09 June 2006

Introducing the Active Directory Discussion Blog....

Hello, all. This is the first post in what I hope will be a useful blog for the Windows admin community. In particular, the AD (or directory services in general) admins out there.

I work at one of Microsoft's Global Technical Support Centers providing support for Windows Directory Services every day. Working at Microsoft in that capacity has allowed me (and my colleagues) to see the common pitfalls as well as the less common, but very difficult scenarios. We get it all, but we're also more likely to see the more esoteric issues and know how to deal with them.

What I hope to do is post about once a week with a troubleshooting technique or scenario. Of course if there is a particular question anyone has, please ask. That's what this blog is for.

Small caveat: My forte is troubleshooting and fixing problems which are already occuring; that's simply what I deal with most often. For all other questions all I can say is that I will do my best to get you an answer (even if I pilfer it from a one of our resident brainiacs).

A little about me: I do technical support for Microsoft customers who use Active Directory. I've had the pleasure of providing support here at Microsoft for about eight years. In that time I've supported Windows client, worked the beta for Windows Millenium Edition (please look at that as a plus not a minus), worked as a partner technical lead with our outsource partners, been a support engineer, and now work as a support escalation engineer.

In the next few days I will be posting the first *technical* post (this certainly wasn't). So, come on back. Let's see if I can help when you do.

Filed under: Active Directory General

Comments

# aicchong said:

Great. Hope to see your technical post soon.

09 June 06 at 5:16 PM

# Shaun G said:

Hello,

In AD, there is an OU that is inheriting from the parent Org. I have added a specific security group to have permissions to this ou, and all object. however, when logged in as a user of the security group, I receive the following error.

The Active Directory object could not be displayed. Unable to view attribute or value. You may not have permissions to view this object.

Kind of stumped on this one, any ideas?

03 May 07 at 3:00 PM

# Tim Springston said:

Hi Shaun-

I think it would be a good idea to review the permissions that are there. And perhaps to verify that the security group you used is, in fact, on the users token.

For the OU and object permissions part you can use DSACLS.EXE to dump them to a text file and review them. It's generally easier than going through the properties sheet of each.

More on that is here: http://support.microsoft.com/default.aspx/kb/281146

For the token, there's a lot of different ways to check this. A nice GUI one is to use Process Explorer and look at the security tab of the Properties of Explorer.exe.

Process Explorer can be gotten here:

http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

Hope this helps!

Tim Springston

Microsoft Corporation

These postings are provided "AS IS" with no warranties, and confer no rights.

08 May 07 at 10:06 AM

Anonymous comments are disabled

About Tim Springston

Tim has worked in the Customer Services and Support division (formerly Product Support Services) of Microsoft since 1998, working escalated contract customer cases and emergency calls. He specializes in Windows Directory Services, which is Active Directory, Security, DFS, PKI and serveral other components of Windows Server. Tim's an alumni of the University of Missouri at Columbia (Mizzou) and does a great deal, perhaps too much, of 'test playing' Xbox 360 games in his spare time.