No RIDs for you (the RODC) !


Says the RID Master FSMO to a RODC. If you recall the RID Master’s sole job is to make sure that duplicate SIDs are not issued by domain controllers. Whenever a DC needs to create a SID, it takes the next available value from its own RID pool to create the SID with a unique value. The default pool size is 500 RIDs. When we run the RID pool test on a RODC, the test skips due to the DC being RODC and not having anything to do with the creation of the new objects.

dcdiag /v /test:ridmanager





















Here is how the test is supposed to report back with the remaining pool of the allocated RIDs.

What is Active Directory Management Gateway Service (ADMGS)?


Windows Server 2008 R2 provides a web service that is required by ADAC and native AD-Cmdlets of PowerShell, that service in known as ADWS and its part of proverbial ADMGS framework. So ADMGS equals ADWS out-of-box. The service lets Server 2008 R2 AD PowerShell cmdlets and other applications work against the DCs with ADMGS installed. And its final version has been released with Windows Server 2008 R2 which hit RTM earlier this week. That ADMGS framework and comparison of changes from 2008 to 2008 R2 was briefly discussed in a Brian Desmond’s webcast a few months back.


















Something not part of the original plan and considered due to high demand is that now you have ADWS add-on service/functionality available to manage your down-level DCs such as Windows Server 2003 and 2008 (non-R2). This means you don’t have to be at 2008 R2 FFL to run this.

Below is excerpted from ADPoSH Blog :

  1. Visit and enter the invitation ID ADWS-FDBT-CVJK on the home page.
  2. Sign in using your live/hotmail ID
  3. Active Directory Management Gateway Service download details and instructions will be available to you on MS Connect site –

Once you have it installed, you can take advantage of native AD PowerShell Cmdlets. This certainly adds good competitiveness to the cmdlets world and Quest Active Roles QAD cmdlets finally have something to compete against.

































For more information see :;en-us;969041&sd=rss&spid=12925

What is ADRAP Scoping Tool ?


Microsoft earlier this month released the AD Risk Assessment Program Scoping Tool to public. My look at it tells me that this tool essentially more fancily does what ADRAP Sutiability Scripts did, which came with ADRAP Snapshot Tool, which of course came when you had the official ADRAP engagement. ADRAP could be extremely benefical¬†for any AD environment. Very few people seem to have heard of it and there isn’t a lot information publicly available for the program, so until you have it done you have a very little idea on what the program offers. This tool is to do just that, it makes the program more public, it gives you a quick glimpse of what the program is about as well as it readies your environment for the actual ADRAP sweep, hence named Scoping Tool. Below you will see the simple 8 steps process that runs several checks on your AD environment and creates a nice HTML report at the end which you would supposedly send it to your TAM prior to the engagement. Regardless of whether you will have the engagement or not, I think this tool serves as a quick snapshot into your environment. This tool is however intended for premier customers.










Download the tool here

Get white papers regarding Active Directory Risk Assessment Program

Is there a GUI to manage AD Recycle Bin ?


Much has been said about the manageability of AD Recycle Bin in Windows Server 2008 R2 via the Microsoft’s intended way i.e via PoSH cmdlets. Though this option stays to be only enable-able via PowerShell, the ability to restore objects (the process of reanimation of objects in earlier ADs) has been extended to GUI by Overall Solutions Inc. The GUI tool is very simple to use and its available for free. Below I show you how to restore a deleted OU with objects inside via this tool. See previous post on how to enable the AD Recycle Bin feature in your Windows Server 2008 R2 forest.

We delete an OU called Chicago which contains a Global Group.



Launch the ADRecycleBin tool (be sure to launch it under administrator’s context)


Right click on the child object of a deleted tree and select all


Click on Restore Deleted Object on top right corner


And its simple as that. Lesson of the story, there is always a window for someone to step in and fill the void. I had earlier posted how Server Core that was intended to be managed via CLI only had made a¬† U-TURN in R2 release of Windows Server 2008. Personally, I wouldn’t mind having to manage this feature solely from PowerShell, but its nice to have the GUI option available.

Download the tool here.

How do I enable the Active Directory Recycle Bin in Windows Server 2008 R2 ?


Launch the PowerShell under Administrator’s account context, and type this cmdlet.

Enable-ADOptionalFeature -Identity ‘CN=Recylcle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=yourdomain,DC=com

Read and understand the warning of this action’s irreversebility, and hit “Y” for yes to continue.


In following screenshot I show you an error not neccesarily applicable to you, the cmdlet complained about not being able to verify the FSMO ownership role. The reason for this was the fact that in my VM Lab environment I had shut down another DC for maintenance and it had not been replicated or talked to.


As I brought that downed DC back online, forced the replication, I was able to proceed. You can then confirm with this cmdlet.

Get-ADOptionalFeature ‘Recycle Bin Feature’


Here is a great post on this hot feaure of Windows Server 2008 R2.