LVR's Intricacies
Thank you for Guido Grillenmeier's article "Leverage LVR to Simplify AD Object
Recovery" (August 2007, InstantDoc ID 96310). Guido deepened my understanding
of Active Directory (AD) and how it replicates. I might have to read the article
a couple of times to fully understand everything, though.
As I was reviewing my AD groups to see if they contain Linked Value Replication
(LVR) links, I ran into an interesting find with the default group Domain Users,
which most of our users have as their primary group. When I run the command
repadmin /showobjmeta DC1
CN="Domain Users",
CN=Builtin,OU=XYZ,OU=COM
it returns information only about the users who do not have Domain Users set
as their primary group. If I go into an individual user account and change the
primary user group, the individual shows up when I rerun the command.
• Why don't user accounts show up when their group is set to primary?
•
Since I can't see the LEGACY, ABSENT, or PRESENT status for the users, can I
assume that all the LVR links are PRESENT?
—Justin Marthaler
I'm glad you liked the article. The
topic is fairly complex.
The Domain Users group is a
special group just like Domain Computers and a few others in AD. As you
noted, those groups' membership is
typically not explicit by virtue of the
user (or computer) being listed in the
group's memberOf attribute. Instead,
the member's PrimaryGroupID attribute is populated with the Relative
Identifier (RID) of the respective AD
group (513 for Domain Users). This
attribute is indexed so that the OS
can list all members quickly.
The Active Directory Users and Computers GUI fools you by displaying the
users as normal members of the Domain Users group. When you check the
memberOf tab for a user, it also displays the Domain Users group. The GUI basically
checks both the backlinks and the PrimaryGroupID, just like the logon process
does to add the group to a user's token. This process allows an AD domain to
contain as many users (or computers) as you want and not be limited by the number
of members or forward links that could fit into a group's member Of attribute.
When you change a user's primary group, the same logic is applied to the
other group: The user's link is removed and instead the group's RID is written
to the user's PrimaryGroupID attribute. But because you didn't remove the Domain
Users group when you edited the user's PrimaryGroup, an explicit link is added
to the Domain Users group.
So basically, a group that's populated with the PrimaryGroup feature doesn't
use LVR. However, it works similarly in that it allows very large groups and
only the membership change is replicated.
—Guido Grillenmeier
I just read "Leverage to Simplify AD Object Recovery" and liked it a lot. I
hope more people will buy into taking LVR and the related issues more seriously
once they or some of their staff have read the article.
—Scotty McLeod
Enhanced Defrag
Dan Gillard's article "Automate the Windows 2003 Defragmenter Without Paying
Extra" (Reader to Reader, May 2007, InstantDoc ID 95487) made me wonder: Why
not just use defrag.exe, which is a command-line tool that ships with Windows
Server 2003 and Windows XP and can be easily scheduled with Task Scheduler?
Does it offer less functionality than dfrgntfs.exe?
—Chris Munger
The batch file uses defrag.exe to launch dfrgntfs.exe. I don't use defrag
.exe directly with the Task Scheduler because this process runs on a file server,
and usually no one is logged on to the server. For a scheduled task to work
when no one is logged on, you need a username and password that has admin rights
to run the task. For all I know there might be a way to hack into the task scheduler
to get passwords, and I'd rather not have that.
Instead of having a process run by
a user who has admin rights on the
server, I use the AT command to run
the command like a service without a
logon account. This approach also runs
the process in the background and
prevents windows from popping up.
The log file this batch file creates also is a good way to check for problems
after the defrag process has run. Defrag .exe itself doesn't create a log unless
you output the process to a text file.
The batch file I created is just another means to defrag the system, with
extra features.
—Dan Gillard
Mysterious Behavior of the Windows Indexing Service
Thank you Bret Bennett for sharing in detail what you learned about the Windows
Indexing Service ("An Unlikely Culprit Can Cause Computers to Hang," August
2007, InstantDoc ID 96343), and thank you Windows IT Pro for printing
it. That article is a good example of why I subscribe to the magazine.
—Chris Hair
See Associated Figure
End of Article
Register
