In Active Directory, a computer object is a security principal. This means that just as with a user, you can give permissions for resources and assign security group memberships to the computer.  Applying permissions to security groups instead of OUs is a generally accepted best practice.  For user objects, you can delegate part of this…

A computer object is a security principal. This means that just as with a user, you can give permissions for resources and assign security group memberships to the computer.  Applying permissions to security groups instead of OUs is a generally accepted best practice.  For user objects, you can delegate part of this and automate most…

Active Directory groups get a single owner in Active Directory & Exchange which is set in the ManagedBy attribute.  But businesses don’t tend to work that way, Active Directory groups are often “matrix managed”, they have more than one user that should be responsible for the upkeep of that group. Exchange 2010 is bridging that…

I recently had a conversation with a customer who said that he doesn’t allow mail enabled Active Directory security groups.  Another customer was in the same meeting who said that he wished he could disable that ability.  Two proofpoints that Active Directory administrators do not want to mail enable security groups.  Unfortunately, we were discussing…

Maintaining the accuracy of all Active Directory groups is important but as George Orwell may have said (and I’m paraphrasing here), “All Active Directory groups are equal, but some Active Directory groups are more equal than others.”  I say this because some Active Directory groups have to be accurate.  And because some are easier to keep…

Imanami was recently quoted in Windows IT Pro on Active Directory’s 10th anniversary.  Part of that discussion was whether Active Directory could be put in the cloud. “That’s tough,” Haaverson says. “AD is protected with a vengeance. Why would you want to push it to the cloud? What do you do if the Internet goes…