Chris May

The other day I was helping a client of mine who was having some problems getting a user setup as the local administrator on a laptop.

When I went to add the user, the "From this location:" option only showed the local computer name, not the domain.

The computer WAS on the domain, so what was going on?

Well it turned out that a new router had been put in on that subnet, and the DHCP on the router had started handing out IP addreses.  Those IPs didn't have the DC as the DNS server, which is something that is needed in order to allow computers to figure out where company.local is really located.

After changing the DNS server to be the DC and not the router, everything worked as expected.

I have written a few programs in .Net that utilize Active Directory (AD), and what a pain it was.

Here is an article where the author created classes to encapsulate some of the objects in AD, which is pretty similar to what I did.

Keywords: LDAP, AD, Active Directory

I have been researching ways to reset a domain admin password for a client who forgot what they typed in when they set the password.

Most password crackers work only on local accounts, not for anything on a domain.  It seems like the way to go about this is to reset the local admin account, then login using Directory Service Recovery Mode to reset the domain admin account.

Here are some of the articles I have been reading:

http://www.jms1.net/nt-unlock.shtml  <-- this idiot won't let you view his pages if you are running IE, so use firebox, but again, that's just stupid

http://www.nobodix.org/seb/win2003_adminpass.html

http://home.eunet.no/~pnordahl/ntpasswd/

http://www.loginrecovery.com/about.html

http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm

 

I should look into this more.

Its called ADAM.

Here is the ever elusive, and poorly documented User schema for AD.

UPDATE: It seem they took away the page above.  Here is a new one.  First pick a type of object, for example User, then pick the property you want, like Surname.  Finally look for the LDAP Display Name, and it will show you the property name, e.g. "sn".

Here is a list of common ports used by Windows 2003 Server.

This microsoft page didn't help me any, but it is a useful referenece.

AD DNS Lookups

Just found this "Our Active Directory server is at address 10.50.100.36. Port 88 is Kerberos v5, and port 445 is microsoft-ds. The initial authentication gets two hits on port 88, but we get one more hit on port 88 in between a bunch of port 445s when we connect to the public share. Even when we transfer a file from the share, all traffic is still via port 445. "

This is a somewhat usefull, but confusing, list of many of the properties that are available in the property collection. If you look down the page for the "Attributes" section you can find a list of available names of properties for a DirectoryEntry item.

This Menu/Navigation control is pretty awsome!