Jorge's Quest For Knowledge!

All You Need To Know About Identity And Security On-Premises And In The Cloud. It's Just Like An Addiction, The More You Have, The More You Want To Have!

Archive for the ‘Active Directory Lightweight Directory Services (ADLDS)’ Category

(2016-11-16) New Replica Of ADLDS Fails When Functional Level Is Too High (Error 0x80072177)

Posted by Jorge on 2016-11-16


On one of my DCs I also have one instance of ADLDS running. As I have a second DC running, I wanted to also install an ADLDS replica instance of the configuration set running on the first DC. The servers are running W2K12R2 and the FFL of the configuration set is W2K12R2 (level 6).

I used a scripted installation of the replica instance and it ended up with the following error

image

Figure 1: Error Message About The Level Of The Operating System Not Matching The Level Of The Configuration Set

To see if there would be any different or additional information I tried the manual setup, but it ended with the following error

image

Figure 2: Error Message About The Level Of The Operating System Not Matching The Level Of The Configuration Set

Looking at the error it might even look like a permission error as it mentions not being able to create the NTDS Settings object. However, when you look at the ADLDS Instance Event Log of the existing ADLDS instance that is being used as the replication source, you will see that apparently the new ADLDS replica instance running W2K12R2 presents itself as a W2K8R2 server (level 4).

image

Figure 3: Error About OS Level Not Matching The Required Level Of The Configuration Set

This looks like a bug!

The solution (make sure to provide the ADLDS host and Ldap port!):

  • View the current level of the Configuration Set

Get-ADObject -Server <ADLDS Host>:<ADLDS LDAP Port> -SearchBase $("CN=Partitions," + (Get-ADRootDse -Server <ADLDS Host>:<ADLDS LDAP Port>).ConfigurationNamingContext) -SearchScope Base -Filter * -Properties "msDS-Behavior-Version" | FL

  • Lower the Configuration Set Level to level 4

Set-ADObject -Server <ADLDS Host>:<ADLDS LDAP Port> -Identity $("CN=Partitions," + (Get-ADRootDse -Server <ADLDS Host>:<ADLDS LDAP Port>).ConfigurationNamingContext) -Replace @{"msDS-Behavior-Version"=4}

  • Add the new replica instance

image

Figure 4: Installing The New ADLDS Replica Instance While The Level Is Set To 4

  • If you try to increase the Configuration Set Level to level 6 again, you will see….

Set-ADObject -Server <ADLDS Host>:<ADLDS LDAP Port> -Identity $("CN=Partitions," + (Get-ADRootDse -Server <ADLDS Host>:<ADLDS LDAP Port>).ConfigurationNamingContext) -Replace @{"msDS-Behavior-Version"=6}

image

Figure 5: Error When Trying To Increase The Level Again After Installing The New ADLDS Replica Instance

UPDATE 2016-12-03: This issue does not exist in Windows Server 2016 where you will be able to increase the configuration set level to level 7

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Active Directory Lightweight Directory Services (ADLDS), Functional Level | Leave a Comment »

(2015-10-07) Realistic Random Data Set To Import Into Some Identity Store

Posted by Jorge on 2015-10-07


Have you ever required to have a large and realistic random data set to test your application or system in some way? Well, look no further!

With testing, “performance/volume testing” and/or “logic testing” (either declarative or coded, against small and large data sets) is meant. Testing with correctly defined (custom) data is required to make sure the application/system behaves as you require it to behave. By using fake data you are sure you do not get into trouble due to privacy or security related issues. You also do not have to beg for and jump through all kinds of hoops to get the data. Depending, on your organization, you may also need to have a data set that includes special characters (e.g. apostrophes) and/or very special characters (e.g. unicode characters from other languages)

Most likely, there are more websites out there, but the following 2 websites can help you out in different scenarios:

  1. https://www.mockaroo.com/
  2. http://www.fakenamegenerator.com/order.php

[1] Mockaroo – Realistics Data Generator

This website allows you to use your own defined schema. You can do that by selecting/defining the field names and field types or by importing the field headers of some CSV file you have. After importing the CSV headers, you still need to define the field types. When done, you can preview the data or download it right away. The data can be downloaded in different formats, such as, but not limited to, CSV format. The only downsides are the limited number of objects (max. 1000) and that it only supports western characters for names. If you need more data, you need to pay a fee per year.

image

Figure 1: The Interface Of The Mockaroo Website To Define The Required Schema

[2] Fake Name Generator

However, if you do not have a strict schema, you want up to 50.000 objects and you also require non-western characters for names (e.g. japanese, chinese, arabic, etc.), then you might be interesting in using this website. You can generate data for a single object, or you can bulk generate (order for free!) a very large amount of data up to 50.000 objects. If you need more objects, you just request it multiple times.

First you need to select the format and compression type. Secondly you need to select the name set(s), countries, gender and age of that objects.

image

Figure 2a: The Interface Of The Fake Name Generator Website To Define The Configuration For The Data Set

And last but not least, you need to select the required fields you want to include in the data set, define the required number of objects and the e-mail address where the bulk order is e-mailed to.

image

Figure 2b: The Interface Of The Fake Name Generator Website To Define The Configuration For The Data Set

Every request file is made available after a few minutes and when done you will receive an e-mail with a time-limited link.

After receiving the data set you can import it, by first writing your own PowerShell script, into ADDS, ADLDS, Azure AD, FIM Portal/Sync, SQL database or anything similar

Have fun!

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Active Directory Domain Services (ADDS), Active Directory Lightweight Directory Services (ADLDS), Data Set, Data Set, Data Set, Data Set, Forefront Identity Manager (FIM) Portal, Windows Azure Active Directory | Leave a Comment »

(2012-03-27) Active Directory Lightweight Directory Services (ADLDS) On Windows “8”

Posted by Jorge on 2012-03-27


Active Directory Lightweight Directory Services (ADLDS), or a.k.a. Active Directory Application Mode (ADAM), (you can find its logo here clip_image001) by default is available on the server OS as a Server Role.

clip_image002

Figure 1: The “Active Directory Lightweight Directory Services” On Windows Server “8” Beta As A Server Role

However, on the client OS, for Windows XP you needed to download it separately, for Windows Vista there was no ADLDS available and for Windows 7 you also had to download it separately. For Windows Client “8” Consumer Preview, there is not need to download anything separately as it is by default available as a Windows Feature. YES!!!!

clip_image003

Figure 2: The “Active Directory Lightweight Directory Services” On Windows Client “8” Consumer Preview As A Windows Feature

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Active Directory Lightweight Directory Services (ADLDS), Windows Client, Windows Server | Leave a Comment »

(2010-01-11) ADLDS (ADAM) For Windows 7

Posted by Jorge on 2010-01-11


In previous client versions of Windows, ADLDS (a.k.a. ADAM) was available for WXP. IN addition to that it was available in every server version of Windows (W2K3, W2K3R2, W2K8 and W2K8R2). There was no official version for Vista, but if I remember correctly (not sure though) it was possible to get the separate download working with some hacks.

However, since yesterday, Microsoft has provided a version of ADLDS for Windows 7. Now everybody with interest to have a lean and mean directory service on his desktop to test or develop software can do it on his desktop without the need to have a server OS.

Get it here!

….and for its logo, see here. J

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Active Directory Lightweight Directory Services (ADLDS), Windows Client | Leave a Comment »

(2009-04-16) ADLDS (ADAM) On Windows Client

Posted by Jorge on 2009-04-16


At the moment you have ADLDS, a.k.a. ADAM, only on the server platform starting from Windows Server 2003 R2 and up. For both Windows Server 2003 RTM and Windows XP Professional you can download an out-of-band version of ADAM. Unfortunately there is no ADAM for Windows Vista or Windows 7. Developers, and others, using the last two are out of luck. But wait! That’s gonna change. Microsoft will release an out-of-band version of ADLDS for BOTH Windows Vista and Windows 7. Yes people, it’s going to happen, you just need to be a little more patient!

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Active Directory Lightweight Directory Services (ADLDS), Windows Client | Leave a Comment »

 
%d bloggers like this: