Using the Directory Service Comparison Tool (Software & Video)

[samsam 14]

As I’ve mentioned before my friend and colleague has developed a tool which makes the Active Directory snapshots functionality useful. The tool is called Directory Service Comparison Tool and the version available at the moment is 1.2.1.

 

In this movie I’m showing the functionality you get from this nifty utility. You can compare objects in your production Active Directory with the values in your snapshot. Not only that, but you can restore objects from your snapshot as well as single attributes. AND (I’m starting to sound like someone on the home shopping channel now) you can restore groups and group memberships from your snapshot into your Active Directory.

 

The tool is available in both x86 and x64-versions and you’ll need .Net framework 2.0 to run it.

 

 

 

How-To Use Video but without Audio(You can %100 understand)

 

http://www.nullsession.com/wp-content/DSCT/DSCT.zip

 

 

 

 

Download powerpoint(DSCT.pptx)

 

http://www.nullsession.com/wp-content/DSCT/DSCT.pptx

[samsam 14]

Directory Service Comparison Tool 2.0 B3

 

The Directory Service Comparison Tool makes use of Active Directory and Active Directory snapshots to enable the following functionality:

 

* Display differences between objects in Active Directory and Active Directory Snapshots

* Restore attribute values from snapshots to Active Directory

* Reanimate deleted objects

* Group membership restore

Display differences in group membership for a selected object (users, computers and groups). Allows for full or selective restore of group membership at any time.

* Active Directory audit integration

Retrieve relevant AD audit event log entries for a specific object from all domain controllers in a domain. Filtering options allow you to find and inspect attribute specific event log entries.

* Tree view [new]

DSCT displays added/modified/deleted objects in a familiar tree structure. Objects are color coded depending on the type of operation (the color part still needs some work, my respect to anyone who designs GUIs for a living)

* Differences in the membership of a group[new]

DSCT can now show you which objects were added and removed from a group since the snapshot was taken.

A list of new features and improvements in DSCT 2.0 can be found in this post. Have fun and keep in mind that this is a beta version! Special thanks to Daniel Brad for some real world testing

 

Directory Service Comparison Tool 2.0 B3

 

The Directory Service Comparison Tool makes use of Active Directory and Active Directory snapshots to enable the following functionality:

 

* Display differences between objects in Active Directory and Active Directory Snapshots

* Restore attribute values from snapshots to Active Directory

* Reanimate deleted objects

* Group membership restore

Display differences in group membership for a selected object (users, computers and groups). Allows for full or selective restore of group membership at any time.

* Active Directory audit integration

Retrieve relevant AD audit event log entries for a specific object from all domain controllers in a domain. Filtering options allow you to find and inspect attribute specific event log entries.

* Tree view [new]

DSCT displays added/modified/deleted objects in a familiar tree structure. Objects are color coded depending on the type of operation (the color part still needs some work, my respect to anyone who designs GUIs for a living)

* Differences in the membership of a group[new]

DSCT can now show you which objects were added and removed from a group since the snapshot was taken.

[samsam 14]

A list of new features and improvements in DSCT 2.0 can be found in this post. Have fun and keep in mind that this is a beta version! Special thanks to Daniel Brad for some real world testing.

 

Download

 

* DSCT 2.0 Beta 3 x64

 

http://lindstrom.nullsession.com/download/DSCompareSetup_2.0_beta3_x64.zip

 

 

 

* DSCT 2.0 Beta 3 x86

 

http://lindstrom.nullsession.com/download/DSCompareSetup_2.0_beta3_x86.zip

 

 

 

 

Previous versions available at the bottom of this page.

 

Getting Started

 

1. Start MMC and add the Directory Service Comparison Tool via the Add/Remove Snap-in dialog.

2. Open the Connection Settings dialog and connect to your DC and snapshot. Don’t forget to specify the portnumber for the snapshot host. No objects will be displayed in DSCT unless differences are detected between the DC and the snapshot.

3. Click the Resync button if you have just modified an object in Active Directory and want to compare it to it’s former state in the snapshot.

 

Requirements

 

* .NET 3.5 or higher

* MMC 3.0

* Data sources: Active Directory and a mounted Active Directory Snapshot on Windows Server 2008 or Windows Server 2008 R2

* Active Directory audit integration: domain controllers must be Windows Server 2008 (R2 supported). Active Directory auditing must be enabled. RODCs and domain controllers running on older operating systems will be ignored.

* DSCT does not have to be installed on a domain controller nor does it have to be installed on a domain joined machined. A functional DNS infrastructure is recommended.

* DSCT can be installed and run on Windows Server 2008, Windows Server 2008 R2. Windows Vista and Windows 7 should work fine although this has not been tested.

 

Testing so far

 

* x86 and x64 versions installed and tested on Windows Server 2008 x64

* Active Directory and snapshots on Windows Server 2008 and Windows Server 2008 R2 tested as data sources

* Locally on a DC and on a separate (non domain joined) machine

* Restore attribute values has been tested on several attributes including ntSecurityDescriptor, multi-value attributes like member and more normal ones like givenName, sn, accountExpires, etc.

* Group membership restore has been tested on users, computers and groups

* Reanimation functionality has been tested on users, groups and organizationalUnits.

* Active Directory audit integration tested with 10 domain controllers and a total 1.2 million event log entries in the security event logs. 6 of these spread over several domain controllers were of interest. DSCT, running on a dual core machine, retrieved these in roughly 6 seconds.

 

Known issues

 

* Full membership restore of very large groups (20k+) fails on a DC running Windows Server 2008. I have not been able to reproduce this error on Windows Server 2008 R2. Needs some more investigation

* Due to a bug in the Windows Server 2008 snapshot feature recently created snapshots will appear to be more up to date than the Active Directory instance. DSCT has a workaround for this scenario. Read this post for further information. This issue does not affect Windows Server 2008 R2.

 

I hope enjoy and usefull for people

Regards

[XP-Fan 220]

Hallo samsam,

 

lieferst du bitte noch die Quelle deines Textes nach ? Danke.

[samsam 14]

ich habe schon geschrieben,

http://www.nullsession.com

aber wenn du genaue addresse möchtest (Video)

http://www.nullsession.com/2008/07/12/using-the-directory-service-comparison-tool/

Directory Service Comparison Tool 2.0 B3

http://lindstrom.nullsession.com/?page_id=11

 

ich hofe usefull sein

regards

[NilsK 2.971]

Moin,

 

bitte verschieben nach Tipps & Links (oder wie das heißt).

 

Gruß, Nils

[samsam 14]

Moin NilsK

 

leider habe keine option zu verschieben

 

regards

[NilsK 2.971]

Moin,

 

ich meinte auch die Moderatoren. ;)

 

Gruß, Nils

PS. Künftig tut es auch ein Link und eine Kurzbeschreibung.

[XP-Fan 220]

Hallo samsam,

 

ich wollte die Quelle des Authors haben oder hast du den Text oben komplett selbst geschrieben ?

 

Weiterhin stellt sich mir die Frage ob du auf der Suche nach Testern bist und wer der

Programmierer ist welcher dieses Tool geschrieben hat.

 

Bitte beachte auch das unsere bevorzugte Sprache nicht englisch ist auch wenn wir es

einigermaßen beherrschen.

 

Ich zähle auf dein Verständnis.

 

Gruß

XP-Fan

[zahni 562]

Der 1. Beitrag ist von hier kopiert:

 

Using the Directory Service Comparison Tool

[samsam 14]

Habe schon geschrieben und habe gedacht vielleicht ist usefull für leute

 

 

ich habe schon geschrieben,

http://www.nullsession.com

aber wenn du genaue addresse möchtest (Video)

http://www.nullsession.com/2008/07/12/using-the-directory-service-comparison-tool/

Directory Service Comparison Tool 2.0 B3

http://lindstrom.nullsession.com/?page_id=11

 

ich hofe usefull sein

regards