One of the most time consuming, aggravating and emotionally draining issues our customers can go through is a disaster recovery issue. The general gyst of this type of thing is: -Accidental deletion of <insert terrifyingly large number here>...

Ah, there’s nothing like the stop-everything, our-company-has-come-to-a-complete-halt emergency call we sometimes get where the domain controllers have slowed to a figurative crawl. Resulting in nearly all other business likewise emulating a glacier as...

One of the enhancements in Windows Vista is the new certificate scripting interface called certenroll. In prior client operating system versions we had the xenroll code which would allow users to enroll for certificates via a web page served out by their...

Whenever we release a new product or suite of products we at Microsoft want to ease the adoption of it. For that reason we’ve released tools and scripts over the years to help our customers out. We’ve typically given these as free downloads from the internet...

A lot of planning goes into the features and capabilities of each Windows release. Over the years I’ve noticed that there is not a great deal of awareness out in the general public for just how much work and labor goes into a new version of Windows...

We’ve had a few customers tell us that they would really like to not be prompted in application launch scenarios with some applications. There are some valid reasons why this may not be entirely helpful and reduction in clickage can be good when it doesn...

Here’s another question we get asked occasionally: is there a way to load the entire Active Directory database into RAM? The idea behind this question is that having the sought after data in physical RAM would prevent the delays of seek time and...

For the first technical post I thought it would be best to lay the groundwork and mention a tool which can be used in a wide variety of AD replication scenarios. We'll talk about one of the useful features in this post, and follow up with one other for...

Understanding how things work is as much of a tool as anything included in the Adminpack or Support Tools. If you know how things work, you know what to expect in normal behavior, and what questions to ask when the behavior your seeing is abnormal. ...

There are other utilities out in the wild that can be used to give a comprehensive test of AD replication, but few are as definitive as REPADMIN /SHOWREPL command in the CSV format. I'm willing to bet there are some folks who just read that statement and are thinking that it sounds pretty silly. I promise you'll be believers after using this tool, particularly those folks out there who are new to the environment they administer or that may work as consultants and so get confronted by new environments all the time. ...

It occurred to me that my post from last week was a bit lacking in the technical detail. As a recap, the issue was regarding the scenario of: -Locked a computer when well connected (DC reachable across the network) -Unlocked computer when...

For folks who have been interested helping test Active Directory Migration Tool version 3.1 your day has come! The ADMT 3.1 Beta is here! This is a beta , not the finished product, so please test it out in your non-production environment and file...

If you are working in a support or engineering role with Microsoft platform products like the various Windows versions one of the biggest struggles you can have is understanding what to expect in code and on the network when Windows computers communicate...

A while back my colleague Ned Pyle wrote a really great blog post about what to do in your IT career if you want to excel.   You can read it here, and if you read just that today (and take it to heart) you’ve done something good for yourself...

Not another post about Kerberos! Sorry folks, my Momma said ‘stick with what you’re good with’. And since playing Halo 3 is not a paying job I’m doing another blog post on Kerberos. I thought this would be a good one to post since how this works...

    Over the past few years we’ve learned more about “NTLM and MaxConcurrentApi Concerns” and we’ve even come up with some new ways of addressing them.   The starting point for learning more is the Knowledge Base article You are intermittently...

A while back I got involved in an issue where a company had written an application for their own internal use. This application was intended to connect to a web page served out by IIS and then proceed with some other action. They wisely chose to make...

Hello, all. This is the first post in what I hope will be a useful blog for the Windows admin community. In particular, the AD (or directory services in general) admins out there. I work at one of Microsoft's Global Technical Support Centers providing...

Recently I posted saying that I’d give a preview of Longhorn Server Active Directory. Well, here it is. I will caution all who read this to take into account that we are still in a beta production phase, so some or all of these items could change (or...

In the concerted effort to provide more secure methods of authentication we have added in product behind-the-scenes support for Advanced Encryption Standard (AES) and other security enhancements. More info on that is here: http://www.microsoft...

One of my pet peeves is when I don’t recall every detail of a troubleshooting step or technique and can’t immediately find a document that explains it. It’s like when I misplace a book I’ve been reading-I wander around the house in circles looking for...

You may heard of a little thing we like to call Windows Vista. In fact, you may be slightly deafened by our marketing making sure you do know about it. Vista contains various security enhancements all designed to work toward the goal of keeping...

A while back I wrote a blog post regarding PAC (Privilege Attribute Certificate) validation in Microsoft Kerberos. We’ve had enough interest in this lately, particularly around the idea of disabling it, that it seemed like a good idea to post about this...

A while back I did a blog post about some problems that were seen with people testing Windows Vista and then “rolling back” to Windows XP and some problems that could be seen when using the same computer object (also known as account) in AD. If you didn’t get a chance to read it here’s the post. What that scenario highlighted was the added level of encryption, by way of leaving behind a little of the supporting infrastructure in the msds-supported-encryptiontypes attribute value. In this post we’re going to talk about the Big Picture of the new authentication encryption available and a few things to keep in mind....

Ever heard of a Best Practice Analyzer , otherwise known as a ‘BPA’? It’s a type of tool that many of our product or support teams have been creating the last few years which can be used to gauge the general health of a component before things go catastrophically...