Victor Stodell

When a person gets married or makes a name change for some other reason this usually means that the login name for the Active Directory-account changes as well. This is rarely a problem, but it turned out to cause some issues on our web server, where the  User.Identity  property was still returning the old login name. The user logged on with the new login name, but was identified by the web application as the old login name. The reason this occurs is because the  User.Identity  property relies on the  LsaLookupSids  method to convert the user SID to a login name. The method first calls the local  LSA-cache , which is not synchronized with the Active Directory. For this purpose a simple reboot of the web server to clear the  LSA-cache  propably would have sufficed. But since we didn't want to take the application offline rebooting was not an option. Instead, it is possible to set the registry value  LsaLookupCacheMaxSize in HKLM...

Our transition to the  System.DirectoryServices.Protocols  has in the whole gone very smooth, but there have been some issues with one environment that contains subdomains. Most things are working fine, but writing to a subdomain does not work in the same way as it did before. What is generally bad with the  System.DirectoryServices.Protocols is the documentation, which is practically non-existent. But most things can  be figured out anyway since most classes just are wrappers for the wldap32.dll, which in turn is way better documented. I would like to have as little bindings to a specific server as possible but still be able to access the domain. In the  LdapConnection  it is possible to set the identifier to null and use the executing computer as a starting point to find a domain controller. But sometimes I must know that I am using a Global Catalog, and with more and more RODC in the environment I sometimes must know that I am working against...

So far we have managed to exclude  System.DirectoryServices  because of our original issues, and  System.DirectoryServices.AccountManagement  because of performance issues. What is left for us now is  System.DirectoryServices.Protocols , and that is the namespace of our choice. Generally the  System.DirectoryServices.Protocols  is pretty similar to System.DirectoryServices , so it is not a big deal to rebuild our existing classes to a newer version. But there are always some small obsacles that need to be conquered. A very good guide to get started with these classes is written by Ethan Wilansky and published on MSDN, Introduction to System.DirectoryServices.Protocols . An small issue is that you always have to know if an attribute exists before you try to remove it. The same thing applies when an attribute is saved, you must know if it is a new attribute to be created or an existing attribute that should be updated. If an incorrect action is taken...

To work around the memory leaking issues in the .NET classes is in theory quite simple, do not use those classes. That is the starting point we had. Instead what we want to do is, by minimizing the affection on all our projects, rebuild our AD classes to use a beter way to communicate with the Active Directory. In .NET 2.0 the  System.DirectoryServices.Protocols  was introduced, which is a collection of general classes to communicate with practically any directory over LDAP. Unlike  System.DirectoryServices  which builds on  ADSI , the  System.DirectoryServices.Protocols  builds on the newer and better wldap32.dll. Heres an overview of the different namespaces and what teqniques they rely on, taken from  Introduction to System.DirectoryServices.Protocols . In .NET 3.5 yet another namespace arrived, namely  System.DirectoryServices.AccountManagement . This is excactly as it sounds a set of classes for account management. In theory thi...

We have a pretty old class library to communicate with Active Directory, shich is built on  System.DirectoryServices . It has worked very well during all these years, but since the size of the systems and the number of users have increased we have begun to see some performance related issues. The environment that is least stable at the moment consists of a root domain and a subdomain. The problem is the following error that sometimes occur on a search in the subdomain: System.DirectoryServices.DirectoryServicesCOMException (0x8007202B): A referral was returned from the server. This is not an unusual issue, but we have taken some steps for these issues not to occur. What is also interesting is that they seem to occur at random. Once the problem occured once the subdomain is unreachable for the current application until the application or application pool is restarted. Part of the problem is some poor memory management in  SearchResultCollection , which never disposes of...

I ran into a problem this week that caused a lot of headaches. In an existing Exchange environment everything seems to be working just fine for existing users. The problems occur when you try to configure an account on a new client. This scenario did not apply to all the mailboxes in the organization. These are some of the messages that were presented during different stages in the configuration: Outlook cannot log on. Verify you are connected to the network and are using the proper server and mailbox name. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action. The name cannot be resolved. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action. The action cannot be completed. The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action. Your server or mailbox names cannot be resolved. The environment is a pur...

Instead of investing in a TACACS server solution we wanted to build switch and router logon on Active Directory authentication. This is possible by installing a RADIUS server to handle the communication between the Cisco devices and Active Directory. Windows Server 2008 R2 can be made into a RADIUS server by installing the role  Network Policy Server . Aaron Walrath  has put together a guide with everything that needs to be done to get the RADIUS authentication in the Cisco devices and how to connect this to the Active Directory. This guide is divided into two blog posts. RADIUS authentication for Cisco router logins Install Windows 2008 R2 NPS for RADIUS authentication for Cisco router logins

Active Directory have always been a little tricky to troubleshoot and monitor. There is a wide variety of  Performance Counters and other parameters to investigate, but this is heavy work to do manually. There is also a bunch of third party tools to do this for us but usually the price tag is big  With Windows Server 2008 a new set of tools were delivered which could be very useful when troubleshooting performance in Active Directory amongst other services. And the best of all is that they are free! Data Collector Sets The role Active Directory Domain Services includes a Data Collector Set intendet for Active Directory diagnostics. This can be found in Server Manager/Diagnostics/Performance/Data Collector Sets. Run the Active Directory Diagnostics for a limited time, but do not forget to stop it. A large amount of data is collected and when the job is stopped a nice and thorough report is generated. Windows System Resource Manager The Resource Manager is installed as a f...

Since we want to simplify administration by minimizing our server farm the subdomain that currently hosts our Team Foundation Server is going to be removed. This means that we will have to move the entire installation to the parent domain. Luckily we only have one server as application-tier and data-tier, and we are very few users, which makes the process a whole lot less dramatic. First of all we have to make sure that the new domain is ready to incorporate the server. It is not possible to perform any kind of user mapping, so all user accounts must have the same login name on the new domain as on the current domain. This also applies to the service accounts used by Team Foundation Server. The documentation around this procedure is well documented on  MSDN . The article describes the scenario to move from a workgroup to a domain, but the scenario from one domain to another works exactly the same. The entire process can be summarized in 5 steps: Ensure that all users hav...

Ever since .NET 2.0  System.DirectoryServices.Protocols  have been a part of the framework and in .NET 3.5 even more directory related classes were added, namely  System.DirectoryServices.AccountManagement . That is exactly as it sounds a namespace containing methods for account management. This fits perfectly for a little project I have chosen to call AD Cleanup Tool. This tool will go through all accounts in a domain to clean up certain account properties, such as naming, password policy etc. Some older solutions does not work with todays versions of Active Directory, for instance if I want to set the property  User must change password at next logon . This has earlier been done by setting the property  userAccountControl  with the flag  ADS_UF_PASSWD_CANT_CHANGE . It is not possible to set that flag anymore, but S.DS.AM gives us an even easier solution: using(PrincipalContext context = new PrincipalContext(ContextType.Domain, "192.16...

I sometimes get very positively surprised by  Microsoft . In the work of cleaning and structuring an Active Directory environment we wanted to produce a graphical overview of our current forest. It did not take long before I found  Active Directory Topology Diagrammer , which is an absolute perfect tool for this purpose. And it is free! Active Directory Topology Diagrammer  gets the entire AD structure according to the parameters you supply and draws the structure in a Visio document. It does however require Visio 2003 or later installed to be able to do this export.

At a number of times we have had requests to be able to run applications as a normal user even though the application is designed to run as an administrator. This could be handled manually by setting the privileges on each computer for certain paths and registry keys and any other resources the application requires. This easily gets out of hand and there is a much better solution, spelled  EPAL . Sure, it requires some configuration and tweaking, but when set up it works like a charm and is a great tool to compensate for poorly written Windows applications requiring administrative privileges.

TEC Europe is over and I am at the Hilton Berlin waiting to go home. The overall impression of the conference is really good, although I as a developer indeed was a minority. I have only visited the Active Directory-related sessions and I have definately gotten some clarification in some areas. For example I can mention that I feel somewhat stupid that our AD-classes are still based on System.DirectoryServices, instead of System.DirectoryServices.Protocols. The former is based on LDAP via ADSI, while the latter is a wrapper to wldap32.dll. For more information about the lectures, and what they are talking about, check out www.tec2009.com.