Why would you want to do this?

1. Running regular maintenance on the Active Directory Database recaptures disk space, makes the database file more efficient (faster) and checks for any weirdness.
2. When stuff gets deleted out of your active directory database, the file does not get any smaller.

*NOTE* – These items will be done using “NTDSUTIL” under the “Files” context. Three items this post will go over will be “Compact”, “Integrity” as well as “Semantic" Database Analysis”.

Getting ready to type the commands

Go and Open command prompt.

1. Type. “ntdsutil”.
2. Type “Activate Instance NTDS”

How to Defrag / Compact the Active Directory Database

* NOTE * You can’t compact the actual Active Directory Database! You will have to compact it to another location. Then copy the new file over the old version manually. This is the #1 concept issue I see people have. Most of the time they think just by running the command the database is defragged. Unfortunately this is not the case.

1. You need to “STOP” the “NTDS Service” before binding to the Active Directory database".
2. Go to “Administrator Tools” and select “Services”.
3. Right click “Active Directory Domain Services” and tell it to “Stop”. Windows will prompt you to tell you there are other services that will be stopped as well.
4. Go back to the command prompt that you opened at the beginning of the how to video. You might get an error about not being able to stop it. This is because replication is going on. You will just have to try stopping it again in a few seconds until it stops.
5. Type “Files”. IF you didn’t stop the NTDS Service in step 3 you will be alerted here with an error.
6. Type “compact to C:\” or where ever you want to create a copy of the compacted Active Directory Database.
7. Verify that a copy copy of the Active Directory Database file has been created @ “C:\ntds.dit”
8. Type “Quit” and “Quit”. This will get you back to the command prompt.
9. Type: copy “C:\ntds.dit” “C:\Windows\NTDS\ntds.dit”
10. Type: del “C:\Windows\NTDS\*.log”

How to Check the Active Directory Database Integrity

* NOTE * – After compacting the database you should always check the Integrity of the database. If you don’t still have the command prompt window go back to “Getting ready to type the commands section”.

1. Type “Files”
2. Type “Integrity”
3. This will make sure there is no issues with the with the compacting of the Active Directory Database
4. Once this command completes there will be a message recommending to you to run the “Semantic database consistency” check as well.

How to run the Semantic Database Consistency util

Still in the NTDS util run:

1. Type "quit” to go up one level in the NTDSutil instance structure.
2. Type “semantic database analysis”
3. Type “Verbose on”
4. Type “Go Fixup”

Remember to restart “Active Directory Domain Services”. All those services that were also stopped during the process of stopping the service will also be started.

1. You have to enable Auditing Policy (specifically Audit Directory Service) on either the domain Controller Policy or the Default Domain Policy. I recommend the Domain Controller Policy.
2. You have to turn on Auditing component on the Object(s) you want to audit.

How to setup/Enable Audit Directory Service

Here are the steps to Enable the Audit Directory Service.

1. Right click the Domain Controller Policy. Select. “Edit…”
2. Go to “Computer Configuration” – “Windows Settings” – “Security Settings” – “Local Policies” – “Audit Policy”
3. Double click “Audit Directory Service Access”
4. All the boxes should be selected. ie. “Define these policy settins”. Audit These attempts “Success” & “Failure”.

How to turn on Auditing on specific Active Directory Objects

Here are the steps to turn on Auditing on AD obejcts:

1. Open Active Directory Users and Computers
2. Go to View and make sure “Show advance features” is enabled.
3. Right click “Base OU” where you want to audit and hit Properties.
4. Click on Security Tab”. (If you don’t see this go back to step #2)
5. Click “Advanced” button near the bottom of the Window.
6. Click on “Auditing” tab in the new Window.
7. Click on “Add..” button
8. Select “Authenticated Users” group
9. Check off Successful and Failed for the Write all Properties. Make sure that “This object and all descendant objects” is selected.
10. Click “Ok”
11. Click “Ok”

How to View Active Directory Auditing Logs

Now that you’ve set this up you might be wondering “Where do I go to see all this auditing now? If you did you would have asked a really good question.

To view the Active Directory Auditing logs you need to open “Server Manager” – “Diagnostics” – “Windows Logs” – “Security”

• 4726 Message – This code is for deleting a user account. The user who did it will also be logged.
• 4720 Message – This code is for creating a user account. The user who did it will also be logged.

You might want to try and filter the events based on these messages.

The information should be pretty easy to understand if you’ve done any server type work before. While this isn’t an complete list of permissions it should be enough information to help you figure out what groups would give you the proper permission level.

There are some things that you will have to change in this script! In this script my Fully Qualified domain name is going to be called: “heinrichs.domain”. If you were to only change the FQ domain name everything else is the Active Directory defaults in the GUI install. Fortunately for most people Microsoft chose some very good defaults and unless you are some enormous enterprise outfit this script should also work for you.

Bellow if the setup file for the Active Directory setup and install. First make a directory on C: called “scripts”. Make a file called “dcpromo-answer.txt” and copy this info into that file.

[DCInstall]
; New forest promotion
ReplicaOrNewDomain=Domain
NewDomain=Forest
NewDomainDNSName=heinrichs.domain
ForestLevel=3
DomainNetbiosName=HEIINRICHS
DomainLevel=3
InstallDNS=Yes
ConfirmGc=Yes
CreateDNSDelegation=No
DatabasePath="C:\Windows\NTDS"
LogPath="C:\Windows\NTDS"
SYSVOLPath="C:\Windows\SYSVOL"
; Set SafeModeAdminPassword to the correct value prior to using the unattend file
SafeModeAdminPassword=
; Run-time flags (optional)
; RebootOnCompletion=Yes

You will want open a command prompt. You will need to type this command:

dcpromo.exe /unattend:C:\scripts\dcpromo-answer.txt

Once you do that you should have a fully working Domain Controller with Active Directory installed and setup!

Setting up Active Directory in Windows 2003

We are going to setup a new domain called “testdomain.private”.

1.) START – RUN – DC Promo

2.) Wizard Starts. Click Next.

3.) Give you some things to think about. We are going to assume that all clients are going to be Windows XP or higher. Click “Next”.

4.) Because we are creating a new domain select “Domain Controller for a new domain”.

5.) We are going to create the first Domain in a new forest.

6.) Type: testdomain.private

7.) The NetBIOS will already be pre-filled for you. Click “Next”.

8.) The info for the Active Directory Database is already filled out. I like to change the log folder like so. Click “Next”.

9.) The “SYSVOL” will already be filled out for you. Click “Next”.

10.) Select “Install and configure the DNS server on this computer and set this computer to use the DNS serve as it’s preferred DNS server.

11.) Set what types of computers will be authenticating against Active Directory.

12.) Enter Password for Active Directory

13.) This next screen just asks you to verify the last 12 Steps. Click Next.

14.) Active Directory is starting to be installed.

15.) Once it is complete you will see this:

Where is the AD Database file?

You can find the database file in C:\Windows\NTDS (default file location).

I like putting the Logs for Active Directory in a different folder. The picture below is from a screenshot during the Active Directory install via “dcpromo”.