lightweight Directory Access Protocol (LDAP) communications port for the ADAM instance. At the dsdbutil: prompt, type the command using the syntax listed below.

Syntax

LDAP port portnumber

portnumber
Specifies the new communications port number to be used for LDAP on the ADAM instance.

list instances

Lists information about the ADAM instances installed on the current computer. To run this command, type list instances at the dsdbutil: prompt. This command does not require or accept any parameters.

popups

Enables or disables interactive pop-up messages. To enable interactive pop-up messages, at the dsdbutil: prompt, type popups on. To disable pop-up messages, at the dsdbutil: prompt, type popups off.

quit

Closes the dsdbutil command-line tool.

semantic database analysis

Analyzes data with respect to ADAM semantics. At the semantic database analysis: prompt, type any of the parameters listed under "Syntax."

Syntax

{get %d|go|verbose %s}

Parameters

get %d
Retrieves the record number %d from Ntds.dit.
go
Starts the semantic analysis of Ntds.dit. A report is generated and written to a file named Dsdit.dmp.n in the current directory, where n is an integer that is incremented each time that you carry out the command.
verbose %s
Toggles verbose mode on or off.
%d
A numeric variable, such as a replication delay time period.
%s
An alphanumeric variable, such as a domain or ADAM instance name.
quit
Takes you back to the previous menu, or exits the utility.
? or help
Displays help at the command prompt.

Remarks

  • Unlike the file management commands described earlier, which test the integrity of the database with respect to ESENT database semantics, the semantic analysis analyzes data with respect to ADAM semantics. It generates reports on the number of records present, including deleted and phantom records.

    Note

    End users should not use this command except, when Microsoft requests them to use it as an aid in fault diagnosis.

set DSRM Password

This command does not apply to ADAM.

SSL port

Sets the Secure Sockets Layer (SSL) communications port for the ADAM instance. At the dsdbutil: prompt, type the command using the syntax listed below.

Syntax

SSL port portnumber

portnumber
Specifies the new communications port number to be used for SSL on the ADAM instance.

Remarks

  • If the variable has spaces in it, enclose it in parentheses, instead of in quotation marks, as follows:

    connect to server (xxx yyy)

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Dsdiag

Dsdiag

Analyzes the state of the Active Directory directory service, or the Active Directory Application Mode (ADAM) directory service, and reports any problems, to assist in troubleshooting. Dsdiag provides detailed information about how to identify abnormal behavior in the system.

Dsdiag consists of a framework for running tests and a series of tests to verify different functional areas of the system. This framework selects which directory services are tested, according to scope directives from the user.

Note

Some Dsdiag tests apply only to Active Directory.

  • Syntax

  • Examples

  • Formatting legend

Syntax

dsdiag /s:adamserver [/n:NamingContext] [/u:Domain\UserName /p:{* | Password | ""}] [{/a | /e}] [{/q | /v}] [/i] [/f:LogFile] [/ferr:ErrLog] [/c [/skip:Test]] [/test:Test][/d][/fix] [{/h | /?}]

Parameters

/s: adamserver
Uses adamserver as the home server. This parameter is required.
/n: Partition
Uses Partition as the application directory partition to test. Domains may be specified in network basic input/output system (NetBIOS), Domain Name System (DNS), or distinguished name formats.
/u: Domain\UserName /p:{* | Password | ""}
Uses Domain\UserName credentials for binding, with Password as the password. Use "" for an empty or null password, or use * to prompt for the password.
/a
Tests all the servers on this site.
/e
Tests all the servers in the entire enterprise. Overrides /a.
/q
(Quiet) Prints only error messages.
/v
(Verbose) Prints extended information.
/d
(Debug) Prints configuration information for the entire enterprise, and displays verbose output information. This parameter can be useful for discovering detailed information about a directory server.
/i
Ignores superfluous error messages.
/fix
Only affects the MachineAccount test. This parameter causes the test to repair the service principal names (SPNs) on the machine account object of the directory server.
/f: LogFile
Redirects all output to LogFile. The /f parameter operates independently of /ferr.
/ferr: ErrLog
Redirects fatal error output to a separate file called ErrLog. The /ferr parameter operates independently of /f.
/c
(Comprehensive) Runs all tests except DcPromo and RegisterInDNS, including nondefault tests. Optionally, this parameter can be used with /skip to skip specified tests. The following tests are not run by default: TopologyCutoffServersOutboundSecureChannels
/skip: Test
Skips the specified test. This parameter must be used with /c. This parameter should not be run in the same command with /test. The only test that cannot be skipped is Connectivity.
/test: Test
Runs only this test. The nonskippable test Connectivity is also run. This parameter should not be run in the same command with /skip.
Note

All tests except DcPromo and RegisterInDNS must be run on computers that have been promoted to directory server.

Valid tests are as follows:

Connectivity
Tests whether directory servers are DNS registered, can be pinged, and have Lightweight Directory Access Protocol/remote procedure call (LDAP/RPC) connectivity.
Replications
Checks for timely replication and any replication errors between directory servers.
Topology
Checks that Knowledge Consistency Checker (KCC) has generated a fully connected topology for all directory servers.
CutoffServers
Checks for any servers that are not receiving replications because their partners are not available.
NCSecDesc
Checks that the security descriptors on the application directory partition heads have appropriate permissions for replication.
NetLogons
Checks that the appropriate logon privileges exist to allow replication to proceed.
Advertising
Checks whether each directory server is advertising itself in the roles it should be capable of fulfilling. This test fails if the Net Logon service has stopped or failed to start.
KnowsOfRoleHolders
Checks whether the directory server can contact the servers that hold the five operations master (also known as flexible single master operations, or FSMO) roles.
Intersite
Checks for failures that would prevent or temporarily hold up intersite replication, and tries to predict how long it will take before the KCC is able to recover. Caution
  • Results of this test are often not valid.

FSMOCheck
Checks that the directory server can contact a Key Distribution Center (KDC), Time Server, Preferred Time Server, primary directory server (primary domain controller (PDC)), and global catalog server. This test does not test any of the servers for operations master roles.
RidManager
Checks whether the RID master is accessible and if it contains the proper information.
MachineAccount
Checks whether the machine account is properly registered and the services are advertised.
Services
Checks whether the appropriate directory server services are running.
OutboundSecureChannels
Checks that secure channels exist from all the directory servers in the domain to the domains that are specified by /testdomain. The /nositerestriction parameter prevents the test from being limited to the directory servers in the site.
ObjectsReplicated
Checks that Machine Account and DSA objects have replicated. Use /objectdn:dn with /n:nc to specify an additional object to check.
frssysvol
Checks that File Replication service (FRS) SYSVOL is ready.
kccevent
Checks that KCC is completing without errors.
systemlog
Checks that the system is running without errors.
DcPromo
This command does not apply to ADAM.
RegisterInDNS
This commmand does not apply to ADAM.
DeadCRTest
Looks for cross-references that appear to be left over from a failed creation of an application directory partition.
CheckSDRefDom
Checks that all application directory partitions have appropriate security descriptor reference domains.
VerifyReplicas
Verifies that all application directory partitions are fully instantiated on all replica servers.
CrossRefValidation
Verifies the validity of cross-references.
VerifyReferences
Verifies that certain system references are intact for the FRS and Replication infrastructure.
VerifyEnterpriseReferences
Verifies that certain system references are intact for the FRS and Replication infrastructure across all objects in the enterprise on each directory server.
{/h | /?}
Displays a syntax screen at the command prompt.

Examples

Example 1: A normal ADAM instance

To examine an ADAM instance to verify that it is healthy and functioning properly, type the following at the command prompt:

dsdiag /s:adam1 /u:cohovineyard\administrator /p:password

Output similar to the following appears:

Directory Service Diagnosis

Performing initial setup:

Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\adam1

Starting test: Connectivity

......................... adam1 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\adam1

Starting test: Replications

......................... adam1 passed test Replications

Starting test: NCSecDesc

......................... adam1 passed test NCSecDesc

Starting test: NetLogons

......................... adam1 passed test NetLogons

Starting test: Advertising

......................... adam1 passed test Advertising

Starting test: KnowsOfRoleHolders

......................... adam1 passed test KnowsOfRoleHolders

Starting test: RidManager

......................... adam1 passed test RidManager

Starting test: MachineAccount

......................... adam1 passed test MachineAccount

Starting test: Services

......................... adam1 passed test Services

Starting test: ObjectsReplicated

......................... adam1 passed test ObjectsReplicated

Starting test: frssysvol

......................... adam1 passed test frssysvol

Starting test: kccevent

......................... adam1 passed test kccevent

Starting test: systemlog

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:28:25

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:40:30

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:43:30

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:58:46

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:02:11

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:05:11

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:10:51

Event String: The time provider NtpClient is configured to

......................... adam1 failed test systemlog

Running partition tests on : Schema

Starting test: DeadCRTest

......................... Schema passed test DeadCRTest

Starting test: CheckSDRefDom

......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration

Starting test: DeadCRTest

......................... Configuration passed test DeadCRTest

Starting test: CheckSDRefDom

......................... Configuration passed test CheckSDRefDom

Running partition tests on : cohovineyard

Starting test: DeadCRTest

......................... cohovineyard passed test DeadCRTest

Starting test: CheckSDRefDom

......................... cohovineyard passed test CheckSDRefDom

Running enterprise tests on : cohovineyard.reskit.com

Starting test: Intersite

......................... cohovineyard.reskit.com passed test Intersite

Starting test: FsmoCheck

......................... cohovineyard.reskit.com passed test FsmoCheck

Example 2: Unresponsive or inaccessible server

To resolve replication problems, type the following at the command line:

dsdiag /s:adam1 /u:cohovineyard\administrator /p:password /e

Output similar to the following appears:

Directory Service Diagnosis

Performing initial setup:

Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\adam1

Starting test: Connectivity

......................... adam1 passed test Connectivity

Testing server: Default-First-Site-Name\RESKIT-DC2

Starting test: Connectivity

Server RESKIT-DC2 resolved to this IP address 172.26.220.34,

but the address couldn't be reached(pinged), so check the network.

The error returned was: Error due to lack of resources.

This error more often means that the targeted server is

shutdown or disconnected from the network

......................... RESKIT-DC2 failed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\adam1

Starting test: Replications

[Replications Check,adam1] A recent replication attempt failed:

From RESKIT-DC2 to adam1

Naming Context: CN=Configuration,DC=cohovineyard,DC=reskit,DC=com

The replication generated an error (1722):

The RPC server is unavailable.

The failure occurred at 2001-12-21 02:19:04.

The last success occurred at 2001-12-21 01:57:43.

1 failures have occurred since the last success.

The source remains down. Please check the machine.

......................... adam1 passed test Replications

Starting test: NCSecDesc

......................... adam1 passed test NCSecDesc

Starting test: NetLogons

......................... adam1 passed test NetLogons

Starting test: Advertising

......................... adam1 passed test Advertising

Starting test: KnowsOfRoleHolders

......................... adam1 passed test KnowsOfRoleHolders

Starting test: RidManager

......................... adam1 passed test RidManager

Starting test: MachineAccount

......................... adam1 passed test MachineAccount

Starting test: Services

......................... adam1 passed test Services

Starting test: ObjectsReplicated

......................... adam1 passed test ObjectsReplicated

Starting test: frssysvol

......................... adam1 passed test frssysvol

Starting test: kccevent

......................... adam1 passed test kccevent

Starting test: systemlog

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:28:25

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:40:30

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:43:30

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 01:58:46

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:02:11

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:05:11

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:10:51

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:13:51

Event String: The time provider NtpClient is configured to

An Error Event occured. EventID: 0xC25A001D

Time Generated: 12/21/2001 02:18:58

Event String: The time provider NtpClient is configured to

......................... adam1 failed test systemlog

Testing server: Default-First-Site-Name\RESKIT-DC2

Skipping all tests, because server RESKIT-DC2 is

not responding to directory service requests

Running partition tests on : Schema

Starting test: DeadCRTest

......................... Schema passed test DeadCRTest

Starting test: CheckSDRefDom

......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration

Starting test: DeadCRTest

......................... Configuration passed test DeadCRTest

Starting test: CheckSDRefDom

......................... Configuration passed test CheckSDRefDom

Running partition tests on : cohovineyard

Starting test: DeadCRTest

......................... cohovineyard passed test DeadCRTest

Starting test: CheckSDRefDom

......................... cohovineyard passed test CheckSDRefDom

Running partition tests on : reskit-sib

Starting test: DeadCRTest

......................... reskit-sib passed test DeadCRTest

Starting test: CheckSDRefDom

......................... reskit-sib passed test CheckSDRefDom

Running enterprise tests on : cohovineyard.reskit.com

Starting test: Intersite

......................... cohovineyard.reskit.com passed test Intersite

Starting test: FsmoCheck

......................... cohovineyard.reskit.com passed test FsmoCheck

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Dsmgmt

Dsmgmt

Provides management facilities for Active Directory Application Mode (ADAM).

To run dsmgmt, at an ADAM tools command prompt, type dsmgmt, and then press ENTER. At the dsmgmt: prompt, type one of the following commands:

  • configurable settings

  • ds behavior

  • partition management

  • LDAP policies

  • metadata cleanup

  • popups

  • quit

  • roles

  • security account management

Configurable settings

Helps to modify the Time to Live (TTL) of dynamic data that is stored in ADAM. To reach the configurable setting: prompt, at the dsmgmt: prompt, type configurable settings, and then press ENTER. Then, at the configurable setting: prompt, use the following syntax.

Syntax

{cancel changes|connections|list|set %s to %s|show values}

Parameters

cancel changes
Cancels the changes that are made but that are not yet committed.
Connections
Invokes the server connections submenu.
List
Lists the names of the supported configurable settings.
set %s to %s
Sets the configurable settings %s1 to the value %s2.
show values
Displays values of configurable settings.
%s
An alphanumeric variable, such as an ADAM instance name.
Quit
Takes you back to the previous menu or exits the utility.
? or help
Displays help at the command prompt.

ds behavior

Enables administrators to specify whether password modifications can be made over unsecured (nonencrypted) connections. By default, password modifications over unsecured connections are not allowed. To view the ds behavior command-line options, type ? at the ds behavior: command prompt.

partition management

Enables administrators to prepare cross-reference and server objects in the directory. To reach the partition management: prompt, at the dsmgmt: prompt, type partition management, and then press ENTER. Then, at the partition management: prompt, use the following syntax.

Syntax

{add nc replica %s %s|connections|create nc %s %s|create nc %s %s %s|remove nc replica %s %s|list|list nc information %s|list nc replicas %s|precreate %s %s|delete NC %s|select operation target|set nc reference domain %s %s|set nc reference domain %s %s|set nc replicate notification delay %s %d %d}

Parameters

add nc replica %s %s
Adds the ADAM instance %s2 to the replica set for the application directory partition %s1. If %s2 is not specified, the ADAM instance that you are connected to is used as the default.
Connections
Invokes the Connections submenu.
create nc %s %s
This command only applies to Active Directory (and not to ADAM).
create nc %s %s %s
This command applies to ADAM (and not to Active Directory). Creates the application directory partition with the distinguished name specified by %s1, of an object class specified by %s2, on the ADAM instance specified by the computername:portnumber specified by %s3. If %s3 is not specified, the currently connected ADAM instance is used.
remove nc replica %s %s
Removes the ADAM instance %s2 from the replica set for the application directory partition %s1. If %s2 is not specified, the ADAM instance that you are currently connected to is used.
List
Lists all the naming contexts (or, directory partitions) that exist in the configuration set.
list nc information %s
Prints out the reference domain and replication delays for the application directory partition.
list nc replicas %s
Prints the list of ADAM instances in the replica set for application directory partition %s. Remember that this is the list of ADAM instances that will eventually hold replicas of the application directory partition and that these replicas may not necessarily be fully replicated yet.
precreate %s %s
Creates a cross-reference object for the application directory partition %s1, allowing an ADAM instance named %s2 to hold a replica of that directory partition. The directory partition must be specified by a fully distinguished name, and the ADAM instance must be specified by computername:portnumber.
delete nc %s
Removes the application directory partition %s. Before you remove a application directory partition, all the replicas must be removed and their removal must replicate back to the naming operations master.
select operation target
Invokes the Select operation target submenu.
set nc reference domain %s %s
This command does not apply to ADAM.
set nc replicate notification delay %s %d %d
Sets the notification delays for the application directory partition specified by %s to %d1 and %d2 for the delay in notifying the first ADAM instance of changes and the delay in notifying subsequent ADAM instances of changes, respectively.
%s
An alphanumeric variable, such as an ADAM instance name.
%d
A numeric variable, such as a replication delay time period.
Quit
Takes you back to the previous menu, or exits the utility.
? or help
Displays help at the command prompt.

LDAP policies

Sets the Lightweight Directory Access Protocol (LDAP) administration limits for the Default-Query Policy object. To reach the LDAP policies: prompt, at the dsmgmt: prompt, type ldap policies, and then press ENTER. At the LDAP policies: prompt, use the following syntax.

Syntax

{cancel changes|commit changes|connections|list|set %s to %s|show values}

Parameters

cancel changes
Cancels any uncommitted modifications of the LDAP administration limits to the default query policy.
commit changes
Commits all modifications of the LDAP administration limits to the default query policy.
Connections
Invokes the server connections submenu.
List
Lists all supported LDAP administration limits for the ADAM instance.
set %s1 to %s2
Sets the value of the LDAP administration limit %s1 to the value %s2.
show values
Shows the current and proposed values for the LDAP administration limits.
%s
An alphanumeric variable, such as an ADAM instance name.
Quit
Takes you back to the previous menu or exits the utility.
? or help
Displays help at the command prompt.

Remarks

  • The following table describes LDAP administration limits, with the default values noted in parentheses.

    Value Description

    InitRecvTimeout

    Initial receive time-out (120 seconds)

    MaxConnections

    Maximum number of open connections (5000)

    MaxConnIdleTime

    Maximum amount of time a connection can be idle (900 seconds)

    MaxActiveQueries

    Maximum number of queries that can be active at one time (20)

    MaxNotificationPerConnection

    Maximum number of notifications that a client can request for a given connection (5)

    MaxPageSize

    Maximum page size supported for LDAP responses (1000 records)

    MaxQueryDuration

    Maximum length of time the ADAM instance can execute a query (120 seconds)

    MaxTempTableSize

    Maximum size of temporary storage allocated to execute queries (10,000 records)

    MaxResultSetSize

    Maximum size of the LDAP Result Set (262,144 bytes)

    MaxPoolThreads

    Maximum number of threads created by the ADAM instance for query execution (4 per processor)

    MaxDatagramRecv

    Maximum number of datagrams that can be processed by the ADAM instance simultaneously (1024)
  • To ensure that ADAM instances can support service level guarantees, specify operational limits for a number of LDAP operations. These limits prevent specific operations from adversely affecting the performance of a server, and they also make the server resilient to denial-of-service attacks.

    LDAP policies are implemented by using objects of the class queryPolicy. Query Policy objects can be created in the container Query Policies, which is a child of the Directory Service container in the configuration naming context. For example: CN=Query-Policies, CN=Directory Service, CN=Windows NT, CN=Services (configuration directory partition).

    An ADAM instance uses the following three mechanisms to apply LDAP policies:

    • An ADAM instance might refer to a specific LDAP policy. The nTDSASettings object includes an optional attribute queryPolicyObject, which contains the distinguished name of a Query Policy.

    • In the absence of a specific query policy being applied to an ADAM instance, the ADAM instance applies the Query Policy that has been assigned to the ADAM instance's site. The ntDSSiteSettings object includes an optional attribute queryPolicyObject, which contains the distinguished name of a Query Policy.

    • In the absence of a specific ADAM instance or a site Query Policy, an ADAM instance uses the default Query Policy that is named Default-Query Policy.

    A Query Policy object includes the multivalued attributes LDAPIPDenyList and LDAPAdminLimits. An administrator can use dsmgmt to set the LDAP administration limits (but not for the IP Deny list) for the Default-Query Policy object.

metadata cleanup

Cleans up metadata for retired ADAM instances. To reach the metadata cleanup: prompt, at the dsmgmt: prompt, type metadata cleanup, and then press ENTER. At the metadata cleanup: prompt, use the following syntax.

Syntax

{connections|remove selected domain|remove selected naming context|remove selected server|select operation target}

Parameters

Connections
Removes metadata associated with the domain that is selected in the Select operation target submenu.
remove selected domain
This command does not apply to ADAM.
remove selected naming context
Removes directory service objects for the selected naming context.
remove selected server
Removes metadata associated with the ADAM instance that is selected in the Select operation target submenu.
select operation target
Invokes the Select operation target submenu.
Quit
Takes you back to the previous menu, or exits the utility.
? or help
Displays help at the command prompt.

Remarks

  • Metadata is maintained for each ADAM instance in a configuration set. When an ADAM instance is uninstalled, any metadata about the uninstalled ADAM instance that has been replicated to other ADAM instances is also removed. However, in some cases, metadata for the uninstalled ADAM instance can remain on the other ADAM instances in the configuration set. To remove this stale metadata, connect to an ADAM instance that holds the stale metadata, and select the uninstalled ADAM instance as the operation target.

Caution

Do not delete the metadata of existing ADAM instances.

popups {on|off}

Enables or disables interactive pop-up messages. To enable interactive pop-up messages, at the dsmgmt: prompt, type popups on. To disable pop-up messages, at the dsmgmt: prompt, type popups off.

quit

Type quit at the dsmgmt: prompt to close the dsmgmt command-line tool.

roles

Transfers and seizes operations master roles. To reach the roles: prompt, at the dsmgmt: prompt, type roles, and then press ENTER. At the roles: prompt, use the following syntax.

Note

Only the naming master and schema master roles apply to ADAM. Commands relating to the PDC, RID, and infrastructure masters do not apply to ADAM.

Syntax

{connections|seize naming master|seize infrastructure master|seize PDC|seize RID master|seize schema master|select operation target|transfer naming master|transfer infrastructure master|transfer PDC|transfer RID master|transfer schema master}

Parameters

connections
Invokes the server connections submenu.
seize naming master
Forces the ADAM instance to which you are connected to claim ownership of the naming operations master role without regard to the data that is associated with the role. Use only for recovery purposes.
seize infrastructure master
Does not apply to ADAM.
seize PDC
Does not apply to ADAM.
seize RID master
Does not apply to ADAM.
seize schema master
Forces the ADAM instance to which you are connected to claim ownership of the schema operations master role without regard to the data that is associated with the role. Use only for recovery purposes.
select operation target
Invokes the Select operation target submenu. From within the submenu, you can list the operations master (also known as flexible single master operations, or FSMO) roles that are held by the currently connected server. For a complete list of select operation target subcommands, type ? at the select operation target: prompt.
transfer naming master
Instructs the ADAM instance to which you are connected to obtain the naming role by means of controlled transfer.
transfer infrastructure master
Does not apply to ADAM.
transfer PDC
Does not apply to ADAM.
transfer RID master
Does not apply to ADAM.
transfer schema master
Instructs the ADAM instance to which you are connected to obtain the schema operations master role by means of controlled transfer.
quit
Takes you back to the previous menu, or exits the utility.
? or help
Displays help at the command prompt.

Remarks

  • Although ADAM is based on a multimaster administration model, some operations support only a single master. For multimaster operations, conflict resolution ensures that after the system finishes replicating, all replicas agree on the value for a given property on a given object. However, some data, for which adequate conflict resolution is not possible, is key to the operation of the system as a whole. This data is controlled by individual ADAM instances, called operations masters.

    The following two operations master roles apply to ADAM configuration sets.

    • Schema operations master. There is a single schema operations master role for each ADAM configuration set. This role allows the operations master server to accept schema updates. There are other restrictions on schema updates.

    • Naming master. There is a single naming master role for an ADAM configuration set. The naming master role allows the owner to define new cross-reference objects that represent directory partitions in the partitions container.

  • An operations master role can only be moved by administrative involvement; it is not moved automatically. Additionally, moving a role is controlled by standard access controls. Therefore, an organization should tightly control the location and movement of operations master roles. For example, an organization with a strong information technology (IT) presence might place the schema role on a server in the IT group and configure its access control list (ACL) so that it cannot be moved at all.

    Operations master roles require two forms of management: controlled transfer and seizure.

    Use controlled transfer when you want to move a role from one server to another, perhaps to track a policy change with respect to role location or in anticipation of a server being shut down, moved, or decommissioned.

    Seizure is required when a server that is holding a role fails and you do not intend to restore it. Even in the case of a server that is recovered from a backup, the server does not assume that it owns a role (even if the backup tape says so), because the server cannot determine if the role was legitimately transferred to another server in the time period between when the backup was made and when the server failed and was recovered. The restored server assumes role ownership only if a quorum of existing servers is available during recovery and they all agree that the restored server is still the owner.

    The roles submenu in dsmgmt is used to perform controlled transfer and recovery of operations master roles. Controlled transfer is simple and safe. Because the source and destination servers are running, the system software guarantees that the operations master role token and its associated data is transferred safely. Operations master role seizure is equally simple but not as safe; you simply tell a particular ADAM instance that it is now the owner of a particular role.

    Caution

    Do not make a server a role owner by means of seizure commands if the real role holder exists on the network. Doing this can create irreconcilable conflicts for key system data. If an operations master role owner is temporarily unavailable, do not make another ADAM instance the role owner. This can result in a situation in which two computers function as the role owner, which might cause irreconcilable conflicts for key system data.

security account management

This command does not apply to ADAM.

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Ldp

Ldp

The Ldp dialog box consists of two panes: the console tree and the details pane. The console tree lists the base object and any child objects. The details pane lists the results of the Lightweight Directory Access Protocol (LDAP) operations. To start Ldp, click Start, point to All Programs, point to ADAM, click ADAM Tools Command Prompt, and then type ldp at the command prompt.

The following sections describe commands on the Ldp menus:

  • Connection

  • Browse

  • View

  • Options

  • Utilities

Connection

The following table describes commands on the Connection menu.

Command Description

Connect

Opens a dialog box that you can use to open a session with a specified LDAP server. A connection must be established with an LDAP server before any other LDAP commands can be run. Type the appropriate port number for the service that you are connecting to. By default, LDAP uses TCP for a connection-oriented session. To use User Datagram Protocol (UDP) for a connectionless session, select the Connectionless check box. By default, a successful connection causes the appearance of RootDSE information in the details pane.

Bind

Opens a dialog box that you can use to authenticate a specified LDAP server. Type a user name and password of an account that has permissions to the LDAP server. If you do a simple bind with an empty password, you will be connected with anonymous credentials. As a shortcut, use the Bind command without using the Connect command to connect, and then authenticate with the server that you last connected to. Click Advanced on the Bind dialog box to open the Bind Options dialog box and configure authentication method options.

The following table describes the options in the Bind Options dialog box.

Option | Description
Function Type | Specifies a category of authentication for Ldp to use when choosing authentication methods.
Generic | Specifies use of a standard authentication protocol.
Simple | Specifies use of no authentication protocol and sends the password in plaintext.
Extended | Not available.
Method | Specifies the type of authentication that Ldp uses when passing credentials.
Synchronous | Specifies that the authenticating server must respond immediately to requests. This option works only with simple authentication.
Use auth. identity | Allows the use of alternate authentication credentials. All authentication methods except simple require synchronous calls.

Disconnect

Terminates an open session with a specified LDAP server. Closing Ldp automatically disconnects any open sessions.

New

Keeps the currently connected session, but clears the details pane. The keyboard shortcut for this action is CTRL+N.

Save

Saves changes to a previously saved file.

Save as

Saves the contents of the details pane to a text file. Use the Open command to view the contents of this file in the details pane later.

Print

Prints the contents of the details pane.

Browse

The following sections describe commands on the Browse menu:

Add Child

Opens a dialog box that you can use to add objects to Active Directory. You must enter the full distinguished name of the object, as well as all the mandatory attributes for the class of object being added.

The following table describes options in the Add dialog box.

Option | Description
Dn | Type the full distinguished name of the new object.
Attribute | Type the required or optional attribute.
Values | Type the values that are associated with the attribute. Separate multiple values for a single attribute with a semicolon. No spaces are required.
Enter | Adds the entered attribute and values to the Entry List box, and clears the Attribute and Values boxes. Continue entering attributes and values until all required and desired optional attributes are in the Entry List box.
Insert file | Opens a dialog box that you can use to open a text file with the appropriate attributes and values.
Entry List | Displays the attributes and values that you enter.
Edit | Opens a dialog box that you can use to enter changes to the selected entry in the Entry List box.
Remove | Deletes the selected entry from the Entry List box.
Extended | Select this check box if the object being added is part of an extended control.
Synchronous | If this check box is selected (which is the default), Ldp is required to wait for a response from the destination server before continuing. If you clear this check box, Ldp continues before a response is received. Clear this check box when slow wide area network (WAN) connections are causing Ldp commands to time out.
Run | Adds the current attributes and values in the Entry List to Active Directory. If Ldp encounters any errors, the object is not added and an error message appears in the details pane.

Delete

This command opens a dialog box that you can use to delete an object from Active Directory. Attributes can be deleted only if they are defined as optional and if they contain no values. To delete an attribute's values, on the Browse menu in the Add dialog box, click Edit.

Option | Description
DN | Type the full distinguished name of the new object.
Extended | Select this check box if the object being modified is part of an extended control.
Synchronous | If this check box is selected (which is the default), Ldp is required to wait for a response from the destination server before continuing. If you clear this check box, Ldp continues before a response is received. Clear this check box when slow WAN connections are causing Ldp commands to time out.
Recursive (client) | Deletes all objects in a container, but does not delete the container.

Modify

This command opens a dialog box that you can use to change the attributes of an object that is stored in Active Directory.

The following table describes options in the Modify dialog box.

Option | Description
Dn | Type the full distinguished name of the new object.
Attribute | Type the required or optional attribute.
Values | Type the values that are associated with the attribute. Separate multiple values for a single attribute with a semicolon. No spaces are required.
Insert file | Opens a dialog box that you can use to open a text file with the appropriate attributes and values.
Enter | Adds the entered attribute and values to the Entry List section of the dialog box, and clears the Attribute and Values fields. Continue entering attributes and values until all required and desired optional attributes are in the Entry List box.
Operation | Add, Delete, or Replace. To add a new value to an existing attribute, click Add. To permanently remove an attribute from the listed object, click Delete. Attributes that contain data cannot be deleted. Also, attempting to delete required attributes results in an error. To replace an existing value with another or to change listed values for an existing attribute, click Replace.
Entry List | Displays the existing attributes and values for an object.
Edit | Opens a dialog box that you can use to make changes to the selected entry in the Entry List box.
Synchronous | If this check box is selected (which is the default), Ldp is required to wait for a response from the destination server before continuing. If you clear this check box, Ldp continues before a response is received. Clear this check box when slow WAN connections are causing Ldp commands to time out.
Extended | Select this check box if the object being modified is part of an extended control.
Run | Sends the edited values in the Entry List box to Active Directory.

Modify DN

Opens a dialog box that you can use to change the relative distinguished name of an object. This option is designed to modify leaf objects only. If you rename the container portion of the distinguished name, the object moves to the container that is named.

The following table describes options in the Modify RDN dialog box.

Option | Description
Old Dn | Type the current distinguished name of the object.
New Dn | Type the new distinguished name for the object.
Delete Old | If this check box is selected (which is the default), the old distinguished name is removed from the LDAP directory.
Synchronous | If this check box is selected (which is the default), Ldp is required to wait for a response from the destination server before continuing. If you clear this check box, Ldp continues before a response is received. Clear this check box when slow WAN connections are causing Ldp commands to time out.
Extended rename | Select this check box if the object being renamed is part of an extended control.
Run | Sends the change to Active Directory.

Search

Opens a dialog box that you can use to create a customized search filter and to perform the search on the directory information tree. The search base must be specified as a distinguished name, and the filter must be a valid LDAP filter. Items returned from a search are separated by >> characters.

The following table describes options in the Search dialog box.

Option | Description
Base Dn | Type a distinguished name to specify where the search starts.
Filter | Type the search criteria, separated by LDAP search filters. Type attributes and values to find an object or set of objects. Note that LDAP search filters are defined in RFC 2254 and in the article 255602 at the Microsoft Knowledge Base.
Scope | Specifies how many levels the search encompasses.
Base | Searches the base object only.
One Level | Searches objects immediately subordinate to the base object, but does not search the base object.
Subtree | Searches the entire subtree, from the base object down to all child objects.
Options | Opens the Search Options dialog box. You can use these options to apply filters that allow some entries and exclude others from the search and that allow you to control the way the search is processed.
Run | Sends the search request to Active Directory.

Compare

Opens a dialog box that you can use to compare the value of an attribute of an object with a specified value. The result returned is either true or false.

The following table describes options in the Compare dialog box.

Option | Description
Dn | Type the full distinguished name of the object whose values will be compared.
Attribute | Type the attribute to be compared.
Value | Type the value that will be compared with the existing value in Active Directory. Separate multiple values for a single attribute with a semicolon. No spaces are required.
Synchronous | If this check box is selected (which is the default), Ldp is required to wait for a response from the destination server before continuing. If you clear this check box, Ldp continues before a response is received. Clear this check box when slow WAN connections are causing Ldp commands to time out.
Run | Starts the comparison.

Extended Op

Opens a dialog box that you can use to submit an extended operation to an LDAP directory by specifying an LDAP object identifier (also known as OID) and an applicable value.

The following table describes options in the Extended Operations dialog box.

Option | Description
Oid | Type the object identifier number.
Data | Type the value of the object identifier attribute.
Controls | See Controls Option in the Options section.
Send | Submits the extended operation to Active Directory.

GetLastError

Calls the LDAP GetLastError function.

Security

Opens a dialog box that you can use to submit an extended operation to an LDAP directory by specifying an LDAP object identifier and an applicable value.

The following table describes the Security Descriptor dialog box.

Option | Description
Security Descriptor | Opens a dialog box that you can use to view access permissions on an object.

Replication

Opens a dialog box that you can use to submit an extended operation to an LDAP directory by specifying an LDAP object identifier and an applicable value.

The following table describes the Replication Metadata dialog box.

Option | Description
Replication/View Metadata | In Object DN, type the distinguished name of the object whose replication metadata you want to view.

Process Pending

Opens a dialog box that shows the list of requests that are not finished processing.

View

The following table describes commands on the View menu.

Command | Description
Tree | In BaseDN, type the distinguished name of the object to use as the base object in the navigation pane.
Enterprise Configuration | This menu option does not apply to ADAM.
Status Bar | Shows or hides the status bar, which is located along the bottom of the LDAP window.

Options

The following sections describe the commands on the Options menu:

Search

The following table describes options in the Search Options dialog box.

Option | Description
Time limit | Type the number of milliseconds that the search can take on the server. By default, the maximum is 120 seconds.
Size limit | Type the maximum number of bytes that the search can return. Typing a null value does not place a maximum size on the data that is returned.
Timeout (s) | Type the number of seconds that Ldp waits for the LDAP server to respond to a search request.
Timeout (ms) | Type the number of milliseconds that Ldp waits for the LDAP server to respond to a search request.
Page size | Type the maximum size, in bytes, of each page of returned data.
Attributes | Specifies which attributes to return in the search. Separate multiple attributes with a semicolon. Use the wildcard character (*) to indicate all attributes.
Search Call Type | Specifies a call type to use in the search. If the search will take some time, you can click Async. so that you can perform other tasks while waiting for the search to complete.
Attributes Only | Select this check box to return only attributes of objects. The distinguished name is not returned.
Chase referrals | Performs a search for objects that are found in external LDAP directories. By default, the objects' trusts of external LDAP directories return only a referral instead of the actual object.
Display Results | Displays a detailed list of objects that are returned by the search. By default, only a success or failure and the number of objects found appear.
Sort Keys | Opens the Sort Keys dialog box. See the Sort Keys section below.
Controls | Opens the Controls dialog box.

Pending

Opens a dialog box that you can use to place filters on the list of processes that have not yet completed.

The following table describes options in the Pending Options dialog box.

Option | Description
All search results | Specifies that all search results display.
Blocking | Clear this check box to set a time limit.
Time Limit (sec): | Type a time limit in seconds.
Time Limit (millisec): | Type a time limit in milliseconds.

General

The following table describes options in the General Options dialog box.

Option | Description
Value Parsing | Specifies the display format of LDAP data. Binary displays the LDAP information in its native numerical format. String Converts the LDAP information from its native format to ASCII characters so that it is more readable when displayed. This is the default setting. Values that are too long to be converted are still displayed in binary form.
LDAP Version | Specifies which version of LDAP the server is using. The default is version 3.
DN Processing | Converts the distinguished names, displayed in component parts, by extending the data types that Ldp returns when performing a command.
Buffer Size | In Number of lines, type the number of returned lines to display per command. In Chars per line, type the number of returned characters to display per command.
Auto default NC query | Specifies that Ldp queries the default naming context when a connection to the LDAP server is made. The default naming context is the RootDSE. This setting is used when the distinguished name value in the View|Tree dialog box is left blank.
Virtual List View (VLV) | Select Auto VLV browse when to display a virtual list view whenever the object count is greater than the value that is displayed in container size is greater than. The default value is 100.

Connection Options

Opens a dialog box that you can use to change the value of any option.

The following table describes options in the Connection Options dialog box.

Option | Description
Option Name | Type the name of the option whose value will be reset.
Value | Type the new value for the specified option.
Set | Sends the information to the LDAP directory.

Controls

In the Controls dialog box, enter information to extend the functionality of LDAP.

The Object Identifier option must be specified when you implement a control. To obtain a list of object identifiers, view the supportedControls property in the RootDSE of a domain controller. Individual controls are described in the "Understanding LDAP" white paper at the Microsoft Web site.

Notes

  • Only server controls can be sent to a server. Client controls work only with LDAP application programming interfaces (APIs).

  • To view a list of extended LDAP controls, see article 222560 at the Microsoft Knowledge Base.

Sort Keys

Sort Keys is a type of control that formats the display of search results. To format the display of your search results, in the Sort Keys dialog box, type an attribute type.

For more information, search for "sortKeyRequestControl" in the "Understanding LDAP" white paper at the Microsoft Web site.

TLS

The following table describes the subcommands for the TLS command.

Option | Description
StartTLS or StopTLS | Starts or stops a secure session with the LDAP server that uses Transport Level Security (TLS).

Utilities

The following table describes the commands on the Utilities menu.

Option | Description
Large Integer Converter | To convert long integers into high and low parts, type a value in the String box.
SID Lookup | To determine the domain\user that is associated with a given security ID (SID), type a SID into List of sids, and then click OK. The associated domain\user appears in the details pane.


Repadmin

Repadmin

Performs tasks related to replication, including managing and modifing replication topology, forcing replication events, and displaying replication metadata and up-to-date vectors. Repadmin contains several subcommands, which are described below in detail.

Notes

  • Most repadmin subcommands apply to both Active Directory Application Mode (ADAM) and Active Directory, except as noted in the description for each subcommand.

  • Not all general parameters apply to all subcommands.

General syntax

repadmin subcommand [dsa] [/u: UserName] [/pw: {Password|*}] [/rpc] [/ldap] [/homeserver:dsaname]

General parameters

subcommand
One of the repadmin subcommands described in the "Subcommands" section.

Value Description

Dsaname

One of the following:

  • computername:portnumber

    Specifies an ADAM instance or Active Directory domain controller, using the name of the computer on which the directory service is running and (for ADAM only) the port number used for communication, for example, adam01:389 or adam01:636.

  • DNSname:portnumber

    Specifies an ADAM instance or Active Directory domain controller by Domain Name System (DNS) name of the computer on which the directory service is running and (for ADAM only) the port number used for communication, for example, adam01.microsoft.com:389 or adam01.microsoft.com:636.

dsaguid

Specifies an ADAM instance or Active Directory domain controller using the globally unique identifier (GUID) of the directory service. When you use "dsaguid" against an ADAM configuration set, you must also use the /homeserver: parameter.

.

Repadmin attempts to select a directory server automatically. When you use "." against an ADAM configuration set, you must also use the /homeserver: parameter.

*

Repadmin selects all ADAM instances or Active Directory domain controllers in the ADAM configuration set or Active Directory forest. When you use "*" against an ADAM configuration set, you must also use the /homeserver: parameter.

site:sitename

Selects all ADAM instances or Active Directory domain controllers in the site called sitename, for example, site:microsoftsite1. When you use "site:" against an ADAM configuration set, you must also use the /homeserver: parameter.

fsmo_dnm:

Selects the directory server holding the naming operation master role (for ADAM), or the domain naming operation master role (for Active Directory). When you use fsmo_dnm: against an ADAM configuration set, you must also use the /homeserver: parameter.

fsmo_schema:

Selects the directory server holding the schema operation master role. When you use fsmo_schema: against an ADAM configuration set, you must also use the /homeserver: parameter.
dsa {dsaname|dsaguid|.|*|site:sitename|fsmo_dnm:|fsmo_schema:}
The dsa parameter represents the directory server (ADAM instance or Active Directory domain controller) to be targeted by the repadmin subcommand. The dsa parameter can be provided in a number of ways, as described in the following table. (Type repadmin /listhelp at the command line for additional information about the dsa parameter.)
/u: UserName
Specifies the account name to use for binding to the directory. By default, /u uses the account name with which the user is currently logged on. You can use any of the following formats to specify an account name: account name (for example, Linda), domain\account name (for example, widgets\Linda), or user principal name (UPN) (for example, Linda@cohovineyard.com)
/pw: {Password|*}
Specifies the password to use for authentication. If you type *, you are prompted for a password.
/rpc
Forces repadmin to communicate using a remote procedure call (RPC) session.
/ldap
Forces repadmin to communicate using a Lightweight Directory Access Protocol (LDAP) session. If LDAP communication fails, repadmin attempts to communicate using RPC. LDAP is the default communication method for repadmin.
/homeserver: dsaname
Forces repadmin to run against a specific ADAM configuration set or Active Directory forest, determined by the configuration set or forest membership of the directory server that is represented by dsaname. Dsaname can be specified in the following formats for an ADAM instance: computername:portnumber or DNSname:portnumber Dsaname can be specified in the following formats for an Active directory domain controller: computername or DNSname. You must use this parameter when you run repadmin against an ADAM configuration set, and dsaguid, "*", ".", "site:site", "fsmo_dnm:", or "fsmo_schema:" are used as the value for the dsa parameter.

Note

  • Not all repadmin subcommands require the dsa parameter.

Subcommands

To view the repadmin subcommand syntax, click a repadmin subcommand:

  • repadmin bind

  • repadmin bridgeheads

  • repadmin checkprop

  • repadmin dsaguid

  • repadmin failcache

  • repadmin istg

  • repadmin kcc

  • repadmin latency

  • repadmin notifyopt

  • repadmin queue

  • repadmin replauthmode

  • repadmin replicate

  • repadmin replsingleobj

  • repadmin showattr

  • repadmin showcert

  • repadmin showchanges

  • repadmin showconn

  • repadmin showctx

  • repadmin showism

  • repadmin showmsg

  • repadmin showncsig

  • repadmin showobjmeta

  • repadmin showoutcalls

  • repadmin showproxy

  • repadmin showrepl

  • repadmin showscp

  • repadmin showtime

  • repadmin showtrust

  • repadmin showutdvec

  • repadmin showvalue

  • repadmin syncall

  • repadmin viewlist

  • repadmin writespn

repadmin bind

Connects to and displays the replication features for a directory server.

Syntax

repadmin /bind [dsa] [/u: UserName] [/pw: {Password|*}] [/rpc] [/ldap]

Parameters

/bind [dsa]
Specifies the directory server for which information will be displayed. For details about the dsa parameter, see General parameters.
Other parameters
For details about other parameters, see General parameters.

repadmin bridgeheads

Lists the directory servers acting as bridgehead servers for a specified site.

Syntax

repadmin /bridgeheads [dsa] [/verbose] [/u: UserName] [/pw: {Password|*}] [/rpc] [/ldap]

Parameters

/bridgeheads dsa
Specifies a directory server that is located in the site for which bridgehead servers will be listed. For details about the dsa parameter, see General parameters.
Other parameters
For details about other parameters, see General parameters.

repadmin checkprop

Compares the properties of specified directory servers to determine if they are up to date with each other. The source directory server contains the original information that needs to be checked. The data on the destination directory server is compared to the data on the source directory server.

Syntax

repadmin /checkprop [dsa] NamingContext OriginatingDCInvocationID OriginatingUSN

Parameters

Dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
NamingContext
Specifies the distinguished name of the directory partition on the source directory server.
OriginatingDCInvocationID
Specifies the unique hexadecimal number that identifies an object on a source directory server. The InvocationID can be retrieved by using showrepl.
OriginatingUSN
Specifies the Update Sequence Number (USN) for the object on the source directory server. The USN is for the object whose InvocationID is already listed.

repadmin dsaguid

Returns a server name when given a GUID.

Syntax

repadmin /dsaguid [dsa] [GUID]

Parameters

Dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
GUID
Specifies the unique hexadecimal number that identifies the directory server. The GUID can be retrieved by using showrepl.

repadmin failcache

Displays a list of failed replication events that are detected by Knowledge Consistency Checker (KCC).

Syntax

repadmin /failcache [dsa]

Parameters

Dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.

repadmin istg

Returns the computer name of the Intersite Topology Generator (ISTG) server for a specified site.

Syntax

repadmin /istg [dsa] [/verbose]

Parameters

Dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
/verbose
Lists detailed information.

repadmin kcc

Forces KCC to calculate replication topology for a specified directory server. By default, this calculation occurs every 15 minutes.

Syntax

repadmin /kcc [dsa] [/async]

Parameters

Dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
/async
Specifies that the operation will be asynchronous. This means that repadmin starts the replication event, but it does not expect an immediate response from the destination directory server. Use this parameter to start kcc without waiting for it to complete.

repadmin latency

Displays the amount of time between replications, using the ISTG Keep Alive time stamp.

Notes

  • This command does not apply to ADAM.

  • The ISTG Keep Alive time stamp is not used in forests that are set to Windows Server 2003 forest functional level. Instead, in those environments, use repadmin /showutdvec /latency.

Syntax

repadmin /latency [dsa] [/verbose]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
/verbose
Lists detailed information.

repadmin notifyopt

Displays or sets the notification timing settings for replication of a specified directory partition.

Syntax

repadmin /notifyopt [dsa] NamingContext [/first:Value] [/subs:Value]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
NamingContext
Specifies the distinguished name of the directory partition on the source directory server.
/first: Value
The number of seconds after a change is made before the directory server notifies its first replication partner that there is a change.
/subs: Value
After the first replication partner is notified of a change, specifies the number of seconds to wait before notifying the next replication partner.

repadmin queue

Displays tasks that are waiting in the replication queue.

Syntax

repadmin /queue [dsa]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.

repadmin replauthmode

Modifies or displays the replication authentication mode in use by an ADAM configuration set.

Syntax

repadmin /replauthmode dsa [newmode]

Parameters

Dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
newmode
Specifies the replication authentication mode to be used by the configuration set. If this parameter is not specified, the command will display the current replication authentication mode. For information about replication authentication modes in ADAM, see Understanding ADAM replication and configuration sets.
Other parameters
For details about other parameters, see General parameters.

repadmin replicate

Starts synchronization for the specified directory partition between the source and destination directory servers. The source GUID can be determined when viewing the replication partners by using showrepl.

Syntax 1

repadmin /replicate destination_dsa source_dsa [/force] [/async] [/full] [/addref]

Syntax 2

repadmin /replicate destination_dsa [/force] [/async] [/full] [/addref] /allsources

Parameters

destination_dsa
Specifies the host_name[:port] of the destination directory server with which you want to replicate. This parameter cannot be used with /allsource. For details about valid values for this parameter, see dsa in General parameters.
source_dsa
Specifies the host_name[:port] of the source directory server with which you want to replicate. This parameter cannot be used with /allsource. For details about valid values for this parameter, see dsa in General parameters.
/force
This parameter is used to override the Disable Replication option on a directory server. Do not use this parameter unless you are certain that replication has been disabled, and that you want to override this setting.
/async
Specifies that the operation will be asynchronous. This means that repadmin starts the replication event, but it does not expect an immediate response from the destination directory server. Use this parameter when there are slow links between directory servers.
/full
Forces a full replication of all objects from the destination directory server.
/addref
Directs the source to check for a notification entry on the source. If the source does not have a notification entry for this destination, one is added.
/allsources
A given destination can have multiple sources for the same naming context. Directs the destination to sync with all sources instead of just one. This parameter cannot be used with source_dsa.
/readonly
This parameter is ignored by the /replicate operation.

repadmin replsingleobj

Replicates a single object between any two directory servers that have partitions in common. The two directory servers do not have a replication agreement. Replication agreements can be shown by using the repadmin /showrepl command.

Syntax

repadmin /replsingleobject dsa DsaSourceGUID ObjectDN

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
DsaSourceGUID
Specifies the unique hexadecimal number that identifies the object that will be replicated. The objectGUID can be retrieved by using showrepl.
ObjectDN
Specifies the distinguished name of the object.

repadmin showattr

The /showattr operation displays objects and their attributes.

Syntax

repadmin /showattr dsa OBJ_LIST [OBJ_LIST_OPTIONS] [/attr|/attrs: attribute attribute ...] [/allvalues] [/long] [/nolongblob] [/nolongblob] [/nolongfriendly] [/dumpallblob]

Parameters

Dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters. This is a required parameter.
OBJ_LIST
This parameter takes a distinguished name or a special keyword that expands into a distinguished name. The keywords are as follows: <DistinguishedName> specify the distinguished name of an object; Ncobj:config:; Ncobj:schema:; Ncobj:domain: This keyword represents the distinguished name of the domain directory partition of the directory server; Dsaobj: This keyword represents the NTDS settings object of the directory server; and, "" Use an empty string to specify the RootDSE.
OBJ_LIST_OPTIONS
The OBJ_LIST_OPTION parameter is required to perform a generic LDAP search from the command line. The parameter requires a BaseDN, with the ability to use a search modifier option. The valid search modifier options are as follows: /filter:<ldap_filter>; /base; /subtree; and, /onelevel. See the LDAP documentation for the LDAP filter syntax.
/atts:<attribute, attribute...>
Returns only the attributes that are specified. Separate each listed attribute with a comma. By default, returns all attributes.
/allvalues
For an attribute, the tool only displays 20 values unless this flag is specified, in which case it shows all values.
/long
Displays one value per line.
/nolongblob
This parameter is ignored by /showattr.
/nolongfriendly
This parameter is ignored by /showattr.
/friendlyblob[:attribute attribute ...]
If any attributes are specified, only those attributes that are named are displayed in friendly format. Otherwise, all known BLOBs are formatted.
/nolongfriendly
Does not format BLOBs.
/dumpallblob
Dumps the BLOB in a default byte-by-byte format if there is not a friendly formatted interpretation available for it.
/nodumpallblob
Does not show the BLOB if there is not a formatted interpretation available.
/attr|/attrs: attribute attribute ...
The parameters /attr or /attrs:, if present, specify that only those named attributes are displayed.
Note

A BLOB in this context means an attribute that is not a simple type, like a string or an integer. A BLOB is a complex structured type that is stored as binary bytes. To make sense of the BLOB, a program must interpret it and format it. A friendly BLOB is a BLOB that the program knows about and can format in an understandable way. The program has a list of BLOBs that it understands.

repadmin showcert

Displays the certificates (used with Simple Mail Transfer Protocol (SMTP)-based replication) that are loaded on a specified directory server.

Note

This command does not apply to ADAM.

Syntax

repadmin /showcert dsa

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.

repadmin showchanges

Displays changes from a specified directory partition or changes to a specified object. "Syntax 1" saves changes to a directory partition. If this information is saved to a file, the getchanges operation can be run again for comparison. "Syntax 2" lists changes to a specified object.

Note

For this command to run properly, the account under which the command is run must possess the replication get changes right on the specified directory partition.

Syntax 1

repadmin /showchanges source_dsa NamingContext [/cookie: File] [/atts: attribute,attribute,...]

Syntax 2

repadmin /showchanges dest_dsa SourcedsaObjectGUID NamingContext [/verbose] [/statistics] [/noincremental] [/objectsecurity] [/ancestors] [/atts: attribute1,attribute2,...] [/filter: ldap filter]

Parameters

dest_dsa
Specifies the host name of the destination directory server from which to enumerate the host directory servers.
source_dsa
Specifies the host name of the directory server that hosts the directory partition whose changes you want to view.
NamingContext
Specifies the distinguished name of the directory partition.
/cookie: File
Specifies a name for the file to which list changes are saved.
/atts: attribute1attributes...
Returns only the attributes specified. Separate each listed attribute with a comma.
SourcedsaObjectGUID
Specifies the unique hexadecimal number that identifies the object whose changes will be listed. The objectGUID can be retrieved by using the showrepl operation.
/verbose
Lists detailed information.
/statistics
Displays a summary of information about changes, instead of a list of individual changes.
/noincremental
Returns changes in value change format, which lists current values for attributes as well what attributes have been added or deleted. If not specified, changes are returned in attribute change format, which shows only the current value of the attribute.
/objectsecurity
Overrides the need for the Get Changes right to the directory partition. By default, this right is needed to run the GetChanges parameter. However, only changes that the currently logged on user has the rights to view are displayed.
/ancestors
Returns changes in USN order.
/filter: ldap filter
Returns only those changes that meet the filter requirements.
Note

The information from "Syntax 1" can be saved to a file for later comparison.

repadmin showconn

Displays the connection objects for a specified directory server. The default is local site.

Syntax

repadmin /showconn [dsa] [ServerRDN|ContainerDN|dsa_GUID] [/From:ServerRDN] [/intersite]

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
ServerRDN
Specifies the relative distinguished name of a server.
ContainerDN
Specifies the distinguished name of a container.
dsa_GUID
Specifies the unique hexadecimal number that identifies the directory server. The GUID can be retrieved by using the showrepl operation.
/From: ServerRDN
Displays only the connection objects that exist to the specified server. By default, all connection objects are displayed.
/intersite
Displays only those connection objects that are between sites.

repadmin showctx

Displays a list of computers that have opened sessions with a specified directory server.

Syntax

repadmin /showctx [dsa] [/nocache]

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
/nocache
Specifies that GUIDs are left in hexadecimal form. By default, GUIDs are translated into strings.

repadmin showism

Queries the Intersite Messaging Service (ISM) for site routes. This operation cannot be executed remotely.

Note

This command does not apply to ADAM.

Syntax

repadmin /showism [TransportDN] [/verbose]

Parameters

TransportDN
Specifies whether the mail server is using SMTP or RPC to send messages.
/verbose
Lists detailed information.
Note

This command cannot be run against a remote directory server.

repadmin showmsg

Displays the error message for a given error number.

Syntax

repadmin /showmsg {Win32Error|DSEventID /NTDSMSG}

Parameters

Win32Error
Returns a short description of the given Win32 error code.
DSEventID /NTDSMSG
Returns the actual event log text for the specified event ID.

repadmin showncsig

Each directory server maintains a directory partition signature list. This command displays a list of the removed application partition GUIDs. An application directory partition can be configured to be held or not held on a particular directory server using dsdbutil (for ADAM), or ntdsutil (for Active Directory).

Syntax

repadmin /showncsig [dsa]

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.

repadmin showobjmeta

Displays the replication metadata for a specified object that is stored in the directory, including attribute ID, version number, originating and local USN, and originating server's GUID and Date and Time stamp. By comparing the replication metadata for the same object on different directory servers, an administrator can determine whether replication has taken place.

Syntax

repadmin /showobjmeta [dsa] ObjectDN [/nocache] [/linked]

Parameters

dsa
Specifies the host name of the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
ObjectDN
Specifies the distinguished name of the object.
/nocache
Specifies that GUIDs are left in hexadecimal form. By default, GUIDs are translated into strings.
/linked
Displays metadata that is associated with, but not stored with, the specified object.

repadmin showoutcalls

Displays calls that have been made by the specified directory server to other directory servers but not yet answered.

Syntax

repadmin/showoutcalls [dsa]

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.

repadmin showproxy

Lists cross-domain move proxy objects. When an object is moved from one domain to another, a marker remains in the original domain. This marker is called a proxy.

Note

This command does not apply to ADAM.

Syntax 1

repadmin /showproxy [dsa] [NamingContext] [matchstring]

Syntax 2

repadmin /showproxy [dsa] [ObjectDN] [matchstring] /movedobject

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
NamingContext
Specifies the distinguished name of the directory partition on the source directory server.
ObjectDN
Specifies the distinguished name of the object.
matchstring
Specifies a filter for the output. Type a string of characters that must be present in the distinguished name to display the object.
movedobject
Displays a history of information from the original domain on a moved object after it has reached the new domain.

repadmin showrepl

Displays replication information. Inbound replica links are displayed by default. Outbound links can also be shown, as well as connections corresponding to those links. The command also displays errors corresponding to replica links that cannot be created by KCC. This helps the administrator build a visual representation of the replication topology and see the role of each directory server in the replication process.

Syntax

repadmin /showrepl [dsa] [SourceDCObjectGUID] [NamingContext] [/verbose] [/nocache] [/repsto] [/conn] [/csv] [/all] [/errorsonly] [/intersite]

Parameters

dsa
Specifies the host name of the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
SourceDCObjectGUID
Specifies the unique hexadecimal number that identifies the object whose replication events will be listed.
NamingContext
Specifies the distinguished name of the directory partition.
/verbose
Lists detailed information.
/nocache
Specifies that GUIDs are left in hexadecimal form. By default, GUIDs are translated into strings.
/repsto
Lists the directory servers that pull replication information from the specified directory partition. To see the outbound neighbors, specify /repsto or /all.
/conn
Displays the connection objects that are associated with each link.
/csv
Displays the output of the repadmin showrepl operation in a Comma Separated Variable (CSV) format for viewing and analysis in Microsoft Excel. Repadmin supports redirection of screen output to a file.
/all
Displays all replication partners.
/errorsonly
Only shows the partnership if it has an error associated with it.
/intersite
Only shows this partnership if the source server belongs to a different site than the site of the server on which the command is being run.

repadmin showscp

Displays service connection point (SCP) objects in Active Directory that have been created by ADAM instances. This command must be run against an Active Directory domain controller.

Syntax

repadmin /showscp [dsa]

Parameters

dsa
Specifies the host name of a directory server that the object will be replicated to. For details about the dsa parameter, see General parameters.

repadmin showsig

Displays the retired invocation IDs on a directory server. A directory server changes its invocation ID when it is restored or when it rehosts an application partition.

Syntax

repadmin /showsig [dsa]

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.

repadmin showtime

Converts a directory service time value to string format for both the local and the Universal Time, Coordinated (UTC) time zones.

Syntax

repadmin /showtime [DSTimeValue]

Parameters

DSTimeValue
Specifies the time value to be converted.
Note

With parameters omitted, repadmin /showtime displays the current system time in both the directory service format and the string format.

repadmin showtrust

Lists all Active Directory domains that are trusted by a specified Active Directory domain.

Note

This command does not apply to ADAM.

Syntax

repadmin /showtrust [dsa]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.

repadmin showutdvec

Displays the highest USN for the specified directory server. This information shows how up to date a replica is with its replication partners.

Syntax

repadmin /showutdvec dsa NamingContext [/nocache] [/latency]

Parameters

dsa
Specifies the directory server to which the object will be replicated. For details about the dsa parameter, see General parameters.
NamingContext
Specifies the distinguished name of the directory partition.
/nocache
Specifies that GUIDs are left in hexadecimal form. By default, GUIDs are translated into strings.
/latency
Sorts the information by the time required to complete the replication. By default, the information is sorted by USN.

repadmin showvalue

Displays the values of the type, last modified time, originating directory server, and distinguished name of a specified object.

Syntax

repadmin /showvalue [dsa] ObjectDN [AttributeName] [ValueDN] [/nocache]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
ObjectDN
Specifies the distinguished name of the object.
AttributeName
Specifies a single attribute whose value you want to display.
ValueDN
Specifies the distinguished name of the attribute that is displayed.
/nocache
Specifies that GUIDs are left in hexadecimal form. By default, GUIDs are translated into strings.

repadmin syncall

Synchronizes a specified directory server with all replication partners. This command contains several subcommands, which are described below.

Note

By default, if no directory partition is provided in the namingcontext parameter, the command performs its operations on the configuration directory partition.

Syntax

repadmin /syncall dsa [NamingContext] [Flags]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
NamingContext
Specifies the distinguished name of the directory partition.
Flags
Performs specific actions during the replication, as indicated in the following table.

Flag | Description
/a | Abort if any server is unavailable.
/A | Synchronize all directory partitions that are held on the directory server represented by dsa.
/d | Identify servers by distinguished name (rather than GUID DNS) in messages.
/e | Synchronize the directory partition across all sites. (The default behavior is to synchronize the directory partition only in the site in which the directory server represented by dsa resides.)
/h | Display help for repadmin /syncall.
/i | Iterate indefinitely.
/I | Perform repadmin /showrepl on each directory server pair in the path, rather than performing synchronization.
/j | Synchronize adjacent directory servers only.
/p | Pause for possible user abort after every message.
/P | Push changes outward from the directory server that is represented by dsa. (The default behavior of the command is to pull, rather than to push, changes.)
/q | Run in quiet mode; suppress callback messages.
/Q | Run in very quiet mode; report fatal errors only.
/s | Perform a topology analysis and generate messages, but do not synchronize the directory partition.
/S | Skip initial directory server response checking, and assume that all directory servers are available.

repadmin viewlist

Displays a list of directory servers.

Syntax

repadmin /viewlist [dsa] [OBJ_LIST]

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.
OBJ_LIST
Accepts a distinguished name or a special keyword that expands into a distinguished name. The keywords include the following: Ncobj:config:; Ncobj:schema:; Ncobj:domain: This keyword is the domain partition distinguished name of the home server; and, Dsaobj: This keyword is the NTDS settings object of the home server.

repadmin writespn

Updates the service principal names (SPNs) in Active Directory.

Note

This command does not create SPNs in ADAM. However, ADAM setup may generate scripts that utilize this command for writing SPNs for ADAM instances into Active Directory. For more information, see Administering ADAM service principal names.

Syntax

repadmin /writespn [dsa] {add|replace|delete} accountDN SPN

Parameters

dsa
Specifies a directory server. For details about the dsa parameter, see General parameters.

Formatting legend

Format | Meaning
Italic | Information that the user must supply
Bold | Elements that the user must type exactly as shown
Ellipsis (...) | Parameter that can be repeated several times in a command line
Between brackets ([]) | Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd} | Set of choices from which the user must choose only one
Courier font | Code or program output


Glossary

Symbols | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

Symbols

1.2.840.113556.1.4.1851

The object identifier that is assigned to Active Directory Application Mode (ADAM). You can use this object identifier programmatically to differentiate ADAM from other directory services.

See also: directory service; object identifier

A

Active Directory

The Windows-based directory service. Active Directory stores information about objects on a network and makes this information available to users and network administrators. Active Directory gives network users access to permitted resources anywhere on the network using a single logon process. It provides network administrators with an intuitive, hierarchical view of the network and a single point of administration for all network objects.

See also: directory service

Active Directory Application Mode (ADAM)

A stand-alone directory service that is designed specifically for use with directory-enabled applications. Active Directory Application Mode (ADAM) does not require or depend on Active Directory forests or domains. ADAM stores and replicates only application-related information. ADAM does not store or replicate network operating system (NOS)-related information.

See also: directory service; directory-enabled application

Active Directory Application Mode (ADAM) instance

For Active Directory Application Mode (ADAM), a single copy of the ADAM directory service, along with its associated directory store, assigned Lightweight Directory Access Protocol (LDAP) and Secure Sockets Layer (SSL) ports, and application event log. You can run multiple ADAM instances simultaneously on a single computer.

See also: Active Directory Application Mode (ADAM); directory service; Lightweight Directory Access Protocol (LDAP); Secure Sockets Layer (SSL)

ADAM

See definition for: Active Directory Application Mode (ADAM)

ADAM instance

See definition for: Active Directory Application Mode (ADAM) instance

authentication

The process for verifying that an entity or object is who or what it claims to be. Examples include confirming the source and integrity of information, such as verifying a digital signature or verifying the identity of a user or computer.

authentication protocol

The protocol by which an entity on a network proves its identity to a remote entity. Typically, identity is proved with the use of a secret key, such as a password, or with a stronger key, such as the key on a smart card. Some authentication protocols also implement mechanisms to share keys between client and server to provide message integrity or privacy.

See also: authentication

B

binding

A process by which software components and layers are linked together. When a network component is installed, the binding relationships and dependencies for the components are established. Binding allows components to communicate with each other.

C

configuration set

For Active Directory Application Mode (ADAM), a set of ADAM instances that share and replicate a common schema partition and a common configuration partition.

See also: Active Directory Application Mode (ADAM); Active Directory Application Mode (ADAM) instance

D

Digest Access protocol

A lightweight authentication protocol for parties involved in communications that are based on Hypertext Transfer Protocol (HTTP) or Simple Authentication and Security Layer (SASL).

See also: Microsoft Digest; Simple Authentication and Security Layer (SASL)

directory service

Both the directory information source and the service that makes the information available and usable. A directory service enables the user to find an object when given any one of its attributes.

See also: Active Directory

Directory Services Markup Language (DSML)

An open, extensible, standards-based format for publishing directory service schemas and exchanging directory contents.

See also: directory service

directory-enabled application

An application that reads, writes, or modifies data that is stored in a directory service.

See also: directory service

DLL

See definition for: dynamic-link library (DLL)

DSML

See definition for: Directory Services Markup Language (DSML)

dynamic-link library (DLL)

An operating system feature that allows executable routines (generally serving a specific function or set of functions) to be stored separately as files with .dll extensions. These routines are loaded only when needed by the program that calls them.

E

There are no glossary terms that begin with this letter.

F

There are no glossary terms that begin with this letter.

G

group

A collection of users, computers, contacts, and other groups. Groups can be used as security or as e-mail distribution collections. Distribution groups are used only for e-mail. Security groups are used both to grant access to resources and as e-mail distribution lists.

group account

A collection of user accounts. By making a user account a member of a group, you give the related user all the rights and permissions granted to the group.

See also: group

group memberships

The groups to which a user account belongs. Permissions and rights granted to a group are also provided to its members. In most cases, the actions a user can perform in Windows are determined by the group memberships of the user account to which the user is logged on.

See also: group

H

Hypertext Transfer Protocol (HTTP)

The protocol used to transfer information on the World Wide Web. An HTTP address (one kind of Uniform Resource Locator (URL)) takes the following form: http://www.microsoft.com.

I

There are no glossary terms that begin with this letter.

J

There are no glossary terms that begin with this letter.

K

There are no glossary terms that begin with this letter.

L

LDAP

See definition for: Lightweight Directory Access Protocol (LDAP)

Lightweight Directory Access Protocol (LDAP)

The primary access protocol for Active Directory. LDAP is an industry-standard protocol, established by the Internet Engineering Task Force (IETF), that allows users to query and update information in a directory service. Active Directory supports both LDAP version 2 and LDAP version 3.

See also: Active Directory Application Mode (ADAM); directory service

M

Microsoft Digest

A security support provider (SSP) that implements the Digest Access protocol. Microsoft Digest provides a simple challenge response mechanism for authenticating clients, and it is intended for use by client/server applications that use communications that are based on Hypertext Transfer Protocol (HTTP) or Simple Authentication and Security Layer (SASL).

See also: authentication; Digest Access protocol; Hypertext Transfer Protocol (HTTP); security support provider (SSP); Simple Authentication and Security Layer (SASL)

N

Network Service account

A predefined local account that is used to start a service and provide the security context for that service. The name of the account is NT AUTHORITY\NetworkService. The Network Service account has limited access to the local computer and authenticated access (as the computer account) to network resources.

O

object identifier

A number that identifies an object class or attribute. Object identifiers (OIDs) are organized into an industry-wide global hierarchy. An object identifier is represented as a dotted decimal string, such as 1.2.3.4, with each dot representing a new branch in the hierarchy. National registration authorities issue root object identifiers to individuals or organizations, who manage the hierarchy below their root object identifier.

P

There are no glossary terms that begin with this letter.

Q

There are no glossary terms that begin with this letter.

R

replica

In Active Directory replication, one instance of a logical Active Directory partition that is synchronized by means of replication between domain controllers that hold copies of the same directory partition. Replica can also refer to an instance of an object or attribute in a distributed directory. In the File Replication service (FRS), a computer that has been included in the configuration of a specific replica set.

See also: Active Directory

S

SASL

See definition for: Simple Authentication and Security Layer (SASL)

Secure Sockets Layer (SSL)

A proposed open standard for establishing a secure communications channel to prevent the interception of critical information, such as credit card numbers. Primarily, it enables secure electronic financial transactions on the World Wide Web, although it is designed to work on other Internet services as well.

security context

The security attributes or rules that are currently in effect. For example, the rules that govern what a user can do to a protected object are determined by security information in the user's access token and in the object's security descriptor. Together, the access token and the security descriptor form a security context for the user's actions on the object.

security ID (SID)

A data structure of variable length that identifies user, group, and computer accounts. Every account on a network is issued a unique SID when the account is first created. Internal processes in Windows refer to an account's SID rather than the account's user or group name.

See also: group account

security package

The software implementation of a security protocol. Security packages are contained in security support provider dynamic-link libraries (DLLs) or in security support provider/authentication package DLLs.

See also: security support provider (SSP)

security principal

An account holder that is automatically assigned a security identifier (SID) to control access to resources. A security principal can be a user, group, service, or computer.

See also: group; security ID (SID)

security protocol

A specification that defines security-related data objects and rules about how the objects are used to maintain security on a computer system.

security support provider (SSP)

A dynamic-link library (DLL) that implements the Security Support Provider Interface (SSPI) by making one or more security packages available to applications. Each security package provides mappings between an application's SSPI function calls and an actual security model's functions. Security packages support security protocols such as Kerberos and NTLM.

See also: dynamic-link library; security package; security protocol; Security Support Provider Interface (SSPI)

Security Support Provider Interface (SSPI)

A common interface between transport-level applications, such as Microsoft Remote Procedure Call (RPC), and security support providers (SSPs), such as Windows Distributed Security. SSPI allows a transport application to call one of the SSPs to obtain an authenticated connection. These calls do not require extensive knowledge of the security protocol's details.

See also: security protocol; security support provider

Service Principal Name (SPN)

A way of referring to a service principal. SPN structures generally follow Internet Engineering Task Force (IETF) naming conventions, and they often include the name of the computer on which the service is running. SPNs may be used to request Kerberos tickets, and they are required for mutual authentication.

See also: authentication

SID

See definition for: security ID (SID)

Simple Authentication and Security Layer (SASL)

An open framework, described in Request for Comments (RFC) 2222, for adding authentication support to connection-based protocols.

See also: authentication

SSL

See definition for: Secure Sockets Layer (SSL)

SSP

See definition for: security support provider (SSP)

SSPI

See definition for: Security Support Provider Interface (SSPI)

T

There are no glossary terms that begin with this letter.

U

There are no glossary terms that begin with this letter.

V

There are no glossary terms that begin with this letter.

W

There are no glossary terms that begin with this letter.

X

X.500

A set of standards defining a distributed directory service, developed by the International Standards Organization (ISO).

See also: directory service

Y

There are no glossary terms that begin with this letter.

Z

There are no glossary terms that begin with this letter.


Specifying administrative credentials for the configuration set

On the Administrative Credentials for the Configuration Set page, you must specify valid administrative credentials for the configuration set to which you are joining the ADAM instance.

To specify administrative credentials for the configuration set

  • On the Administrative Credentials for the Configuration Set page, do one of the following, and then click Next:

    • Click Currently logged on user.

    • Click This account, click Browse, and then select a local or domain account or group.

Note

  • The account that you specify on this wizard page must belong to the Administrators group in the configuration directory partition of the configuration set that you are joining (CN=Administrators,CN=Roles,CN=Configuration,CN={GUID}).


Selecting components to install

On the Installation Options page, you can choose to install Active Directory Application Mode (ADAM) and its administration tools, or you can choose to install ADAM administration tools only.

To select components to install

  • On the Installation Options page, do one of the following, and then click Next:

    • Under Install the following on this computer, click ADAM and ADAM administration tools.

    • Under Install the following on this computer, click ADAM administration tools only. Use this option if want to manage certain aspects of ADAM servers remotely, but you do not intend to install ADAM on the destination computer.

Notes

  • This wizard page only appears if the ADAM administration tools have not already been installed on the target computer.

  • ADAM administration tools include the ADAM ADSI Edit snap-in, the ADAM Schema snap-in, Ldp, and ADAM command-line tools. For more information about ADAM administration tools, see Related Topics.

See Also

  • ADAM Administration Tools
  • Connect and bind to an ADAM instance using ADAM ADSI Edit
  • Connect and bind to an ADAM instance using Ldp.exe
  • Using ADAM administration tools


Copying application directory partitions

On the Copy Application Directory Partitions page, you can specify one or more application directory partitions to copy from the configuration set that you are joining. You are not required to copy any application directory partitions when joining a configuration set.

To copy application directory partitions

  1. On the Copy Application Directory Partitions page, in Available partitions, click the application directory partition that you want to copy.

  2. Select any additional application directory partitions that you want to copy by holding down the CTRL key and clicking the additional directory partitions in Available partitions.

  3. To add the selected application directory partitions to Partitions to copy, click Add.

  4. Click Next.

Notes

  • If Available partitions does not contain any application directory partitions, the ADAM instance that you specified on the Joining a Configuration Set page does not contain any application directory partitions.

  • The configuration and schema directory partitions are always copied from the configuration set that you are joining, even if you choose not to copy any application directory partitions.


The ADAM Schema snap-in is not available

The ADAM Schema snap-in is not available

The ADAM Schema snap-in has not been installed, or online Help was unable to locate the appropriate MMC console file.

For information about installing the ADAM Schema snap-in and creating the appropriate MMC console file, see Install the ADAM Schema snap-in.


Joining a configuration set

On the Joining a Configuration Set page, you must specify an Active Directory Application Mode (ADAM) instance from which to replicate the configuration and schema directory partitions for the new ADAM instance that you are installing. The ADAM instance that you specify on this page also determines the ADAM configuration set in which the new ADAM instance will participate.

To join a configuration set

  1. In Server, specify the host name or DNS name of the computer that holds the ADAM instance belonging to the ADAM configuration set that you want the new ADAM instance to join.

  2. In LDAP port, specify the Lightweight Directory Access Protocol (LDAP) communication port number that is used by the ADAM instance, and then click Next.

Important

  • If you are installing a replica ADAM instance into an existing configuration set that includes ADAM instances in multiple forests, use the full DNS name, rather than the Internet Protocol (IP) address, when specifying the source ADAM instance from which to replicate.


Creating an ADAM instance replica from network or media

On the Copying Application Information page, you can specify the Active Directory Application Mode (ADAM) instance or media location from which the replica ADAM instance will be created.

To create an ADAM instance replica from network or media

  1. On the Copying Application Information page, do one of the following:

    • Click Over the network from the selected ADAM instance, if you want to replicate an ADAM instance that is currently running on the network.

    • Click From the restored backup files in these folders, if you want to create an ADAM instance from media.

  2. If you click From the restored backup files in these folders, specify the location of the recovered data (*.dit) and log (*.log) files in Restored data folder and Restored data recovery folder, respectively.

  3. Click Next.

Notes

  • To install an ADAM instance replica over the network, the ADAM instance must currently be running.

  • To install an ADAM instance replica from backup media, you must first restore an ADAM backup.

See Also

  • Back up an ADAM instance to a file or a tape
  • Install an ADAM replica from media
  • Restore an ADAM instance