I'm looking at implementing group policies for both security and to
deploy/maintain software in a small business (~600 users) with 3 sites.
I've read through all the material I can find however I haven't found if
there is a dis-advantage to creating nested OUs?

I have several questions about establishing trust relationship between two AD
forests.
1. Two AD forests are from two independent organizations. Domain controllers
are behind each organization’s firewalls. Does trust relationship require ALL

I’d like to restore my Active Directory (2k3)  on a Virtual environment
based on Virtual Server 2005 in order to practices this procedure.
I’ve restored single users and OUs, however, I’ve never restored the entire
directory on a server without the AD role installed.

What are the syntax for the command OR in LDAP. I can manage = (the same as)
and ! (not as) but I can't find something like OR.
I want to search for 2 AD attributes and it's enough if one of them are
right (have the right value), but I'm not sure how to do that. If I manage I

Windows 2003 SP3
I have some folders and the owners are just SID's. I assume these SID's are
old/deleted AD user accounts. Is there anyway to identify the user account
these SID's had been attached to? Is there a record of the username that the

I have 3 Windows 2003 R2 servers in my test environment.  (A, B and C)
When a DFS replication group is created on A or B, it replicates to all
other servers (A,B and C) quickly showing up in DFS management (and file
replication starts quickly).

Is it possible to set folder permissions in active directory?  We have an
application that has a set level of permissions for folders on the PC.  Is
there a way in AD to setup folder permissions?

I have a question about the log on as a service setting that is
available in GPOs. I have a couple hundred windows servers in an OU
and I would like to configure "log on as a service" in the GPO that is
applied to this OU. However, as I understand it once I do that all

I have a forest with 2 domains.
I want to grant some users to manage the account properties of the users
under a OU.
When the delegated user checks "user must change password at next logon",

I need to keep in sync shares from about 15 workstations with a vackup
location on the file server (it will be a 2008 SBS server).
I've read Robocopy's documentation, and in my opinion it is very good for
what I need. I intend to run it with /MON parameter, so it will keep in sync

I am upgrading about 100 desktops. Currently I have windows XP pro
envoirnment. New PC's will have the same. Is there a script that I can use
that will allow me to join multiple computer to my domain, instead of going
to each computer and joining them manually?

I would like to configure my main DC to be the NTP server for all computers
in the domain.  At each branch I have a DC.  I would like the branch
computers to sync with the local DC and then the local DC syncs with my main
DC.

I have a user with a notebook who from home connects to his network, then
logs into his domain account using cached credentials.   Then he connects to
the VPN.  He can ping everything once in , but he is unable to connect to
any resources from this login over VPN.    Is there a ...

I would like to know if there is any tool or script that clean the AD
database through NTDSUTIL/Metadatacleanup automaticaly.
I have some DC´s "lost" in my environmet because they were demoted in a
wrong way.

We are about to do a domain name change in Active Directory and I am
currently running Certificate Authority on an independent server.  Will I
need to rebuild this server after running the rendom.exe tool?  Or will a
double reboot of the server make any changes necessary?  Thx.