Group Policy Objects (GPO) are not just for OUs any more. There are not a ton of GPOs that are better off applying exclusively to Active Directory groups but there are a few. The main use of GPOs filtered to Active Directory security groups is to create exceptions to group policy but there are a few…
In our LinkedIn User Group, we had a customer ask if GroupID could set the Max Send Size on messages to a group. What they are doing is delegating control of groups to their users but want to maintain control. So they have implemented the appropriate amount of workflow (on group creation, on join requests, etc). …
An orphaned Active Directory group is a group with no owner. On the surface, that doesn’t seem that bad, email is still delivered, permissions are still applied. But there are some real dangers to the business if you allow Active Directory groups to go ownerless and the membership becomes static. Common Danger for Orphan AD…
Active Directory and Exchange offer a great tool for managing communication to distribution lists: message delivery restrictions. This concept is pretty easy to understand, if you have an Exchange distribution list that you want only certain people to be able to email, you include them in the message delivery restriction. Conversely, if you want certain…
I presented a webinar today on the common pitfalls in Active Directory self service. I would link to a recording but as usual I forgot to hit that red record button at the beginning. Luckily, Imanami has a blog so that we can save the ideas for posterity. First off, why do you want to offer…
To manage Active Directory user accounts; that’s quite a statement. It evokes an image of constantly working on a user account, ensuring its accuracy, checking on its well being, and probably calling the user herself every once in a while to see how life is going. It is also one of the phrases that brings…
A computer object is a security principal. This means that just as with a user, you can give permissions for resources and assign security group memberships to the computer. Applying permissions to security groups instead of OUs is a generally accepted best practice. For user objects, you can delegate part of this and automate most…
Maintaining the accuracy of all Active Directory groups is important but as George Orwell may have said (and I’m paraphrasing here), “All Active Directory groups are equal, but some Active Directory groups are more equal than others.” I say this because some Active Directory groups have to be accurate. And because some are easier to keep…
Imanami was recently quoted in Windows IT Pro on Active Directory’s 10th anniversary. Part of that discussion was whether Active Directory could be put in the cloud. “That’s tough,” Haaverson says. “AD is protected with a vengeance. Why would you want to push it to the cloud? What do you do if the Internet goes…
In today’s M&A-heavy environment, GAL synchronization between two or more forests is becoming more and more important. IT departments are regularly called upon to integrate two organizations’ global address lists on the first day that the merger is complete, expecting employees to be able to see the new organizations as one even if the backend…