Spat's WebLog (Steve Patrick) : AD

Just a quick post on IIS7 cert mapping setup

SpatDSG — Mon, 30 Nov 2009 15:41:00 GMT

Install the role service under IIS At the Server level - enable DS mapping under authentication: Create the web site. Enable it for HTTPS ( bindings ) Set the site to require certs under: Enable the site : C:\Windows\SysWOW64\inetsrv> appcmd unlock...(read more)

More Kerberos fun with PAC’s- decrypt the PAC

SpatDSG — Thu, 26 Mar 2009 17:38:00 GMT

I had been meaning to blog about this for a while, and recently was teaching a class when a friend of mine looked into the exact steps and issues – thanks Woody. It may be interesting to peek into the PAC every once in a while and make sure everything...(read more)

There and back again.. the journey of a bug in ADFS

SpatDSG — Mon, 23 Feb 2009 18:27:00 GMT

Let's look at a bug fix.. end to end. So back in November, my friend Jim Simonet had posted a question about a problem with ADFS using ADAM as the auth store and specifying that it connect via LDAP over SSL. He could connect to ADAM via LDP on 636, so...(read more)

More fun with Kerberos and Web Sites

SpatDSG — Mon, 17 Nov 2008 18:27:00 GMT

SPN’s. Service Principal Names. I am not going to go into the details of how SPN’s are used right now, see my other posts on Kerberos or go use your favorite search engine to determine how they are used. Most of this post will relate to web sites and...(read more)

Kerberos domain routing

SpatDSG — Thu, 21 Aug 2008 17:43:00 GMT

So the scenarios is pretty simple. Forest trust like so: Basic problem. User tried to access sharepoint and fails to use Kerberos. So we can review the end to end process ( still at a high level ) 1. User logs on 2. User gets TGT for kz.com domain 3....(read more)

LDAP client tracing...

SpatDSG — Tue, 12 Aug 2008 17:37:00 GMT

ADinsight from the sysinternals toolset is a great tool , but I seem to have problems with it at times. Specifically on Server 2008 & Vista (maybe due to the way it hooks wldap32.dll) On Vista OS and beyond, there is built in client ldap tracing which...(read more)

How to populate the “Street” field with more than 1 line of text...or, how to use top down tshooting.

SpatDSG — Thu, 03 Jul 2008 22:12:00 GMT

this is a test of an excerpt... :) ...(read more)

Remote Server Administration Toolset (RSAT) for Windows Vista SP1 -- now available!

SpatDSG — Tue, 25 Mar 2008 19:49:00 GMT

Long awaited remote admin tools you can toss on Vista.. located here: http://www.microsoft.com/downloads/details.aspx?FamilyID=9ff6e897-23ce-4a36-b7fc-d52065de9960&DisplayLang=en and x64 here: http://www.microsoft.com/downloads/details.aspx?FamilyID=d647a60b-63fd-4ac5-9243-bd3c497d2bc5&DisplayLang=e...(read more)

Group Policy Preferences CSE for download -

SpatDSG — Mon, 17 Mar 2008 19:54:00 GMT

Group Policy Preference Client Side Extensions for Windows XP (KB943729) Multiple Group Policy Preferences have been added to the Windows Server 2008 Group Policy Management Console (which are also available through the Remote Server Administration Toolset...(read more)

"Kerberos delegation .. end to end" Part III

SpatDSG — Mon, 26 Nov 2007 18:35:00 GMT

When we last left off, we had just installed SQL. Also my standard disclaimer for this series: First off let me say that I am not a “SQL guy” nor am I an “IIS guy” .. I am primarily a platforms OS kinda guy. However, I can wing my way thru some of those...(read more)

Set WMI namespace security via GPO (script)

SpatDSG — Wed, 21 Nov 2007 19:20:00 GMT

This was an example of setting WMI security via a script - the specific question was: “Is there a way I can change the permissions on WMI (need to grant remote enable access) so I can grant a service account read access to certain machines via Group Policy?”...(read more)

"Kerberos delegation .. end to end" Part II

SpatDSG — Tue, 20 Nov 2007 18:32:00 GMT

When we left off - I was about to install SQL. Also my standard disclaimer for this series: First off let me say that I am not a “SQL guy” nor am I an “IIS guy” .. I am primarily a platforms OS kinda guy. However, I can wing my way thru some of those...(read more)

"Kerberos delegation .. end to end" Part I

SpatDSG — Wed, 14 Nov 2007 18:35:00 GMT

First off let me say that I am not a “SQL guy” nor am I an “IIS guy” .. I am primarily a platforms OS kinda guy.

However, I can wing my way thru some of those two technologies. This series of posts may not exactly follow best practices when it comes to SQL or IIS but it will definitely get you up and running.

You may be thinking, there are already a ton of resources to show how to get this up and running. Simply use your favorite search engine and look for ‘Kerberos delegation SQL’ and you will find dozens of HOW TO articles, blogs etc..

I am hoping that this one will differ in two ways. One, is that it is an exact step by step. Two, is that we will go into the WHY’s of why we do certain actions to make it all work ( mostly from an OS authentication perspective ) .

Overview:

Kerberos delegation specific to a 3 tier server design

What does that mean to a non “kerberos guy”? It means you want the following scenario to work.

Scenario:

Bob logs on to his XP machine which is a member of a domain.
Bob accesses a web site which should give him data “x”
The web site needs to be accessed as Bob – not as some service account or system.
The web site needs to access a SQL server, running on a different machine --- as Bob.

OK so now that we have that basic scenario down let’s see what we need to make this work.

Necessary ingredients:

Domain controller ( Win2k3 SP2 )
XP client ( sp2 )
IIS Web Server ( Win2k3 Sp2 )
SQL server ( 2005 )

OK so this isn’t really an end to end scenario.. I’m not going to walk you through DCpromo DNS etc.. I assume you have the basic domain working. If not, go run DCpromo and then come on back.

Now, let’s assume we have not setup the Web Server or SQL server yet.

The first thing to think about is – what or who are these services going to run as? Best practices for security says – not as system. OK . So let’s make a few domain accounts to run them as.

On the DC ( domain controller ) create the following 3 users. Don’t put them in any magical groups or anything.

Domain\Bob
Domain\SVC_IISPool
Domain\SVC_MSSQLServer

Great. On to installing IIS. Go ahead and make sure you install ASP.NET also:

Now we are going to create a new Application Pool which will run as Domain\SVC_IISPool – I called my app pool "SVC_POOL"

Then go to the properties of the new App pool you just made and go to the identity tab and set it up to run as the domain account you made:

Now create a new Web site – and make sure you do not enable anonymous access. I made a dir called c:\website and the site should be set to windows integrated authentication only.

I then went to the “home directory” tab and set it to run under the app pool I created earlier – the one I called SVC_POOL:

Execute permissions should be set to "Scripts only" unlike the screen shot below.

Also – make sure that the web site is configured to use ASP.NET 2.0:

Now, for the actual web site I’m going to stick with Visual Studio ( I suppose you could use visual studio express – it’s free http://msdn.microsoft.com/vstudio/express/

Open Visual Studio and click on File -> New Web Site.

Point it to c:\website ( or wherever your site is )

It will make the following dir and files:

S:\website>dir /b

App_Data

Default.aspx

Default.aspx.cs

Change your Default.aspx.cs to look like this:

using System;

using System.Data;

using System.Configuration;

using System.Web;

using System.Web.Security;

using System.Web.UI;

using System.Web.UI.WebControls;

using System.Web.UI.WebControls.WebParts;

using System.Web.UI.HtmlControls;

using System.Security.Principal;

public partial class _Default : System.Web.UI.Page

{

protected void Page_Load(object sender, EventArgs e)

{

Response.Write(" This page is running as : <b>" + WindowsIdentity.GetCurrent().Name +

"</b><br>");

}

Now it should run and you will see it under the debugger like so:

Let it add the web.config file and then you should see:

Lets try it from IE ( not via Visual Studio )

Oh no! Service Unavailable… Ok what’s wrong here. ( remember I really am not an IIS guy )

Let’s see what have I done so far:

Made web site – set to integrated auth
Made app pool to run as SVC_IISPool
Set site to run under the app pool

Hrmm ok well I suppose that the SVC_IISPool account needs NTFS permissions to c:\website.. let’s try that.

Nope still fails

OK lets set it to use the defaultAppPool. Yup – that seems to work OK – we get:

Turns out there is this command called: aspnet_regiis.exe

It appears that this command grants proper membership and permissions to the service account

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727>aspnet_regiis.exe -ga request132027\svc_iispool

Start granting request132027\svc_iispool access to the IIS metabase and other directories used by ASP.NET.

Finished granting request132027\svc_iispool access to the IIS metabase and other directories used by ASP.NET.

Then I restarted the App Pool and it started working:

But – I don’t want to authenticate as SVC_IISPool – I want it to say I accessed the web site as Bob ( or whoever it is )

Edit your web.config file and add the line in red.

<snip>

Set compilation debug="true" to insert debugging

symbols into the compiled page. Because this

affects performance, set this value to true only

during development.

-->

<!--

The <authentication> section enables configuration

of the security authentication mode used by

ASP.NET to identify an incoming user.

-->

<identity impersonate="true"/>

<!--

The <customErrors> section enables configuration

of what to do if/when an unhandled error occurs

during the execution of a request. Specifically,

it enables developers to configure html error pages

to be displayed in place of a error stack trace.

<snip>

Now you should see :

So lets try this from the remote XP machine as Bob.

Oh no.. I’m prompted for authentication and then get this:

Tried adding authenticated users NTFS to c:\website – nope still fails

So let's think about this - why would It be denied?

· The site is being accessed via http://name -- if we used http://host.domain.com we need to add it to the intranet sites in IE in order for IE to recognize it should use integrated authentication.

· IE is set to use Windows integrated authentication – verified via the Tools->Options->Advanced.

· We can look at the security event logs on IIS and see it is using Kerberos.

· The web site runs as SVC_IISPool - but we have set <identity impersonate="true"/> what does this mean to us?

Let’s look on the wire..specifically between the client and the DC. You can use Netmon or Wireshark to do so.

We see the TGS request and a successful reply:

Kerberos TGS-REP

Pvno: 5

MSG Type: TGS-REP (13)

Client Realm: REQUEST132027.LOCAL

Client Name (Principal): bob

Name-type: Principal (1)

Name: bob

Ticket

Tkt-vno: 5

Realm: REQUEST132027.LOCAL

Server Name (Service and Instance): HTTP/sp132027c.request132027.local

Name-type: Service and Instance (2)

Name: HTTP

Name: sp132027c.request132027.local

enc-part rc4-hmac

The IIS machine name is sp132027c.request132027.local.

OK – time for a little lesson on this thing called Kerberos:

Based on http://technet2.microsoft.com/WindowsServer/en/library/4a1daa3e-b45c-44ea-a0b6-fe8910f92f281033.mspx

Message 4: The Ticket-Granting Service Response

The TGS response includes the ticket from the requested target server and a session key for the client and the target server with which to encrypt and decrypt their session messages.

The ticket is encrypted with the target server's secret key, so the client cannot decrypt and modify the ticket.

The message containing the session key for use with the target server is encrypted with the session key being used by the client and the TGS. The client can decrypt the new session key and use it to encrypt the authenticator that it will send to the target server along with the new ticket.

The “target server” in this case, is the target that the KDC identified via the Service Principal Name (SPN) passed to it.

Message 5: The Application Server Request

After the client has requested and received a TGT from the AS, and has requested and received a service ticket from the TGS, the client is ready to send the ticket to the target server.

The KRB_AP_REQ message contains an authenticator encrypted with the session key that the client and target server share, the service ticket encrypted with the target server's secret key, and the optional mutual authentication request. The mutual authentication response, which takes the form of a KRB_AP_REP message, is only necessary if the client requires verification that the target server is truly the recipient of the KRB_AP_REQ and subsequent messages.

So we take that TGS_REP, extract the data destined for the target and package it up and toss it over to the target server in an AP_REQ.

So let’s take a look at the IIS audit log, since this is the target server in our scenario:

Event Type: Failure Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 529

Date: 11/10/2007

Time: 3:58:01 PM

User: NT AUTHORITY\SYSTEM – why does it show us accessing as system? Should be Bob right?

Computer: SP132027C

Description:

Logon Failure:

Reason: Unknown user name or bad password

User Name:

Domain:

Logon Type: 3

Logon Process: Kerberos

Authentication Package: Kerberos

Workstation Name: -

Caller User Name: -

Caller Domain: -

Caller Logon ID: -

Caller Process ID: -

Transited Services: -

Source Network Address: 10.10.34.66

Source Port: 1150

That’s odd.. it is showing up as system ( that would be the local machine account. )

I would expect to see Bob – or at the least, SVC_IISPool.

The net sniff indicates the requested SPN is for via cName (client name ) == Bob and the SPN is for HTTP/sp132027c.request132027.local.

Hrmm .. a quick search in the AD shows IIS automatically registered that on the machine account.

OK that’s a bit of a lie. What is it really?

LDP.EXE shows us the object information as follows:

>> Dn: CN=SP132027C,OU=IIS,DC=request132027,DC=local

2> servicePrincipalName: HOST/SP132027C; HOST/sp132027c.request132027.local;

So if there is no HTTP service registered how does it know to use the account SP132027C?

There is this thing called SPNMapping that we do:

All of the following SPN’s can be implicitly mapped to the “HOST” service. I didn’t create these mappings, they are default in the OS

dn: CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=request132027,DC=local

sPNMappings:

host=alerter,appmgmt,cisvc,clipsrv,browser,dhcp,dnscache,replicator,eventlog,eventsystem,policyagent,oakley,dmserver,dns,mcsvc,fax,msiserver,ias,messenger,n

etlogon,netman,netdde,netddedsm,nmagent,plugplay,protectedstorage,rasman,rpclocator,rpc,rpcss,remoteaccess,rsvp,samss,scardsvr,scesrv,seclogon,scm,dcom,cifs

,spooler,snmp,schedule,tapisrv,trksvr,trkwks,ups,time,wins,www,http,w3svc,iisadmin,msdtc

So – Bob asks for a TGS specifically for the service HTTP/sp132027c.request132027.local to present to the web server.

The KDC looks and says – yup , found that SPN registered on \\sp132027c I will encrypt the session key with the password that the machine \\sp132027c will be able to decrypt.

KDC hands the ticket to Bob – Bob then hands it to the web server.

Now, the web site is running under SVC_IISPool – which is the one who needs to be able to authenticate the ticket - not the local machine account for \\sp132027c.

SVC_IISPool looks at the ticket, tries to decrypt it and can not, since it doesn’t have the right password

Can we prove this?

Let’s turn on some logging on the IIS Server and see what he thinks of this whole thing.

How to turn on debug output – via http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx

There are a number of ways to view the debug output from Kerberos. The easiest way is by logging the debug output to a file and then opening this file in Notepad.

1.	Click Start, click Run, type regedit.exe,* and then press ENTER.* Caution Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
2.	Open the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\
3.	Create the following entry: Value: KerbDebugLevel Type: DWORD Data: c0000043 (this value will print the most standard set of debug messages. Try it first. If you still want to see more output, set it to ffffffff).
4.	Create the following entry in the same registry location: Value: LogToFile Type: DWORD Data: 1
5.	Reproduce the error
6.	Open the file lsass.log, located

Once we turn on the logging we see the following when IE is accessing the site ( I like to use tail.exe –f to monitor the log )

412.492> Kerb-Error: KerbVerifyApRequest failed to check ticket 29 0162A7A0

412.492> Kerb-Warn: Failed to verify AP request (need u2u? false): 0xc000006a. d:\nt\ds\security\protocols\kerberos\client2\ctxtapi.cxx, line 3759

Err.exe shows us that 6a is:

Y:\>err 0xc000006a

# for hex 0xc000006a / decimal -1073741718 :

STATUS_WRONG_PASSWORD ntstatus.h

# When trying to update a password, this return status

# indicates that the value provided as the current password

# is not correct.

# 1 matches found for "0xc000006a"

And 29 = KRB_AP_ERR_MODIFIED kerberr.h

Sure enough – if we look on the XP clients event logs we see:

Event Type: Error

Event Source: Kerberos

Event Category: None

Event ID: 4

Date: 11/10/2007

Time: 5:57:59 PM

User: N/A

Computer: GARBAGEXP

Description:

The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/sp132027c.request132027.local. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (REQUEST132027.LOCAL), and the client realm. Please contact your system administrator.

Status wrong password.. the SVC_IISPool account cannot decrypt the AP_REQ it is handed.

So how to make sure that the AP_REQ piece we get back in the TGS_REP is encrypted with the right keys so SVC_IISPool’s account can decrypt it?

We need to add the explicit HTTP SPN’s to SVC_IISPool account!

The two commands below can be summarized as:

“Please modify the servicePrincipalName attribute on the SVC_IISPool account, and add the SPN’s for http/sp132027c.request132027.local and http/sp132027c

C:\tools>setspn -A http/sp132027c.request132027.local request132027\SVC_IISPool

Registering ServicePrincipalNames for CN=SVC_IISPool,OU=SVC_Accounts,DC=request132027,DC=local

http/sp132027c.request132027.local

Updated object

C:\tools>setspn -A http/sp132027c request132027\SVC_IISPool

Registering ServicePrincipalNames for CN=SVC_IISPool,OU=SVC_Accounts,DC=request132027,DC=local

http/sp132027c

Updated object

We can see via ldp.exe that the account now has the SPN’s

Expanding base 'CN=SVC_IISPool,OU=SVC_Accounts,DC=request132027,DC=local'...

Result <0>: (null)

Matched DNs:

Getting 1 entries:

>> Dn: CN=SVC_IISPool,OU=SVC_Accounts,DC=request132027,DC=local

4> objectClass: top; person; organizationalPerson; user;

1> cn: SVC_IISPool;

1> givenName: SVC_IISPool;

1> distinguishedName: CN=SVC_IISPool,OU=SVC_Accounts,DC=request132027,DC=local;

1> instanceType: 0x4 = ( IT_WRITE );

1> whenCreated: 11/10/2007 10:12:50 Pacific Standard Time Pacific Daylight Time;

1> whenChanged: 11/10/2007 15:43:09 Pacific Standard Time Pacific Daylight Time;

1> displayName: SVC_IISPool;

1> uSNCreated: 24635;

1> uSNChanged: 24714;

1> name: SVC_IISPool;

1> objectGUID: e5d2f719-ff72-4e75-9ca1-608947d11107;

1> userAccountControl: 0x10200 = ( UF_NORMAL_ACCOUNT | UF_DONT_EXPIRE_PASSWD );

1> badPwdCount: 0;

1> codePage: 0;

1> countryCode: 0;

1> badPasswordTime: 01/01/1601 00:00:00 UNC ;

1> lastLogoff: 01/01/1601 00:00:00 UNC ;

1> lastLogon: 11/10/2007 15:33:13 Pacific Standard Time Pacific Daylight Time;

1> pwdLastSet: 11/10/2007 10:12:50 Pacific Standard Time Pacific Daylight Time;

1> primaryGroupID: 513;

1> objectSid: S-1-5-21-331918943-2602081550-104023558-1119;

1> accountExpires: 09/14/30828 02:48:05 UNC ;

1> logonCount: 7;

1> sAMAccountName: SVC_IISPool;

1> sAMAccountType: 805306368;

1> userPrincipalName: SVC_IISPool@request132027.local;

2> servicePrincipalName: http/sp132027c; http/sp132027c.request132027.local;

1> objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=request132027,DC=local;

1> lastLogonTimestamp: 11/10/2007 10:17:02 Pacific Standard Time Pacific Daylight Time;

-----------

Now we go back to the XP machine and try again…

And IIS registers a successful event:

Event Type: Success Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 540

Date: 11/10/2007

Time: 4:12:32 PM

User: REQUEST132027\bob

Computer: SP132027C

Description:

Successful Network Logon:

User Name: bob

Domain: REQUEST132027

Logon ID: (0x0,0x410C4)

Logon Type: 3

Logon Process: Kerberos

Authentication Package: Kerberos

Workstation Name:

Logon GUID: {b4f121f9-561c-e513-3e50-ad7dbff4a2e9}

Caller User Name: -

Caller Domain: -

Caller Logon ID: -

Caller Process ID: -

Transited Services: -

Source Network Address: 10.10.34.66

Source Port: 1165

Whewww!! Seems like a lot of work to get that little ole BOB logon…

See http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/523ae943-5e6a-4200-9103-9808baa00157.mspx?mfr=true for more of a high level overview.

I think that will end this part 1 of the series on Kerb\Delegation and adventures of an IIS\SQL newbie.

If this was helpful, I'd be interested in knowing - or if you find the series interesting\informative - or utter crap.

Also - are these posts too long? I read through it and it seemed a little long.. but what do you think?

Next up – SQL installation.

spatdsg

A few handy queries to ask Active Directory

SpatDSG — Tue, 06 Nov 2007 18:49:00 GMT

I just wanted to do a random DS related post .

These are a few useful constructed attributes. A constructed attribute is one which is not directly stored in the AD, but is constructed specifically when requested. More info on MSDN I'm sure..

Some useful ones are … AllowedAttributesEffective, msds-replvaluemetadata, and Tokengroups

In the schema they are defined as:

CN=Allowed-Attributes-Effective,CN=Schema,CN=Configuration

CN=ms-DS-Repl-Value-Meta-Data,CN=Schema,CN=Configuration

CN=Token-Groups,CN=Schema,CN=Configuration

Note the systemFlags - FLAG_ATTR_IS_CONSTRUCTED

Getting 1 entries:

>> Dn: CN=Allowed-Attributes-Effective,CN=Schema,CN=Configuration,DC=rlo,DC=local

2> objectClass: top; attributeSchema;

1> cn: Allowed-Attributes-Effective;

1> distinguishedName: CN=Allowed-Attributes-Effective,CN=Schema,CN=Configuration,DC=rlo,DC=local;

1> instanceType: 0x4 = ( IT_WRITE );

1> whenCreated: 11/09/2005 15:42:30 Pacific Standard Time Pacific Daylight Time;

1> whenChanged: 07/19/2007 10:50:06 Pacific Standard Time Pacific Daylight Time;

1> uSNCreated: 4162;

1> attributeID: 1.2.840.113556.1.4.914;

1> attributeSyntax: 2.5.5.2;

1> isSingleValued: FALSE;

1> uSNChanged: 4162;

1> showInAdvancedViewOnly: TRUE;

1> adminDisplayName: Allowed-Attributes-Effective;

1> adminDescription: Allowed-Attributes-Effective;

1> oMSyntax: 6;

1> searchFlags: 0;

1> lDAPDisplayName: allowedAttributesEffective;

1> name: Allowed-Attributes-Effective;

1> objectGUID: fb7fa1c4-1719-480e-a9fa-80f640985afe;

1> schemaIDGUID: 9a7ad941-ca53-11d1-bbd0-0080c76670c0;

1> attributeSecurityGUID: e48d0154-bcf8-11d1-8702-00c04fb96050;

1> systemOnly: TRUE;

1> systemFlags: 0x8000014 = ( FLAG_ATTR_IS_CONSTRUCTED | FLAG_SCHEMA_BASE_OBJECT | FLAG_DOMAIN_DISALLOW_RENAME );

1> objectCategory: CN=Attribute-Schema,CN=Schema,CN=Configuration,DC=rlo,DC=local;

CN=Allowed-Attributes-Effective,CN=Schema,CN=Configuration

This one will tell you what attributes on an object you can modify, under whatever security context you query as.

Here I am logged on as Admin – and query the Cert Publishers object to see what I can do to it.

As you can see – I can pretty much modify anything.. as admin.

***Searching...

ldap_search_s(ld, "CN=Cert Publishers,CN=Users,DC=rlo,DC=local", 2, "(objectCategory=*)", attrList, 0, &msg)

Result <0>: (null)

Matched DNs:

Getting 1 entries:

>> Dn: CN=Cert Publishers,CN=Users,DC=rlo,DC=local

92> allowedAttributesEffective: proxiedObjectName; accountNameHistory; dSCorePropagationData; otherWellKnownObjects; mS-DS-ConsistencyGuid; mS-DS-ConsistencyChildCount; uSNSource; msDS-AzLDAPQuery; msDS-NonMembers; isCriticalSystemObject; altSecurityIdentities; unixUserPassword; userSMIMECertificate; lastKnownParent; url; partialAttributeDeletionList; legacyExchangeDN; textEncodedORAddress; managedBy; userCert; showInAddressBook; partialAttributeSet; mail; wellKnownObjects; sIDHistory; secretary; labeledURI; nonSecurityMember; msSFU30Name; msSFU30NisDomain; systemFlags; fSMORoleOwner; desktopProfile; sAMAccountType; wbemPath; controlAccessRights; groupMembershipSAM; rid; groupAttributes; adminCount; revision; operatorCount; supplementalCredentials; securityIdentifier; nTGroupMembers; flags; replUpToDateVector; replPropertyMetaData; objectGUID; name; msExchLabeledURI; USNIntersite; wWWHomePage; msExchAssistantName; msSFU30PosixMember; displayNamePrintable; garbageCollPeriod; uSNDSALastObjRemoved; extensionName; adminDescription; proxyAddresses; adminDisplayName; showInAdvancedViewOnly; uSNLastObjRem; uSNChanged; gidNumber; memberUid; repsFrom; repsTo; info; objectVersion; dSASignature; isDeleted; uSNCreated; displayName; subRefs; whenChanged; whenCreated; distinguishedName; userCertificate; userPassword; member; telephoneNumber; description; objectCategory; groupType; sAMAccountName; objectSid; nTSecurityDescriptor; instanceType; cn; objectClass;

-----------

A code snip of how to use this is here - http://msdn2.microsoft.com/en-us/library/aa814512.aspx

CN=ms-DS-Repl-Value-Meta-Data,CN=Schema,CN=Configuration

This one will dump the metadata of the object in XML:

Below is the output..

***Searching...

ldap_search_s(ld, "CN=Cert Publishers,CN=Users,DC=rlo,DC=local", 2, "(objectCategory=*)", attrList, 0, &msg)

Result <0>: (null)

Matched DNs:

Getting 1 entries:

>> Dn: CN=Cert Publishers,CN=Users,DC=rlo,DC=local

1> msDS-ReplValueMetaData: <DS_REPL_VALUE_META_DATA>

<pszAttributeName>member</pszAttributeName>

<pszObjectDn>CN=SAMME342B,OU=Domain Controllers,DC=rlo,DC=local</pszObjectDn>

</DS_REPL_VALUE_META_DATA>

;

-----------

CN=Token-Groups,CN=Schema,CN=Configuration

This one will tell you what groups a user belongs to, including nested groups.

**Searching...

ldap_search_s(ld, "CN=Administrator,CN=Users,DC=rlo,DC=local", 0, "(objectCategory=*)", attrList, 0, &msg)

Result <0>: (null)

Matched DNs:

Getting 1 entries:

>> Dn: CN=Administrator,CN=Users,DC=rlo,DC=local

9> tokenGroups: S-1-5-32-545; S-1-5-32-544;

S-1-5-21-140114927-3003004965-4151461519-1616;

S-1-5-21-140114927-3003004965-4151461519-518;

S-1-5-21-140114927-3003004965-4151461519-519;

S-1-5-21-140114927-3003004965-4151461519-1112;

S-1-5-21-140114927-3003004965-4151461519-513;

S-1-5-21-140114927-3003004965-4151461519-512;

S-1-5-21-140114927-3003004965-4151461519-520;

-----------

This is demonstrated here - http://support.microsoft.com/kb/301916

AD insight released as free download

SpatDSG — Tue, 06 Nov 2007 18:40:00 GMT

Some folks may recall this from using the Winternals product,..

ADInsight is an LDAP (Light-weight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications. Use it’s detailed tracing of Active Directory client-server communications to solve Windows authentication, Exchange, DNS, and other problems.

As long as I'm going on about AD tools - might as well have a look at AD explorer:

IMO the cool part of AD explorer is:

AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. When you load a saved snapshot, you can navigate and explorer it as you would a live database. If you have two snapshots of an AD database you can use AD Explorer's comparison functionality to see what objects, attributes and security permissions changed between them.

And last but not least - AD topology diagrammer thingy-

The Microsoft Active Directory Topology Diagrammer reads an Active Directory configuration using ActiveX Data Objects (ADO), and then automatically generates a Visio diagram of your Active Directory and /or your Exchange 200x Server topology. The diagramms include domains, sites, servers, administrative groups, routing groups and connectors and can be changed manually in Visio if needed.

Some of these tools are new - some old.. but all worth looking into and could prove a valueable tool when needed.

spatdsg