I have been working with a company to solve a issue, where they are
trying to enforce a password policy for the entire company.
Simple enough. I know that you create a new GPO and link it to the
ROOT of the domain to be enforced to the domain. If you link it to a

I need to create a security group that has query rights to for users,
groups.. for all domains within our AD forrest.  This has been done before on
2 accounts but was never documented.  We now want to recreate these rights
for a group instead.

Can anyone recommend a link for guidance in creating role based permissions?  
Our sys admins have been assigning way too many people the Domain Admins
group and we need to create a more sane subset of role based administrative
groups.

I have a new Window XP SP2 (with all patches) workstation that is a member
server in our Active Directory domain.
This workstation opens up what would seem to be a large number of
connections to different domain controllers.

I've created 2 new OUs and given access to user1 (full control) to both.
Then I created a computer account in OU1 and tried to move to OU2.
I got the error: Windows cannot move object <name> because: Access is denied.
Any idea?

one doubt:
- I have an environment with Windows 2000 AD as following configuration:
- Server A: Schema Master, Domain Naming Master
- Server B: Infrastructure Master, RID Master, PDC Emulator

Hi,
I'm in test mode of migrating users from a NT2000 domain to a NT2003 domain
(different forests). Users are all roaming profiles with their My Documents,
Desktop, and Application Data folders redirected. Their profiles and

I am a Linux Admin, who has to configure "Security Audit of Active
directory" for audit purpose.
I have configured the same with editing group policy (as described in
the link http://support.microsoft.com/kb/814595 ).

I have a domain with Windows 2000 server.In  that
domain, i have a server who is DC and GC.Now I
want to replace that server for other.
The problem is that the new server follows without being identified

I want to put Reporting services in a DMZ so that when reports are run by an
external user they only see the rows in analysis services(on the LAN) that
they are allowed to see.  I don't want to open up lots of ports between the
DMZ and LAN and I was wondering if ADAM was the ...

due to an hardware error i have to do a recovery my primary domain
controller. a secondary ad controller holds his role for now.
the dc is running AD,DNS,WINS,GC and Terminalserverlicensing. The Recovery
will start in a few hours.

is there any way to lock down the account via script? Or, is is possible to
force the password to expire in e.g. 10days?
Thanks

We are planning to migrate our SQL-A (in AD) box to SQL-B (in AD)  box, then
rename SQL-B to SQL-A in AD.
The proposed steps are:
remove SQL-A and SQL-B from AD

Is there a way to actively monitor who is querying a domain
controller?  We had two of our DC's become unresponsive last week due
to lsass.exe crapping out and I want to see if someone is throwing
excessivly large queries against the directory.

User A is a domain admin on subdomain xx.yy.com
Exchange Server is on yy.com
If User A wants to create an exchange mailbox on the exchange Server(yy.com),
what permissions does he need?