In this slideshow, Azaleos identifies tips focusing on Active Directory improvements. They have collected the following best practices from their network operations centers for making Active Directory run more smoothly in 2012. These tips cover a lot of ground, from consolidation down to smaller items, such as using the new recycle bin feature. Start small and tackle each of these items gradually. This will enable you to stay current with required fixes, while monitoring the health, performance and functionality of your AD enterprise for smooth sailing into the new year.
Click through for 10 tips to keep Active Directory running smoothly in 2012, as identified by Azaleos.
Stay current with critical security hot fixes. Be vigilant about Domain Controller security.
The Active Directory (AD) Domain Controller (DC) is one of the most important servers in your enterprise. The DC holds all of the individual identities (usernames and passwords) along with their fundamental access rights (group membership). If the DC falls behind on security patches, then it will be vulnerable to malware or malicious hackers looking to assume and leverage increased privileges. Test and apply critical security hot fixes in short order to minimize the window of exposure and reduce the possibility of falling victim to publicly documented exploits.
Build an Active Directory test lab. Safely test your changes and ideas in a sandbox.
Creating a sandbox test lab for your Active Directory environment can be invaluable for safely evaluating validations, potential changes, new applications and process discoveries. A basic AD test lab which replicates user accounts and objects from your production environment can be built quite easily. If the lab must be a closer approximation of the actual production environment, then additional resources can be added such as name resolution services, remote access, client server applications and beyond. This sandbox allows you to ferret out catastrophic errors, failure or similar complications such as bugs in new operating system versions, patches or applications – without impacting the production AD infrastructure.
Plan, document and test a strategy for Active Directory backups and disaster recovery. Prepare for the storms.
When disaster strikes, your chances of making a successful recovery will increase exponentially if you have planned ahead and created a solid disaster recovery (DR) strategy. A good DR methodology should include, but should not be limited to, a backup and restore process to recover granular attribute information or entire domain controllers. In addition, your plan should also test and include details to recover the entire AD forest, in the event that all DCs become collectively unavailable. A solid, tested and proven DR strategy plan can make all the difference in providing a clear path for recovery.
Plan your upgrade from Windows Server 2003 domains and forests to Windows Server 2008 R2. Bring a new feature set to the table.
If you are still managing a Windows Server 2003 domain and forest, it’s time to look at upgrading to Windows Server 2008 R2. There is an array of new features and improvements in Windows Server 2008 R2 by itself, beyond the enhancements brought specifically to AD. Windows Server 2008 adds fine-grained password policies, read-only DCs, restartable AD services, snapshot viewer and more. Furthermore, Windows Server 2008 R2 includes an AD recycle bin, Active Directory Administrative Center, Best Practices Analyzer and the PowerShell AD module, to name a few. Be sure to take inventory of all the benefits you can get from making the leap to Windows Server 2008 R2.
Perform your own general Active Directory health check. Bring looming problems to the surface.
Conduct an annual in-house AD enterprise health check using freely available tools to gain greater visibility into the state of the directory servers. You can start to assemble your toolkit with items such as DCDIAG – a directory services break/fix health tool that can check all of your DCs for a wide array of problems. Microsoft Baseline Security Analyzer (MBSA) can be used to evaluate the state of missing security hot fixes, service packs and application rollups along with remediation guidance if well-known vulnerabilities are present. In Windows Server 2008 R2, you can leverage the new AD Best Practices Analyzer (BPA) to scan DC roles against a large set of Microsoft best practices criteria to pinpoint possible misconfigurations that can lead to service degradations. You can also add performance data collectors for Active Directory and get a detailed view into the performance of your DCs and how resources are being utilized. Use these tools to ferret out issues in your AD infrastructure that could lead to outages or degrade directory services performance.
Use Distributed File System (DFS) and (-R)eplication with file servers. Raise the bar on file sharing.
Managing file resources across multiple file servers can be a fragmentation nightmare, since you may be addressing gaps with third-party products for backup, replication and centralized management. Take control of disparate and disjointed file server resources and create a simplified, logical, fault-tolerant file availability strategy with DFS (Distributed File System) and -R (Replication). The DFS-R technology uses the newer RDC or "diff over the wire" protocol to efficiently update only deltas and changes rather than the whole file as was done in the past with NTFRS technology and MD5 comparison. Using these feature sets you can join file shares from many locations and organize them logically into manageable structures. This will also allow you to use AD integration to create location aware services so that users can find the nearest server. In addition to logical structuring, DFS replication can be used to duplicate data across multiple servers and protect against single points of failure. This is definitely NOT the file sharing of yesterday.
Leverage Group Policy in order to efficiently manage policy across your enterprise. Centralize control.
If you are not using Group Policies (GPOs) to centrally manage O/S configurations and application settings in your enterprise, then you are doing a lot of extra and unnecessary work. With GPOs and the newer features of Windows Server 2008, you can easily manage configurations of computer groups including O/S behavior, registry settings, security policies, logon scripts, preferences and much more. You will significantly reduce total cost of ownership and policy management challenges. Windows Server 2008 R2 GPO has many improved features, including the long-desired ability to push registry changes, as well as map drives, among others.
Activate the new AD recycle bin feature for no-cost additional protection. Prepare for the big OOPS.
Prior to Windows Server 2008 R2, the ability to recover deleted objects existed, but it usually required taking a DC offline and performing multiple authoritative restores, leaving the object stripped of most attribute details. With Windows Server 2008 R2, you can enable and leverage the AD Recycle Bin to restore AD objects with all attributes in their entirety to the same state they were in just prior to deletion. This includes group membership. Using the recycle bin feature can help reduce directory services downtime by improving your ability to recover accidentally deleted AD objects without many of the previous challenges and deficiencies.
Simplify and optimize Active Directory replication topology. Direct the data flow.
Active Directory topology can be confusing at times and even more so when you co-mingle automatic and manual configurations. The AD topology is critical to the flow of AD metadata replication as well as SYSVOL GPO information. If you are working with a mix of automatic and manual configurations, then your overall topology may be a bit of a mystery. Take control of your AD topology by defining AD sites, site links, and manual connections into a specific topology which works best given your physical network environment. Once simplified, you can consider options such as enabling change-based notification across links, rather than interval-based notifications. This will provide much faster convergence that resembles intra-site, but will be truly inter-site.
Plan now to consolidate a fragmented AD enterprise. Simplify and unify administration.
Fragmented AD configurations create separate schema, directory synchronization, identity management, group policy and access strategy challenges. Reign in AD sprawl by planning and beginning your consolidation to a unified single forest/domain model with granular OU delegation. The general consensus within the AD design and architecture communities is that a single unified forest/domain model is the best option, except in cases where isolation, autonomy or replication boundaries are required. Depending on the size, scope and complexity of your environment, an AD consolidation can potentially be costly. Nevertheless, a unified AD model is undoubtedly easier to manage with a reduction in repeated tasks along with lower minimum requirements.
