Scripting and Schem(a)ing

Summary

I wrap things up in this chapter with a look at two topics that can really take your AD administrative skills to the next level. All of the objects that you work with in AD are ultimately based on the Active Directory schema, which defines how objects like user and group objects are created and what types of information they can contain. Since each Active Directory forest shares a single schema, editing this schema is a delicate operation and one that you need to plan carefully so as not to adversely affect the rest of your AD network. To help mitigate the risks associated with editing the Active Directory schema, Windows Server 2003 has created Active Directory Application Mode (AD/AM), which creates an isolated incidence of the AD database that developers can modify without these edits affecting the entirety of the network. If you find that you need to edit or extend the actual AD schema at any point, you’ll need to know how to work with the Schema Master FSMO role holder, and how to enable this server to allow schema edits.

As a final treat, you also hold in your hands a primer to get you started with writing scripts to help to automate your administrative tasks. Scripting languages such as VBScript, JScript, Perl, and Python are freely available, and allow you to automate tasks such as creating and modifying user objects, as well as interact with workstation and server properties like services, processes, and the Windows file system. We looked at such fundamental tasks as creating variables, making decisions using If...Else and Switch constructs. We also looked at the powerful Windows Management Instrumentation tool that allows you to retrieve information about many aspects of the Windows operating system by performing SQL-like queries in the WMI Query Language. By integrating script automation into your administrator’s arsenal, you’ll save time and become a better and more efficient Active Directory administrator.