Whats new in active directory window 2008 R2 server

Windows Server 2008 R2:
What's New in Active Directory

Windows Server 2008 R2: What’s New in Active Directory

Table of Contents
Windows Server 2008 R2: What's New in Active Directory ..................................................... 1
Exercise 1 Using the Active Directory Administration Center .......................................................................................2
Exercise 2 Working with Active Directory using the Active Directory PowerShell Module ...........................................5
Exercise 3 Recovering Deleted Objects using Active Directory Recycle Bin ..................................................................8
Exercise 4 Pre-Deploying Computer Accounts using Offline Domain Join ..................................................................11


Windows Server 2008 R2: What's New in
Active Directory
After completing this lab, you will be better able to:
Objectives  Use the Active Directory Administration Center to perform administrative
tasks
 Locate and manage objects using the Active Directory PowerShell provider
 Recover deleted Active Directory objects using the Active Directory Recycle
Bin
 Perform an offline domain join for a not yet deployed computer
Woodgrove Bank is an investment bank located in Baltimore, USA. Woodgrove
Scenario Bank has a main office and many regional and local branch offices. Many of the
branch offices are small offices and do not have local IT support, and are
connected to the main office by low-bandwidth WAN connections. In addition,
many users at Woodgrove Bank travel between offices, as well as to customers’
offices and homes for meetings regarding client accounts. Woodgrove Bank is
faced with the following global challenges:
 Management of many servers in many offices.
 The need to reduce the operational cost of each branch office.
 The need for roaming and remote users to access company resources.
 Management of a large and complex Active Directory infrastructure.

Before working on this lab, you must have:
Prerequisites  The ability to work in a command line environment
 An understanding of Active Directory administration tasks
 An understanding of Windows PowerShell concepts and tasks

Estimated Time to 60 Minutes
Complete This Lab

Computers used in this
Lab BAL-DC-01

The password for the Administrator account on all computers in this lab is:
Passw0rd!

Page 1 of 12


Exercise 1
Using the Active Directory Administration Center

Scenario
In this exercise you will use the new Active Directory Administration Center to perform some common Active
Directory management tasks. By performing these tasks, you will learn how basic administration and navigation of
large Active Directory structures is made easier using the new tools.

Tasks Detailed Steps
Complete the following Note: In this task you will use the new Active Directory Administrative Center to
task on: perform some common administrative tasks. The purpose of this exercise is to
become familiar with the navigation and use of the new interface.
a. On the Start menu, point to Administrative Tools and then click Active Directory
BAL-DC-01
Administrative Center.
1. Explore the
b. In Active Directory Administrative Center, in the Reset Password tile, in User
Administrative
name, type WoodgrovebankBobSmith and then press TAB.
Center Interface
Note: The user name is checked and a warning is displayed that the username is
invalid.
c. In Active Directory Administrative Center, in the Reset Password tile, in User
name, type WoodgrovebankDonHall and then press TAB.
Note: Notice that the user account was validated by the tool.
d. In Password and in Confirm Password type Passw0rd!2 and then click Apply.
Note: The reset password tile is one of many tiles that can be added to the Overview
page. Each tile allows common tasks to be completed quickly and without navigation
to the actual object.
e. In the upper right of the Administrative Center Overview pane, click Add Content.
Note: The Add Content menu allows you to add additional task-based tiles to the
Overview page. You can add the tiles that allow you to complete your most common
tasks.
f. In the Active Directory pane, click the fly-out menu next to Woodgrovebank
(local). The fly-out menu is shown below.

g. Using the fly-out menu, navigate to AmericaWashingtonKing and double-click
Redmond.
Note: You can use the Find in this column text box to type the first few letters of the
item you are looking for to speed navigation.
h. Under Redmond, click Abigail Heiford and then in the Tasks pane, click Enable.

2. Creating and Note: In this task you will use the Active Directory Administrative Center to create and

Page 2 of 12

Modifying User and modify both user and group accounts.
Group Accounts In Active Directory Administrative Center, ensure you are in the
AmericaWashingtonKingRedmond organizational unit.
a. In the Tasks pane, click New and then click User.
b. In the Create User dialog box, create a new user account with the properties
defined in the following table and then click OK.
Note: If a property is not listed in the table, you may omit it in the dialog box.
Property Value
First Name Alice

Last Name Ciccu

User UPN logon AliceCiccu

Password Options Select Other password options and then
check Password never expires.

Password and Confirm Password Passw0rd!

Note: Note the large number of user properties you can modify in the create user
dialog box.
c. In the Tasks pane, click New and then click Group.
d. In the Create Group dialog box, create a new group account with the properties
defined in the following table and then click OK.
Note: If a property is not listed in the table, you may omit it in the dialog box.
Property Value
Name RedmondSupport

Protect from Accidental Deletion Checked

Managed By Anna Keyes

Click Edit to modify the managed by value. Use
the Advanced button to search for her.
Members Alice Ciccu

Click Add to modify group membership.
e. In the Contents pane, click Alice Ciccu and then in the Tasks pane, under Alice
Ciccu, click Properties.
Note: You may need to refresh your view by pressing F5 if do you not see Alice Ciccu.
f. In the Alice Ciccu dialog box, next to Organization, click the Collapse button.
g. Next to Profile, click the Close button.
Note: The properties dialog box allows you to customize the available administration
panes.
You can add closed sections by clicking the Add Sections menu and checking the
sections you want to add back in.
h. Under Extensions, on the Dial-in tab, click Allow access.
Note: Many properties are accessible through the new property panels; however any
additional extensions are available via the extensions panel. This ensures that any

Page 3 of 12

third party add-ins for Active Directory Users and Computers still function without
modification.
i. Click OK to close the Alice Ciccu dialog box.
j. Close the Active Directory Administrative Center.

Page 4 of 12


Exercise 2
Working with Active Directory using the Active Directory
PowerShell Module

Scenario
In this exercise you will use the Windows PowerShell Integrated Scripting Environment (ISE) to administer Active
Directory. As a reference, the major components of the ISE are labeled below.

Complete the following Note: This exercise makes extensive use of Windows PowerShell. To assist you, you
task on: can use the up arrow key to recall previous commands and use tab completion to help
quickly type commands.
In this task you will use the PowerShell V2 Graphical Console to perform basic user
BAL-DC-01
and group administrative tasks. You will begin by loading the Active Directory
1. Using the Windows module, exposing over 75 Active Directory Cmdlets. You will then use these Cmdlets to
PowerShell Graphical administer Active Directory.
Console to Work with
a. On the Start menu, navigate to All ProgramsAccessoriesWindows PowerShell
User and Group
and then click Windows PowerShell ISE.
Accounts
b. To load the Active Directory module and list the available Cmdlets, in the
Command Pane, type the following commands, pressing ENTER after each
command:
Import-Module ActiveDirectory
Get-Module
Get-Command *ad*
c. To browse your Active Directory domain using Windows PowerShell, in the
Command Pane, type the following commands, pressing ENTER after each

Page 5 of 12

command:
Note: You can press the TAB key to auto complete many of these commands and save
a great deal of typing.
Cd AD:
PWD
DIR | Format-Table -Auto
CD "DC=Woodgrovebank,DC=com"
DIR | ft –a
Note: This series of commands shows you how you can navigate Active Directory like
a file system and format output using standard Windows PowerShell commands.
d. To list the content of the users container and then enable the Guest account, in
the Command Pane, type the following commands, pressing ENTER after each
command:
Note: If you see a repeated command, such as the third command in this series, you
can use the up arrow to retrieve the previous instance of the command instead of
retyping it.
CD CN=Users
Dir | ft –a
Get-ADObject –Filter {name -like “*”}
Get-ADUser –Filter {name -like “*”}
Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto
Enable-ADAccount –Identity Guest
Get-ADUser -Filter {name -like "*"} | Select Name, Enabled | Format-Table -Auto
e. To display information about the user Don Hall in the Managed Objects OU, in the
Command Pane, type the following commands, pressing ENTER after each one.
CD ..
cd ‘OU=Managed Objects'
Get-ADuser -Filter {Name -eq "Don Hall"}
Get-ADuser -Filter {Name -eq "Don Hall"} –Properties *
f. To query information on the Domain Administrators group, in the Command
Pane, type the following command and then press ENTER:
Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree -
Filter {Name -Like "*Domain Admins*"} -Properties *
g. To add Don Hall to the Domain Administrators group, in the Command Pane, type
the following command and then press ENTER:
Get-ADGroup -SearchBase "DC=Woodgrovebank,DC=com" -SearchScope Subtree -
Filter {Name -Like "*Domain Admins*"}| Add-ADGroupMember -Member DonHall
2. Using the Windows Note: In this task you will use Cmdlets that relate to the domain and to domain
PowerShell Graphical controllers to display information about items such as password policies and FSMO
Console to Work with roles.
Domains and Domain a. To query information on the Woodgrovebank.com domain, in the Command
Controllers Pane, type the following command and then press ENTER:
Get-ADDomain Woodgrovebank.com
Note: The output of this command allows you to easily determine things such as
FSMO roles.
b. To query information on the domain controllers in the Woodgrovebank.com
domain, in the Command Pane, type the following command and then press
ENTER:
Get-ADDomainController –Discover

Page 6 of 12

c. To query information on the domain password policy in the Woodgrovebank.com
domain, in the Command Pane, type the following command and then press
ENTER:
Get-ADDefaultDomainPasswordPolicy Woodgrovebank.com

3. Using Windows Note: In this task you will use Cmdlets that relate to organizational units to create
PowerShell Graphical and delete an organizational unit. You will also use a Set Cmdlet to set properties on
Console to Create an organizational unit.
and Delete a. To create a new organizational unit and display its properties, in the Command
Organizational Units Pane, type the following commands, pressing ENTER after each one:
New-ADOrganizationalUnit –Name “Europe” –Path “DC=Woodgrovebank,DC=com”
Get-ADOrganizationalUnit “OU=Europe,DC=Woodgrovebank,DC=com” –Properties *
b. To delete the new organizational unit, in the Command Pane, type the following
commands, pressing ENTER after each one and clicking Yes to confirm deletion.
Note: Note that the first command will result in an expected failure due to insufficient
permissions, which the second command will resolve.
Remove-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com”
Set-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com”
–ProtectedFromAccidentalDeletion $False
Remove-ADOrganizationalUnit ”OU=Europe,DC=Woodgrovebank,DC=com”
Note: The ProtectedFromAccidentalDeletion property is used to add or remove an
access control list to the OU which explicitly denies the delete permission for all users.
This property is true by default for all container objects.
c. Close Windows PowerShell ISE.

Page 7 of 12


Exercise 3
Recovering Deleted Objects using Active Directory
Recycle Bin

Scenario
In this exercise you will explore the new Active Directory Recycle Bin feature. The Active Directory Recycle Bin
stores all deleted objects in a special container which allows easy recovery at a later time, preserving all object
properties.

Complete the following Note: In this task you will enable the Active Directory Recycle Bin feature. Windows
task on: Server 2008 R2 does not automatically enable features as forest and domain
functional levels are increased. Each feature must now be explicitly enabled. Features
are enabled using the Enable-ADOptionalFeature PowerShell Cmdlet.
BAL-DC-01
1. Enable the Active Module for Windows PowerShell.
Directory Recycle Bin
b. To check the state of the Recycle Bin Feature, in Windows PowerShell, type the
Feature
following command and then press ENTER:
Get-ADOptionalFeature –Filter {Name –Like “*”}
Note: The EnabledScopes property is currently empty, which indicates that this
feature is not enabled.
The RequiredForestMode property indicates the prerequisites for enabling this
feature.
c. To enable the Recycle Bin feature, in Windows PowerShell, type the following
command and then press ENTER:
Enable-ADOptionalFeature -Identity 'CN=Recycle Bin Feature,CN=Optional
Features,CN=Directory Service,CN=Windows
NT,CN=Services,CN=Configuration,DC=woodgrovebank,DC=com' -Scope
ForestOrConfigurationSet -Target 'woodgrovebank.com'
Note: This command will enable the Recycle Bin feature, which is disabled by default.
d. To confirm the command, type Y and press ENTER.
Note: You must confirm this action, as once enabled, you cannot disable the Recycle
Bin.
e. To verify the Recycle Bin feature has been enabled, in Windows PowerShell, type
Get-ADOptionalFeature –Filter {Name –Like “*”}
Note: You can review the value of EnabledScopes to ensure that the Recycle Bin is
enabled.
2. Move Objects to the Note: In this task you will move objects to the Recycle Bin by deleting them. All
Recycle Bin deleted objects are automatically moved to the Recycle Bin once the feature is
enabled.
a. On the Start Menu, point to Administrative Tools and then click Active Directory
Administrative Center.
b. Navigate to the AmericaWashingtonKingRedmond organizational unit.

Page 8 of 12

c. Delete the user account Alice Ciccu.
d. Delete the group account RedmondSupport.
Note: You can use the search feature at the top of the window to find the group.
You will also need to uncheck Protect from accidental deletion from within the group
properties.
e. Delete the Redmond organizational unit.
f. In the Confirm Subtree Deletion dialog box, check Use delete subtree server
control and then click Yes.
3. Verify Objects are Note: In this task you will use Windows PowerShell to query the contents of the Active
Now in the Recycle Directory Recycle Bin. Objects that have been deleted are moved to this location and
Bin have their distinguished name adjusted to reflect the fact that they are a deleted
object, and also to avoid conflicts when multiple objects of the same common name
are deleted.
Module for Windows PowerShell.
b. To display the contents of the Recycle Bin, in Windows PowerShell, type the
Get-ADObject –SearchBase “CN=Deleted Objects,DC=Woodgrovebank,DC=Com” –
ldapFilter “(objectClass=*)” -includeDeletedObjects
Note: This command displays the entire contents of the Recycle Bin.
Leave the output of this command on the screen as you will use it in the next task.
c. To verify the Alice Ciccu user object is in the Recycle Bin, in Windows PowerShell,
type the following command and then press ENTER:
Get-ADObject –Filter {Name –Like “*Alice Ciccu*”} –SearchScope Subtree –
includeDeletedObjects | Format-List
Note: The output of this command will show the details for the Alice Ciccu user object.
Note the distinguished name indicates this object is in the AD Recycle Bin.
d. In Windows PowerShell, type the following command and then press ENTER:
Get-ADObject –Filter {Name –Like “*Redmond*”} –SearchScope Subtree
–IncludeDeletedObjects | Format-List
Note: The output of this command will show the details for the RedmondSupport user
group as well as the Redmond OU.
Note the distinguished name indicates this object is in the AD Recycle Bin.
4. Recover Deleted Note: In this task you will use the Recover-ADObject PowerShell Cmdlet to recover
Objects objects that have been deleted from Active Directory.
Ensure Active Directory Module for Windows PowerShell is open.
a. In Windows PowerShell, copy the objectGUID value for the object Alice Ciccu to
the clipboard.
Note: To copy text from a command prompt, right click and then select Mark.
Highlight the text to copy and then press ENTER.
To paste, right click and then click Paste.
b. To attempt to restore the Alice Ciccu user account, in Windows PowerShell, type
Note: To complete the following command, copy the value of the objectGUID
property from the Alice Ciccu object.
Restore-ADObject –Identity <objectGUID>

Page 9 of 12

Note: The command fails with an error message indicating that the object’s parent
object does not exist.
You can then query for the last known parent of the object and restore that object.
c. To identify the last known parent of Alice Ciccu, in Windows PowerShell, type the
Note: To save typing, use the up arrow key to locate the previous search command
and append the additional parameters to it.
Get-ADObject –Filter ‘Name –Like “*Alice Ciccu*”’ –SearchScope Subtree –
includeDeletedObjects –properties lastKnownParent | Format-List
Note: This command displays the last known parent object, which, you can tell, is also
in the Recycle Bin.
d. To restore the OU which contains Alice Ciccu, in Windows PowerShell, type the
Note: To complete the following command, copy the value of the objectGUID
property from the Redmond object which can be found from the output of the last
command in Step 3 in the Verify Objects are Now in the Recycle Bin exercise.
Restore-ADObject –Identity <objectGUID>
e. To restore the Redmond OU Objects, including Alice Ciccu, in Windows
PowerShell, type the following command and then press ENTER:
Get-ADObject –ldapFilter
“(lastKnownParent=OU=Redmond,OU=King,OU=Washington,OU=America,DC=Woodgr
ovebank,DC=com)” –includeDeletedObjects | Restore-ADObject
Note: This command lists all objects that have the last known parent attribute as the
Redmond OU and pipes them into the Restore-ADObject Cmdlet.
5. Verify that Deleted Note: In this task you will review Active Directory to ensure that the deleted objects
Objects have been have been recovered.
Recovered a. If not open, on the Start Menu, point to Administrative Tools and then click Active
Directory Administrative Center.
Note: Ensure you refresh your view in Active Directory Administrative Center after you
make changes to ensure you see those changes.
b. Navigate to the AmericaWashingtonKing OU.
c. Verify that the Redmond OU is present.
d. Navigate to the Redmond OU.
e. Verify that the user accounts, including Alice Ciccu, are present.
f. Verify the group RedmondSupport is present.

Page 10 of 12


Exercise 4
Pre-Deploying Computer Accounts using Offline Domain
Join

Scenario
In this exercise you will complete the tasks required to provision an account for offline domain join. Offline domain
join involves two steps. In the first step you will provision a computer account in Active Directory and save the
account information in a file. In the second step you will use that file in a command that inserts the domain join
information into an offline version of Windows.

Complete the following Note: In this task you will use the DJoin command to provision a computer account in
task on: Active Directory for offline domain join. The result of this task is a file that can be
merged into an offline copy of Windows, ensuring that the first time the computer
starts it is domain joined.
BAL-DC-01
a. On the Start menu, click Command Prompt.
1. Provision a Computer
b. To provision a new computer account, in the Command Prompt, type the
Account for Offline
Domain Join
DJOIN /Provision /Domain Woodgrovebank.com /Machine BAL-SRV-10 /SaveFile BAL-
SRV-10.DJoin
Note: This command creates a computer account in Active Directory and stores the
computer account password and related information in an encrypted file. The
encrypted file can then be used to offline domain join a computer.
c. To display the contents of the provisioning file, in the Command Prompt, type the
Type BAL-SRV-10.DJoin
Note: The contents of the .DJoin file are encrypted.

2. Verify the Computer Note: In this task you will look at Active Directory to verify that the offline domain join
Account has been has correctly created the computer account for BAL-SVR-10.
Created in Active a. On the Start menu, point to Administrative Tools and then click Active Directory
Directory Administrative Center.
b. Navigate to Woodgrovebank (local)Computers.
Note: Note that the computer account BAL-SRV-10 has been created.

3. Review the Process Note: In this task you will type the command used to perform an offline domain join
to Perform an Offline operation. This command will use the contents of the saved file created in the
Domain Join previous task to insert domain join information into the computer’s registry without
having to start the operating system. This command can be run on an offline copy of
Windows such as a WIM file or VHD which has been mounted.
Begin this task with a command prompt window open.
a. To perform an offline domain join, use the following command:

Page 11 of 12

Note: Do not execute this command. It is provided for reference purposes only.
DJOIN /Requestodj /LoadFile BAL-SVR-10.DJoin /WindowsPath MountWindows
Note: This command is used to perform the offline domain join.
This command is intended to be run against an offline copy of Windows such as a
WIM file or VHD that has been mounted as a drive or folder in the file system.
Windows Server 2008 R2 with SP1 – Free Trial Download
Certification: Windows Server 2008 R2, Server Virtualization

Page 12 of 12

Whats new in active directory window 2008 R2 server

Recommended

More Related Content

Viewers also liked (9)

Similar to Whats new in active directory window 2008 R2 server (20)

Recently uploaded (20)

Whats new in active directory window 2008 R2 server