Active Directory Users and Computers is a Microsoft Management Console (MMC) that is automatically installed when you install Active Directory. This tool also ships with the Administration Tools Pack (Adminpak.msi).

You can access the tool from the Start menu: To do this, click Start, point to Programs,point to Administrative Tools, and then click Active Directory Users and Computers.

Active Directory Users and Computers runs on domain controllers that run Windows Server 2003 or Windows 2000 operating systems. You can use MMC to administer and publish information in the directory.

The Windows Server 2003 version of Active Directory Users and Computers can target domain controllers that are running Windows Server 2003 or Windows 2000 Server.

On administrative workstations that are running Windows XP Professional or Windows 2000, you can install the Windows Server 2003 Administration Tools Pack (Adminpak.msi) from the i386 folder on the Windows Server 2003 CD. This version of the Administration Tools Pack encrypts and signs Lightweight Directory Access Protocol (LDAP) traffic between the administrative tool client’s and domain controllers.

Note

• You cannot run the Windows Server 2003 Administration Tools Pack (Adminpak.msi) on a computer that is running Windows XP Professional, Windows XP Home Edition, or Windows XP 64-Bit Edition Version 2003 without Windows XP Service Pack 1 (SP1).
  
  

You can use Active Directory Users and Computers to manage the following properties that are listed in the following table, which are associated with objects in Active Directory. Any changes you make affect certificate mapping for these objects.

Active Directory Users and Computers Object Management

You can find more information about Active Directory Users and Computers on the TechNet Web site.

Event Viewer is included in the Windows Server 2003, Windows XP, and Windows 2000 operating systems.

Event Viewer is supported for the Windows Server 2003, Windows XP, and Windows 2000 operating systems.

The system log contains Secure Channel (Schannel) events that are related to authentication.

Schannel Events

To find more information about “Event Viewer”, see “Event Viewer” on TechNet.

A limited version of Network Monitor is included in Windows Server 2003, Windows XP, and Windows 2000 operating systems. The full version of Network Monitor is included with Microsoft Systems Management Server.

Network Monitor is supported for Windows Server 2003, Windows XP, and Windows 2000.

Network Monitor enables you to capture network traces which can be used in troubleshooting most network issues.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003

This entry does not exist in the registry by default. The default value is that all four certificate mapping methods are supported.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of symmetric algorithms.

This subkey controls use of DES 56 bit algorithm.

This subkey controls use of no encryption.

This subkey controls use of RC2 128 bit algorithm.

This subkey controls use of RC2 40 bit algorithm.

This subkey controls use of RC2 56 bit algorithm.

This subkey controls use of RC4 128 bit algorithm.

This subkey controls use of RC4 40 bit algorithm.

This subkey controls use of RC4 56 bit algorithm.

This subkey controls use of 3DES 168 bit algorithm.

The default for these ciphers is enabled.

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. When you disable any algorithm, you disallow all cipher suites that use that algorithm. To re-enable the cipher, change the DWORD value to 0xffffffff.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003, Windows XP, Windows 2000

This entry controls the time to expire client side cache entries in milliseconds. A value of 0 turns off secure connection caching. This entry does not exist in the registry by default. The default values are:

Default Client Cache Time

HKLM SYSTEM\CurrentControlSet\Control\LSA

Windows Server 2003, Windows XP, Windows 2000

This entry controls FIPS compliance. The default is 0.

FIPS Cipher Suites

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of hash algorithms.

This subkey controls use of MD5 as hashing algorithm.

This subkey controls use of SHA-1 as hashing algorithm.

The default for these ciphers is enabled.

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. When you disable any algorithm, you disallow all cipher suites that use that algorithm. To re-enable the cipher, change the DWORD value to 0xffffffff.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003

This entry controls the size of issuer cache and is used with issuer mapping. Starting with Windows Server 2003 operating systems, Schannel attempts to map all of the issuers in the client’s certificate chain—not just the one that directly issues the client certificate. When the issuers do not map to an account which is the typical case, the server might attempt to map the same issuer name over and over, hundreds of times a second. To prevent this, Windows Server 2003 has a negative cache, so if an issuer name does not map to an account, then it is added to the cache and Schannel will not attempt to map the issuer name again until the cache entry expires. This registry entry specifies the cache size. This entry does not exist in the registry by default. The default value is 100.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003

This entry controls the length of cache timeout interval in milliseconds. Starting with Windows Server 2003operating systems, Schannel attempts to map all of the issuers in the client’s certificate chain—not just the one that directly issues the client certificate. In the case where the issuers do not map to an account which is the typical case, the server might attempt to map the same issuer name over and over, hundreds of times a second. To prevent this, Windows Server 2003 has a negative cache, so if an issuer name does not map to an account, then it is added to the cache and Schannel will not attempt to map the issuer name again until the cache entry expires. This cache is kept for performance reasons, so that the system does not keep trying to map the same issuers over and over. This entry does not exist in the registry by default. The default value is 10 minutes.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of key exchange algorithms.

The subkey controls use of DH for key exchange.

This subkey controls use of RSA for key exchange.

The default for these ciphers is enabled.

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. When you disable any algorithm, you disallow all cipher suites that use that algorithm. To re-enable the cipher, change the DWORD value to 0xffffffff.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003, Windows XP, Windows 2000

This entry controls the maximum number of cache elements. Setting MaximumCacheSize to 0 disables the server-side session cache and prevents reconnects. Increasing MaximumCacheSize above the default values causes Lsass.exe to consume additional memory. Each session cache element typically requires 2-4k bytes of memory. This entry does not exist in the registry by default. The default value is 10,000 elements.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of Private Communications Transport PCT.

This subkey controls use of PCT on client

This subkey controls use of PCT on server

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 0xffffffff.

This entry controls disabling PCT by default. This entry does not exist in the registry by default.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003

This entry controls the flag controlling sending of list of trusted issuers. In the case of servers that trust hundreds of certificate authorities for client authentication, there are too many issuers for the server to be able to send them all to the client when requesting client authentication. In this situation, this registry key can be set, and instead of sending a partial list, Schannel will not send any to the client.

Not sending a list of trusted issuers might impact what the client sends when asked for a client certificate. For example, when Internet Explorer receives a request for client authentication, it only displays the client certificates that chain up to one of the certificate authorities that is sent by the server. If the server did not send a list, then Internet Explorer displays all of the client certificates that are installed on the client machine. This behavior might be desirable, when PKI environments include cross certificates, the client and server certificates will not have the same Root CA and therefore, Internet Explorer cannot chose a certificate that chains up to on of the server’s CAs. By configuring the server to not send a trusted issuer list then Internet Explorer will send all its certificates.

This entry does not exist in the registry by default. This value is true by default.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Windows Server 2003, Windows XP, Windows 2000

This entry controls the time to expire server side cache entries in milliseconds. A value of 0 disables the server-side session cache and prevents reconnects. Increasing ServerCacheTime above the default values causes Lsass.exe to consume additional memory. Each session cache element typically requires 2-4k bytes of memory. This entry does not exist in the registry by default. The default values are:

Default Server Cache Time

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of SSL 2.0.

This subkey controls use of SSL 2.0 on the client.

This subkey controls use of SSL 2.0 on the server.

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 0xffffffff.

Flag to disable SSL 2.0 by default.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of SSL 3.0.

This subkey controls use of SSL 3.0 on client

This subkey controls use of SSL 3.0 on server

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 0xffffffff.

HKLM SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

Windows Server 2003, Windows XP, Windows 2000

This subkey controls use of TLS 1.0.

This subkey controls use of TLS 1.0 on client

This subkey controls use of TLS 1.0 on server

To disable, create the Enabled entry in the appropriate subkey. (This entry does not exist in the registry by default.) After you have created the entry, change the DWORD value to 0. To re-enable the protocol, change the DWORD value to 0xffffffff.