Windows Server 2008 R2 New Active Directory Features

Windows Server 2008 put a decent amount of new Active Directory features. But what about Windows Server 2008 R2? This is expected to be released in the 4th quater of 2009. Here are some great new features to expect.



Recycle Bin for Active Directory



Starting with Active Directory, a fear of deleting objects came almost immediate. As the process to recover deleted objects takes a decent amount of downtime. As time went on Symantec put out a Backup Exec Agent for Active Directory that supposedly eased this trouble. But, now Microsoft has created a recycle bin for Active Directory objects. This recycle bin allows recover for deleted users, groups, etc... Attributes are automatically recovered with the object, including linked attributes. Objects by default are stored in the recycle bin for 180 days. The recycle bin retention time can be modified.



There are few requirements for you to get this feature. First, all domain controllers must be Server 2008 R2. Second, you must turn on the recycle bin. To gain access to the recycle bin is done solely through PowerShell. You can use the Get-ADObject cmdlet and pipe the results to the Restore-ADObject cmdlet. You can even empty the recycle by piping the results of querying whats in the recycle bin to the Remove-ADObject cmdlet.

Of course, the Active Directory database size or DIT file size does increase because of this feature. The size increases by 10% - 15% on average.

Managed Service Accounts

Many different programs and services needed to have an associated user account to perform certain tasks. The way these service user accounts were created was just like a regular user. But, now you had to manage these service user accounts and passwords. To do away with this issue Microsoft has come up with managed service accounts.

With managed service accounts (MSA), both the password and service principal name are managed by Active Directory. To create a MSA you use the New-ADServiceAccount cmdlet in PowerShell. You will also have to assign these accounts to a computer object, and you do this with the Add-ADServiceAccount cmdlet. A MSA can only be assigned to one computer object, so you cannot have multiple computers use the same MSA. You assign permissions to the MSA just like you would any other user account.

Since Active Directory manages the password, you don't enter one. This may pose a problem when you are installing a program that requires an account be specified and a password as well. To get around this you can create a temporary user account and then when the service is created, go in and change it to the MSA.

There are a couple limitations as well. First, scheduled tasks to not work with MSA's. Second, MSA's do not work with clustered services.

PowerShell

There are a new set of cmdlets in PowerShell for Active Directory. This is now more consistent with other server roles. You can also navigate Active Directory through familiar commands in PowerShell.

Active Directory Administrative Center

Microsoft has created a new interface. This interface is task oriented and now more consistent between the CLI and GUI. The navigation design is meant to support multiple domains and forests. This is the foundation for future UI enhancements.

Active Directory Best Practices

With Active Directory, there are hundreds of best practices but it changes for each environment. Also, it is sometimes hard to distinguish between best practices and "nice to haves". Also, when analyzing an issue, it can be quite cumbersome. To answer these challanges, Microsoft will be coming out with an Active Directory Best Practices tool. This is to be exptected since more and more of their other product have been getting this tool for some time now. The AD BPA will analyze AD settings that cause most unexpected behavior. The tool will only flag the setting or config, you will have to make the changes yourself.