I remembered that many moons ago, I had seen Dean Wells demonstrate this ability, so I dug out my notes and thought I would share (but Kudos to Dean).

If you open Active Directory Users and Computers, navigate to an OU and then select View Add/Remove Columns, we can see that the information about the Operating System is not available to add as a column.

But if we right click on a computer object  we can see that the Active Directory knows about the computers Operating System and Service Pack information.

If you view the computers attributes, we can see how these attributes are stored in Active Directory

The attributes I am interested in displaying in Active Directory Users and Computers are:

operatingSystem and operatingSystemServicePack

To add them to the Add/Remove columns tab, logon to the Active Directory with Schema Admin privileges, and start ADSIEDIT.MSC.

Navigate to the Configuration Partition and then DisplaySpecifiers and then select the code page for your language. For me this is 409.

navigate to CN=organizationalUnit-Display double click and navigate to extraColumns

Double Click extraColumns and add the following two values.

operatingSystem,Operating System,0,150,0
operatingSystemServicePack,Service Pack,0,150,0

These values equate to:

<ldapDisplayName>,<Column Title>,<Displayed by default>,<Column Width>,<unused>

Once the values are added, navigate your way out of ADSIEDIT.MSC and open Active Directory Users and Computers.  Once again navigate to an OU and then select View Add/Remove Columns we can now see two additional columns

Select Add to make then available in the displayed columns.

We now have Operating System and Service Pack information available at a glance, but many of the other attributes can be added in exactly the same way.

To enable detailed diagnostic logging there are a series of registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics which when set to a defined value will populate the information to the event logs.

The defined values are:

Any logging above level 3 can generate a lot of additional logged information and should be used with caution.

These values can be set against the one or more of these 24 keys

Key Name:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

1 Knowledge Consistency Checker

The KCC derives its input configuration from objects in the directory (for example, sites, servers and site links). The KCC reports if these objects are incorrect or missing. Events occurring during a run of the KCC.

Messages fall into the following categories:

KCC runtime errors, such as inconsistencies, resource errors or directory access problems. KCC output configuration problems. The new configuration cannot be built or is incomplete in some way.  Perhaps too many servers are down to build a complete topology at this time.

2 Security Events

Events related to security such as a user who tries to read or write an attribute with insufficient permissions, a user binding through MAPI, or a domain that has been changed to native mode.

3 ExDS Interface Events

Events related to communication between Active Directory and Exchange clients.

4 MAPI Interface Events

Events related to communication between Active Directory and Exchange clients.

5 Replication Events

Events related to outbound replication, where changed objects are found and inbound replication, where these changes are applied to a local database. “Normal” errors during the course of replication, such as a domain controller being down, are not logged. They are kept as status and are available through the replication tools. The errors logged during replication are generally critical inconsistencies that require user intervention, as database errors. The other kind of events logged by the replication category are information about which objects and attributes were updated and why.  Note that many attributes are updated each time replication occurs. Logging detail about attributes can generate a great deal of messages very quickly.

A level of 1 is safe and might be informative as to the general types of operations occurring for replication. A level higher than level 2 can result in filling up the log file and performance degradation.

6 Garbage Collection

Events generated when objects marked for deletion are actually deleted.

7 Internal Configuration

Interpretation and display of the internal directory service operations.

8 Directory Access

Reads and writes directory objects from all sources.

9 Internal Processing

Events related to the internal operation of Active Directory code such as processing security descriptor propagation. Error events in this category might be an indicator of serious problems in Active Directory. When the directory returns the status of “internal error,” this category can be used to identify the problem for Microsoft support. Set this category to 1 on all computers involved (client and server) and reproduce the problem. Note the point in the code where the internal error was raised.

10 Performance Counters

Events related to loading and unloading the NTDS performance object and performance counters.

11 Initialization/Termination

Events related to starting and stopping Active Directory.

12 Service Control

Processes Active Directory service events.

13 Name Resolution

Resolution of addresses and Active Directory names.

14 Backup

Events related to the backup of Active Directory. Specifically, errors occurring when ESE database records are read or written for backup purposes. Generally only logged when a backup operation is underway.

15 Field Engineering

Internal debugging trace.

16 LDAP Interface Events

Events related to LDAP. An example of events logged include the following: the LDAP server closed a socket to a client, unable to initialize LDAP Simple Bind Authentication, and LDAP over SSL is now available.

17 Setup

Events related to running the Active Directory Installation Wizard.

18 Global Catalog

Events related to Global Catalog. For example, “Promotion of this server to a Global Catalog will be delayed for %1 minutes. This delay is necessary so that the required partitions can be made ready before the GC is advertised.

The operations that occurs during this time include the KCC being run to generate the new topology, all read-only partitions in the enterprise being added to this server, and the contents of these partitions being replicated into this system.  If you want to promote the GC immediately without enforcing this precondition, set the registry variable

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\
GlobalCatalogDelayAdvertisement

(sec) to a DWORD value of 0. The GC will be promoted on the next attempt to check preconditions. This value can also be set to the maximum number of seconds that the DSA will wait before promoting to a GC.”

19 Inter-site Messaging

These messages are logged by the “Intersite Message” service, which is a separate service from the directory itself. There are two kinds of messages that are generated in this category:
The ISM Service is responsible for transporting replication messages between sites.
The ISM Service is also responsible for calculating site routes for the KCC to use. Note that the messages in this category are either fatal configuration errors, or informational messages about the amount of traffic being carried.

20 Group Caching

Events related to Universal Group Membership Caching on a domain controller in a site where this feature is enabled. The value is set to an integer from 0 (no logging) through 5 (most verbose logging). Significant events are reported at logging level 2. with many additional events reported at logging level 5.

21 Linked-Value Replication

Events related to Linked-Value Replication.

22 DS RPC Client

Events related to RPC Client

Controls the logging of events that are related to communication with the Directory Service.
Examples of logged events include remote procedure call (RPC) errors, cancelled calls, and service principal name (SPN)– related operations.

Real world example: Only up to 10 DNS failures are shown for any given 12 hour period, even if more than 10 failures occur. To log all individual failure events, set diagnostics registry value to 1.

23 DS RPC Server

Controls the logging of events that are related the RPC server service.

Example, during outbound replication and replication setup operations.

24 DS Schema

Events related to the Active Directory schema.

Example of an event logged includes a successful Active Directory Schema updates which records the event with and Event ID of 1582

September 2011 Update.

Added a list of resources for verifying that replication is working correctly.

Download it here.

Last night I met up with a former colleague who was having leaving drinks and he noted that I had become somewhat quiet on here and Twitter, so I thought I should put pen to paper so to speak and provide an update of sorts.

The reason for my silence is purely time, along with my day job and family commitments, I am also currently studying for a degree with the Open University (not the kind of OU I am used to dealing with though).  A degree is always something I felt I was capable of, but when I was younger never had the opportunity to do. The degree I am doing is a BSc (Honours) Computing and IT. I am actually amazed how much of the first module (My digital life) I already know and understand but I think transitioning my business knowledge, approach and experience into academic writing and process is where I will find it a challenge, but this is where my tutor Michelle will become invaluable.

I am at the stage of my career where I don’t need to do this degree for anything beyond personal accomplishment, but in the future when asked “What’s my degree in?” I can reply with an honest answer rather than changing the subject or feigning deafness.

As my studies progresses I will update this blog as I document my journey into the unknown.

Two features that I have configured on Facebook that I feel are worth pointing out:

Noise reduction (or increase).

Facebook has introduced a “subscribed” feature for your friends, this allows you to control the amount of noise that is generated on your profile.

The default is “Most Updates” which for most people is enough, but Mrs P., is constantly complaining that I miss a lot of her updates, so Mrs P is now set to “All Updates”

If you are fed up of people requesting “more chickens” or to “come and blow up the invading pirates” then you can un-tick “Games” which will remove those updates from your wall.

Stopping unwanted “Friends” from being able to chat you.

When you add a friend to Facebook, there is an option to “categorise” them. I have categorised my “Friends” in to a hierarchy of sorts.

Now if I only want to chat with my family and turn off the feature for everyone else I know, select the “asterix” in your Facebook chat window and select “Limit availability”

Ensure Only make available to “Family” is selected, now you will appear only appear in the chat list of your friends you have categorised as family,

If you have not categorised your friends you can do so retrospectively by selecting “Account” and then “Edit friends”

I hope this helps and I will be documenting other Facebook features soon – but I am not a Social Media consultant – Eileen Brown of Amastra is.

Microsoft have published an excellent document on Single-Label-Domains in Active Directory Domain Services (AD DS) – Considerations, Migration, and Co-existence. It is well worth a read, even if you are not impacted by this issue.

Management Summary

An Active Directory domain name that contains one or more labels separated by a dot is referred to as a fully qualified domain name with two or more names and it will be referred as FQDN in this document. In contrast there is the concept of single-label domain (SLD), which refers to Active Directory domain names with only one label.

Given that SLD is not a commonly deployed configuration and that many Microsoft and third-party applications have not been tested under an SLD configuration, Microsoft recommends FQDN Active Directory deployments. For companies who have deployed SLD, they should transition to an FQDN Active Directory deployment. This will ensure that they get the most value out of their deployed applications.

For companies that will be evaluating transition to FQDN from SLD configurations, this document describes the options and considerations that they will need to take into account. In particular it describes Domain Migration and Domain Rename operations and explains the different considerations of these two options, so that companies can build a transition plan that makes sense to them.

Long-term, the goal of Microsoft is to have customer infrastructures using common, tested configurations to minimize costs and effort to administrate the Active Directory (AD) and DNS environment. The use of multi-label names is Microsoft’s recommended naming configuration.

Organizations that have SLD configurations should begin by analyzing their current environment to find out the best mitigation option.

Domain rename operations might be feasible in certain scenarios, mainly for smaller organizations or those that can tolerate some outage while removing and reinstalling applications that are incompatible with domain rename.

The migration into a non-SLD forest and domain structure should be well aligned with the product lifecycle and the future IT infrastructure roadmap of the organization.

The transition from a single label to a fully qualified Active Directory domain namespace puts your clients, servers, domain controllers, the operating systems and applications in a namespace configuration that can deliver the following benefits:

• Provides the broadest application support, including the ability to deploy applications on day 1 after release without fear that support will be deprecated in a future release, will be deferred until a future release, or will never support forests configured with SLDs, possibly even blocking installation in SLDs.

• Receives the highest number of test passes by Microsoft and third-party application developers
• Requires the least additional configuration to register and resolve DNS names of interest
• Delivers the lowest total cost of ownership (TCO) by reducing complex configurations and by consolidating forest and domain structures
• Enables enhanced security capabilities of new versions of AD DS
• Aligns the namespace assigned to your forest with same type of namespace assigned to the top thousands of domains deployed and operated by other customers over the last decade or more
• Receive Microsoft cloud support, because only domains with fully qualified DNS names are supported by Microsoft cloud services such as BPOS and Office 365

Download: Single-Label-Domains in Active Directory Domain Services (AD DS) – Considerations, Migration, and Co-existence

The download includes a Lync Training Plans workbook which helps to target the most applicable training for the end user

Download

Planning Workbook – Focus is on the Information worker

Single Label Domains:

Singles Label Domains (SLD’s) are not supported (e.g. markparris.co.uk or markparris.net are, markparris. is not). Anyone with an SLD will have to migrate to a new forest to utilise Office 365.  See Microsoft Online Services compatibility with single-label domains, with disjoint namespaces, and with discontiguous namespaces

Forest Functional Level:

As far as I can ascertain the minimum supported Forest Functional Level should be Windows Server 2003 FFL (Level 2).  Even though DirSync and AD-FS support alternative FFL’s, the Microsoft Office 365 Beta Deployment Guide for Enterprises states this FFL level is required for Exchange 2010 SP1 hybrid mode coexistence and this is the lowest common denominator that Exchange 2010 SP1, DirSync and AD-FS all support.  If you don’t want to run Exchange 2010 SP1 in hybrid mode coexistence, then a lower FFL may be suitable. 

Active Directory Schema:

If the organisation has a requirement for deploying Exchange hybrid mode coexistence, then the Exchange Server 2010 SP1 Schema will need to be deployed. In a global environment, that perhaps still has 32bit domain controllers with an NTDS.DIT greater than 4GB, then this schema extension may require some thought and planning, due to the additional load it may place on your DC’s.

Summary of Exchange Online Simple Coexistence and Exchange Hybrid Mode Coexistence Capabilities

Number of Forests:

Office 365 will initially only support single sign on from a single forest. This may change moving forward, but if it does not then a forest rationalisation project may need to instigated. This could be a huge piece of work.

Domain Name:

To utilise AD-FS and single sign-on, the forest name or more specifically the UPN of the forest must be Internet routable. See: http://markparris.co.uk/2011/03/08/active-directory-local-domain-design-and-office-365 This could be a huge piece of work.

Active Directory Recycle Bin

If the Active Directory Recycle Bin has been enabled then this may impact your total object count quota for Directory Synchronization (in the beta this was 10000 objects). If the Active Directory Recycle Bin has not been enabled, this may be a factor in waiting before enabling it as it is an irreversible action.

Active Directory Cleanup:

Remove duplicate proxyAddress and userPrincipalName attributes.

Update blank and invalid userPrincipalName attributes with a valid userPrincipalName.

Ensure the attributes meet the requirements and remove invalid or questionable characters as detailed:

sAMAccountName

Maximum number of characters: 20

Invalid Active Directory characters: !#\$%\^&\{\}\\{`~"",\\/\[\]:@<>\+=;\?\* If a user has an invalid sAMAccountName but a valid userPrincipalName, the user account is created in Office 365.

If both the sAMAccountName and userPrincipalName are invalid, the on-premises Active Directory userPrincipalName must be updated.

givenName

Maximum number of characters: 64

Questionable characters: ?@\+

sn (surname) Maximum number of characters: 64

Questionable characters: ?@\+

displayName

Maximum number of characters: 256

Questionable characters: \?@\+

mail

Maximum number of characters: 256

Invalid characters: [! #$ %&*+ / = ? ^ ` { }]

Duplicate values: The mail attribute cannot contain any duplicate values.

mailNickname Maximum number of characters: 64

Invalid characters: ""\\\[\]:><;

proxyAddresses

Maximum number of characters: 256

Invalid characters: \)\(;><\]\[\\,

userPrincipalName Maximum number of characters for username: 64

Maximum number of characters for domain name: 256

Invalid characters: }{ # ‗ $ % ~* + ) ( > < ! / \ = ? `

& character: Automatically changed to underscore

^ character: The value is automatically removed.

(_) character: This remains the same.

Duplicate proxies will be emailed as an error before any notification errors.

Additional requirements for a valid userPrincipalName:

@ character is required in each userPrincipalName value.

@ character cannot be first character in each userPrincipalName value.

Username cannot end with a period (.) an ampersand (&) a space ( ), or at sign (@)

Username cannot have a space ( ).

Routable domains must be used (.local or .internal cannot be used)

Unicode is converted to underscore characters.

userPrincipalName may not contain any duplicate values in the forest.

Groups

Mail-enabled character check: All mail-enabled groups must follow the pattern of *@*.

Contacts Mail-enabled character check: All mail-enabled contacts must follow the pattern of *@*.

Attributes:

Populate the following Username attributes:

First Name

Last Name

Display Name

For optimal use of the Global Address List (GAL), populate the following GAL attributes:

Job Title

Department

Office

Office Phone

Mobile Phone

Fax Number

Street Address

City

State or Province

Zip or Postal Code

Country or Region

Note:  This page will be regularly updated as my experience with Office 365 grows.

Microsoft have provided a Visio 2010 Add-In to enable Disk Space Monitoring, it provides a graphical view of free space available on selected computers.  To populate the Visio diagram it can either be populated from an Excel spreadsheet or System Center Operations Manager.  Once all the desired computers have been contacted, the information is presented in a format similar to this.

May the Gig’s be with you.

Client\X64 – Visio Add-In for Disk Space Monitoring Download
Client\X86-Visio Add-In for Disk Space Monitoring Download
Server\Visio Services Data Provider for Disk Space Monitoring add-in Download
User Guide for Visio Add-In for Disk Space Monitoring Download
Visio Services Data Provider for Disk Space Monitoring add-in user guide Download

The week after Teched North America, Microsoft hosted 3 days of online training for its new Office 365 platform; these HD videos are aimed at the IT Professional and give an excellent insight into the product.

• Office 365 Jump Start (01): Microsoft Office 365 Overview for IT Pros
• Office 365 Jump Start (02): Deploying Clients For Office 365
• Office 365 Jump Start (03): Microsoft Office 365 Administration & Automation Using Windows PowerShell™
• Office 365 Jump Start (04): Microsoft Office 365 Identity and Access Solutions
• Office 365 Jump Start (05): Microsoft Office 365 Directory Synchronization
• Office 365 Jump Start (06): Exchange Online Overview for IT Pros
• Office 365 Jump Start (07): Microsoft Exchange Online Administration
• Office 365 Jump Start (08): Microsoft Staged Exchange Online Migration
• Office 365 Jump Start (09): Hybrid Options with Exchange Server & Exchange Online
• Office 365 Jump Start (10): Exchange Online Archiving & Compliance
• Office 365 Jump Start (11): Lync Online Overview & Configuration for IT Pros
• Office 365 Jump Start (12): SharePoint Online Overview
• Office 365 Jump Start (13): SharePoint Online Administration
• Office 365 Jump Start (14): SharePoint Online Extensibility & Customization
• Office 365 Jump Start (15): Office 365 Deployment Overview