Export (0) Print
Expand All

Directory Service Configuration Management Tasks

Updated: December 5, 2005

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

 

Task Permissions Required to Perform Task

Designate a DC as a Global Catalog

WP on the corresponding NTDS Settings object with distinguished name cn=NTDS Settings, cn=<Computer-Name>, cn=Servers, cn=<SiteName>,cn=Sites,cn=Configuration, dc=<forestRootDomain> to modify the options attribute

Force the directory service to do garbage collection

Add the doGarbageCollection attribute on the rootDSE object, and set its value equal to any value

Extended Right Do-Garbage-Collection on NTDS-Settings object CN=NTDS Settings, CN=<Server>, CN=<Site>,CN=Sites, CN=Configuration, DC=<forestRootDomain>

Specify the directory service garbage collection period

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the Garbage-Coll-Period attribute

Force the directory service to recalculate the Exchange Address Book information hierarchy

Add the recalcHierarchy attribute on the rootDSE object, and set its value equal to any value

Extended Right Recalculate-Hierarchy on NTDS-Settings object CN=NTDS Settings, CN=<Server>, CN=<Site>,CN=Sites, CN=Configuration, DC=<forestRootDomain>

Update the Schema cache on demand

Add and modify the schemaUpdateNow attribute on the rootDSE object, and set its value equal to 1

Extended Right Update-Schema-Cache on cn=Schema, cn=Configuration, dc=<ForestRootDomain>

Force directory service to recompute ACL inheritance on a naming context

Add the recalcHierarchy attribute on the rootDSE object and set its value equal to ‘forceupdate’

Extended Right Recalculate-Security-Inheritance on NTDS-Settings object CN=NTDS Settings, CN=<Server>, CN=<Site>,CN=Sites, CN=Configuration, DC=<forestRootDomain>

Force the directory service to check stale phantom objects

On the rootDSE object, add the checkPhantoms attribute to the object and set its value equal to any value

Extended Right DS-Check-Stale-Phantoms on NTDS-Settings object CN=NTDS Settings, CN=<Server>, CN=<Site>,CN=Sites, CN=Configuration, DC=<forestRootDomain>

Force the directory service to immediately refresh the group cache by contacting an available GC

on the rootDSE object, add the updateCachedMemberships attribute to the object and set its value equal to any value

Extended Right Refresh-Group-Cache on NTDS-Settings object CN=NTDS Settings, CN=<Server>, CN=<Site>,CN=Sites, CN=Configuration, DC=<forestRootDomain>

Force the directory service to remove lingering objects from a Domain Controller

Add the removeLingeringObject attribute on the rootDSE object and set its value equal to the object to remove in the following form: DN_OF_THE_SOURCE_NTDS_SETTINGS_OBJECT:DN_OF_THE_OBJECT_TO_REMOVE

Extended right Manage Replication Topology needed on the cn=configuration, dc=<forestRootDomain>

Reanimate Tombstones

Extended Right Reanimate Tombstones on CN=Schema, CN=Configuration, DC=<forestRootDomain>

Force the directory service to perform an online defrag on a Domain Controller

Add the doOnlineDefrag attribute on the rootDSE object and set its value equal to any value.

Extended Right Do-Garbage-Collection on NTDS-Settings object CN=NTDS Settings, CN=<Server>, CN=<Site>,CN=Sites, CN=Configuration, DC=<forestRootDomain>

Specify the default amount of time a dynamic object will exist in the directory

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the ms-DS-Other-Settings attribute

Specify the minimum amount of time a dynamic object will exist in the directory

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the ms-DS-Other-Settings attribute

Specify the delay between deleting a server object and it being permanently removed from the replication topology

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the Repl-Topology-Stay-Of-Execution attribute

Specify the number of days before a deleted object is removed from the directory (tombstone lifetime)

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the Tombstone-Lifetime attribute

Adjust ANR searching behavior

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the DS-Heuristics attribute

Put the directory in the special “List Object” mode

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the DS-Heuristics attribute

Restrict anonymous operations (other than rootDSE searches and binds) through LDAP

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the DS-Heuristics attribute

Control the behavior of the userPassword attribute

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the DS-Heuristics attribute

Specify which SPN types are mapped to “host”

WP on the NTDS-Service object cn=Directory Service,cn=Windows NT,cn=Services,CN=Configuration, DC=<forestRootDomain> to modify the SPN-mappings attribute

Increase the level of detail logged by the KCC in the event log

Modify the 1 Knowledge Consistency Checker entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged for Security Events

Modify the 2 Security Events entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events related to communication between Active Directory and Exchange clients

Modify the 3 ExDS Interface Events entry and the 4 MAPI Interface Events entry under KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged when objects marked for deletion are actually deleted

Modify the 6 Garbage Collection entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by directory service operations

Modify the 7 Internal Configuration entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by directory access events

Modify the 8 Directory Access entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by internal operation of directory service code

Modify the 9 Internal Processing entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events related to loading and unloading the NTDS performance object and performance counters

Modify the 10 Performance Counters entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events related to starting and stopping the directory service

Modify the 11 Initialization/Termination entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by directory service events

Modify the 12 Service Control entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by the events related to address resolution and Active Directory names

Modify the 13 Name Resolution entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by the events related to the backup of Active Directory

Modify the 14 Backup entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events related to LDAP

Modify the 16 LDAP Interface entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events related to running the Active Directory Installation wizard

Modify the 17 Setup entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events related to the Global Catalog

Modify the 18 Global Catalog entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Modify the level of detail logged by events the Inter-site messaging service

Modify the 19 Inter-site Messaging entry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Thus, appropriate permissions required to modify this registry key will be required to delegate the operation

Designate a DC as a Global Catalog

WP on the corresponding NTDS Settings object with distinguished name cn=NTDS Settings, cn=<Computer-Name>, cn=Servers, cn=<SiteName>,cn=Sites,cn=Configuration, dc=<forestRootDomain> to modify the options attribute

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft