| Is Android Fragmentation a Lie? | | By Paul Thurrott With Android's rise to prominence in the mobile market, one of the big stories we've been fed by its shell-shocked competitors is that the platform suffers from fragmentation. But Android's supposed fragmentation certainly hasn't translated into any usage or market share problems. Is fragmentation just an excuse, a lie? More... | | | | ADVERTISEMENT |
Follow us on Twitter! Don't miss real-time updates on articles, virtual events, white papers, Essential Guides, webcasts, and more. Meet your peers and tell us what you think. Also look for us on Facebook and LinkedIn.
| | | | Introducing the Active Directory Recycle Bin in Windows Server 2012 | | By John Marlin | | The Recycle Bin has been a feature in Windows OSs for quite some time. If you accidentally delete a file, it gives you the ability to restore it. However, if you accidentally delete a user or computer account in Windows Server 2008 Active Directory (AD) or earlier, you have very little you can do other than restore AD, re-create the account, or use a third-party tool to recover it.
Windows Server 2008 R2 introduced the first Active Directory Recycle Bin. With it, you can restore a user, computer, or organizational unit (OU) account that has been accidentally deleted. However, you must use Windows PowerShell to work with the Active Directory Recycle Bin. Using PowerShell commands to search for and restore a deleted object can be difficult, especially if you're not familiar with PowerShell. And when you want to search for an object, you're limited in what you can search on. The PowerShell commands can also get a bit on the long side.
These challenges were presented to the appropriate Microsoft Product Groups. Based on this feedback, they made the Active Directory Recycle Bin part of the Active Directory Administrative Center in Windows Server 2012. As you'll see, setting up and using the Active Directory Recycle Bin just got a whole lot easier. More... | | Q: What's the easiest way to create a global audit policy that will automatically log events for all administrator changes to the system registry on all the domain controllers (DCs) in a Windows domain? | By Jan De Clercq
| | A: To set up a global audit policy, you can leverage a Windows feature called Global Object Access Auditing, which Microsoft introduced in Windows Server 2008 R2. A global object access audit policy can be used to enforce an object access audit policy for a file system or registry folder, without having to configure and propagate conventional system ACL (SACL) settings on each individual machine. You can find a good introduction to this feature on TechNet's Global Object Access Auditing page.
To configure, apply, and validate a global object access audit policy for administrator changes to the system registry on your DCs, follow these steps:
- Log on to your domain as a member of the local Administrators group and start the Group Policy Management Console (GPMC).
- In the console tree, navigate to Domains\\Group Policy Objects\Default Domain Controllers Policy, where is the name of your domain. Right-click Default Domain Controllers Policy and click Edit.
- In the Group Policy Management Editor, navigate to the Computer Configuration\Policies\Windows Settings\Security Settings\Advanced Audit Policy Configuration\System Audit Policies container.
- Double-click Object Access, then double-click Audit Registry. Select the Configure the following audit events check box, select the Success and Failure check boxes, and click OK.
- Double-click Global Object Access Policies, then double-click Registry. Select the Define this policy setting check box and click Configure.
- In the Advanced Security Settings for Global Registry SACL box, click Add. Add all default administrator groups (e.g., Domain Admins, Enterprise Admins) to the list and other custom administrator groups that you've defined and want to audit.
- In the Auditing Entry for Global Registry SACL box, select the Successful or Failed activities (e.g., Create Subkey, Delete, Change Permissions, Read) for which you want to log audit entries.
- Click OK three times to complete the audit policy configuration.
- Apply the Group Policy Object (GPO) change. On each of your DCs, open a command prompt and run the command:
gpupdate /force
| | |
No comments:
Post a Comment