►
Description
This month we are proud to be hosting Mathias Jessen in person to do a deep dive exploration of the corners of Active Directory Domain Services most admins probably don't think about that often.
Who is Mathias Jessen?
Mathias (twitter: @iisresetme) is a well-known community member who lives in the Netherlands and speaks at just about every major PowerShell conference around the world. He is known for a razor-sharp mind and an interesting wit as well. He works as an AD security engineer and blue team member by day and acts as an advocate for PowerShell and automation in his own personal time.
One thing you can count on with Mathias is to learn something amazing every time he speaks because he is not afraid to explore other areas untouched by many speakers!
Be sure not to miss this event! If you work with Active Directory and its directory service, then this is a must-attend event.
Connect with Mathias Jessen:
https://twitter.com/iisresetme
https://github.com/IISResetMe
Watch our previous meeting on PowerShell Core with Kevin Laux:
https://youtu.be/0ZoC0BtgNNw
SUBSCRIBE to learn about PowerShell!
https://www.youtube.com/c/rtpsug?sub_confirmation=1
LET'S CONNECT!
-- https://twitter.com/rtpsug
-- https://www.meetup.com/Research-Triangle-PowerShell-Users-Group/
-- http://rtpsug.com/
B
B
B
If
you
think
about
your
career,
if
you
think
about
the
last
10
15
20
years,
right,
there's
no
way
you're
going
to
remember
all
the
technical
things
and
all
the
things
you
learn
and
then
so
on
and
on
so
putting
things
out
on
the
Internet
is
really
nice
for
other
people
to
get
some
value
out
of
it.
But
from
a
more
selfish
point
of
view,
it
also
means
that
we
now
have
Google
cataloging.
What
we
learned
in
the
past
right
and
so
I
came
over.
B
Just
as
we
were
having
this
conversation-
and
he
was
sort
of
talking-
maybe
maybe
I
should
stop
blocking
his
words
as
well.
Maybe
I
should
that
I,
don't
know
I,
don't
know,
and
now
a
year
and
a
half
later
he
said
easily
causing
this
to
choose
a
group
and
speaking
at
the
partial
somewhat
earlier
this
year.
So
I
think
that's
super
cool
and
I
sort
of
wanted
to
to
pay
back
a
little
bit
after
sort
of
pushing
him
in
that
direction.
Sean.
A
B
Of
the
things
that
we
sort
of
both
enjoy
professionally
is
Active
Directory
I
and
before
I
got
into
information
security.
I
used
to
be
an
active
directory
Evan,
so
I
use
the
main
admin
for
big
companies,
anything
from
20,000
to
to
half
a
million
users,
and
that's
also
sort
of
what's
on
my
information,
security
or
my
security.
A
career
is
that
a
lot
of
people
have
Active
Directory
and
need
help
security
light.
So
today,
what
we're
going
to
do
very
quickly
go.
B
My
my
name
is
Matthias
I
worked
with
rat
detection
in
booking.com,
I'm
sort
of
obsessed
with
PowerShell,
which
is
also
back
here
today
and
then
I'm,
not
statically,
and
professionally
invested
in
Active
Directory.
You
could
say
emotionally
invested
in
in
Active
Directory
and
we'll
talk
a
little
bit
about
that.
But
today
we're
not
going
to
be
talking
a
lot
about
partial
we're
going
to
be
talking
about
expiratory
and
sort
of
what
I
had
in
mind.
Is
that
you
probably
don't
know
who
this
guy
is?
His
name
is
Quan.
B
Weak
ESP
is
a
Danish
pastor
from
the
mid
eighteen
or
19th
century,
and
he
had
this
idea
that
as
a
society,
we
move
forward
by
keeping
alive
something
equal
deserving
word
or
oral
tradition
right
and
so.
For
this
reason,
I
thought
I
wanted
to
show
up
in
person
and
then
tell
a
story
because
people
relate
to
stories
right.
So
we're
not
going
to
do
a
bunch
of
demos.
This
is
not
going
to
be
like
a
book
on
run
down.
B
It
like
this
is
how
you
configure
Active
Directory
or
superior
expiratory
I'm,
just
going
to
tell
a
story
about
sort
of
the
worst
disaster
scenario
I've
ever
running
into
with
that
Authority,
and
maybe
we'll
maybe
we'll
learn
something
from
that
afterwards,
once
I'm
done
with
that
and
since
I'm
here
anyways.
If
you
have
any
questions
that
you
think
I
can
screw
with
that's
dr.
Park
or
whatever
we'll
do
like
a
short,
am
a
cool.
A
B
B
B
B
It's
also
very
complex
and
generally
poorly
understood.
Right
and
I
don't
mean
that,
like
you
know,
people
doing
a
career
stupid,
but
there's
so
much
complexity
in
Active
Directory
that
it's
sort
of
hard
to
be
an
expert
or
or
or
really
well
done
in
all
of
them.
So
I
want
to
talk
about
some
of
this
right
now,
there's
also
another
reason:
I,
don't
know!
B
If
you
have,
you
know
small
children
or
family
members
with
toddlers,
but
have
you
ever
observed
a
baby
realizing
the
following
that
they
can
control
movement
of
their
extremities
right
if
you've
seen
like
a
small
child
figuring
up,
they
have
hands
and
that
they
can
sort
of
control
and
right
there's
nothing
like
the
joy
of
sacred
I
can
do
something
with
my
mind
and
now
my
experiment.
Is
there
they're
sort
of
sort
of
move
right
and.
A
A
B
Baby
will
figure
out
that
they
can
do
stuff
in
the
brain,
their
their
arms
and
their
affirmatives
run
around
and
at
some
point
they
will
stop
touching
something
right.
They'll
touch
a
ball
and
it'll
roll
away,
and
this
sensation
that
you
have
agency
to
affect
change
in
your
environment
is
sort
of
fundamental
to
human
experience.
Right
and.
A
B
We
talk
about
when
we
talk
about
IT
security,
there's
a
high
incident
rate,
at
least
in
the
Western
world,
of
a
sort
of
burnout
I'd
like
there's,
there's
too
much
too
much
for
lack
of
a
better
word
in
modern
jobs.
We
all
need
to
do
administrative
tasks.
We
have
way
too
many
meetings
right
and
we
never
have
this
sense
that
we
actually
sort
of
act,
real
change
in
it
and
impact
around
us
and
the
people
who
are
stuck
with
this
most.
B
You
know
they
end
up
in
this
situation
of
what
we
call
burnout
right,
like
you,
sort
of
collapse
under
under
not
being
able
to
sort
of
use
your
agency
to
affect
real
change
or
impacting,
and
so
for
me,
Active,
Directory,
being
able
to
better
understand,
Active,
Directory
and
being
able
to
use
that
understanding
to
solve
problems
and
configure
these
environments
and
then
see
applications.
Networks,
use
cases
out
in
the
real
world
actually
take
advantage
of
this.
B
This
was
sort
of
my
first
experience
in
doing
in
doing
IT
management
and
IT
administration,
where
I
feel
like
whoa.
This
is
really
cool.
I'd
like
I
can
sit
down.
I
can
understand.
Complexity,
I
can
make
some
changes
and
also
some
I
solve
problems
sort
of
at
breast
like
because
many
people,
many
applications
are
relying
an
expiratory.
B
So
that's
sort
of
that's
what
my
motivation
and
why
I'm
still
not
stealthy
and
emotionally
invest
in
the
next
curvature.
So
a
cornerstone
of
fact
directory
is
it's
a
replication
feature
all
the
way
data's
replicated
among
space
bases
in
Active,
Directory
and
sort
of
at
a
high
level
access
Directory
replication
have
some
very
interesting
characteristics.
The
first
one
that
comes
to
mind
is
red.
It
forms
something
we
call
multi
master
replication
and.
B
It
is
pretty
cool
right
and
it's
pretty
complex
trade
in
the
most
sort
of
in
most
sort
of
classical
database
replication
chains.
You
will
have
master
instance
of
a
database
right
and
then
you
will
have
a
chain
or
a
hierarchy
of
what
we
call
slaves
or
replicators.
So
that
means
that
any
application
that
needs
to
update
gates
and
a
space,
they
have
a
single
entry
point
for
writing
or
updating
data
right
and
then
that
sort
of
replicators
goes
out
in
through
the
replication
arity.
B
B
You
have
database
instances
like
with
Active
Directory,
where
they
might
be
geographically
dispersed.
Right,
like
there
might
be
a
domain
controller
in
in
this
office
here
in
North
Carolina.
There
might
be
one
in
Africa
one
out
in
Southeast
Asia,
and
we
want
to
sort
of
attain
eventual
consistency
between
these
systems,
but
latency
at
least
back
in
1999
might
have
been
in
hint
a
hindrance
for
for
attaining
consistency
within
a
time
limit.
B
That
would
allow
you
to
sort
of
take
advantage
of
the
updates
to
the
data
in
your
directory
and
so
the
the
way
Microsoft
sort
of
solved.
This
is
by
saying.
Ok,
we
have,
we
think
we've
come
up
with
a
consistent
model
that
will
allow
us
to
do
most
massive
replication,
and
what
this
means
is
that
you
can
talk
to
any
domain
controller
right.
B
If
we
forget
about
read
only
domain
controllers
for
a
second,
you
can't
talk
to
any
domain
controller,
make
any
change,
and
eventually
that
change
to
whatever
PC
stays
in
the
store
will
replicate
out
to
the
others,
even
though
other
people
might
be
making
changes
to
another
mastery
replica
somewhere
else.
So
this
is
a
super
hard.
So
the
distributed
computing
problem
and
the
solution
that
Microsoft
came
up
with
for
expertise,
essentially
pretty
pretty
elegant.
So.
B
Level
does
anyone
know
the
difference
between
attribute
values
and
link
value
as
Atsugi
flex
territory,
so
so
link
value
attribute
in
Active
Directory
are
things
like
direct
reports
and
manager
or
member
and
member
off
right?
So
we
remember,
the
member
of
the
group
is
most
valued
as
we're
on
on
a
group,
for
example
right
and
any
change
to
that
will
be
reflected
on
the
object
that
is
referenced
in
in
infinite
recruit
right.
B
A
B
Been
the
case
since
2003
prior
to
that,
like
the
entire
member
list,
would
be
replicated
to
all
domain
controllers
in
order
to
keep
track
of
all
this
like
having
this,
like
very
granular,
very
narrow
updates
in
multiple
replicas
of
this
most
massive
replication
setup,
each
domain
controller
or
each
BSA,
the
directory
service
agent
was
processed
that
runs
in
takes
care
of
replication
on
the
DC.
They
each
maintain
two
metadata
Kerr
link
or
per
attribute.
That
has
been
changed
for
every
object
in
the
directory
and
the
metadata
is.
B
B
Change
is
made
and
the
update
sequence
number
is
is
incremented
by
one,
but
you
have
sort
of
before
counting
accounting
of
all
the
changes
that
have
been
made
for
linked
values.
The
metadata
will
also
contain
the
last
addition
of
any
unique
relationship
or
the
last
solution
for
any
unique
link
value
relationship.
So
if
you
go
in
and
look
at,
if
you
use
something
like
partial
at
80,
replication
attribute
metadata
as
well.
If
you
use
this
against
an
object
at
a
specific
domain
controller,
it's
going
to
tell
you.
B
Let's
say
that
I
add
my
T
to
to
a
group
and
then
I
delete
this
membership
from
that
group.
Again,
if
you
check
the
metadata,
the
group
will
now
no
longer
have
myk's
myk's
identity,
never
list
right.
But
if
you
go
in
and
check
the
metadata,
it's
actually
going
to
reflect
that.
The
last
change
between.
A
B
T
and
this
group
was
that
his
entry
was
deleted
from
the
member
from
from
the
member
at
a
group,
and
so
for
someone
like
Gus,
you
know
digital
forensics
when
we
have
incidents
or
someone
trying
to
address.
This
is
super
interesting
right,
because
all
this
metadata,
it's
also
something
about
when
something
happened
that
might
no
longer
be
reflected
in
the
directory
data
itself.
Obviously
this
is
not
that
main
purpose.
The
main
purpose.
A
B
That's
not
enable
like
it
again.
This
metadata
exists
so
that
the
domain
controllers
can
keep
track
of
this
multi
master
replication
set
up
right,
so
the
metadata
is
always
there
and
you
don't.
You
don't
need
anything
special
to
to
discover
that
it's
sort
of
hidden
by
default,
but
like
there's,
nothing
stuck
recruiting.
B
So
if
you
have
a
look
at
something
like
get,
eighty
replication
attribute
metadata,
it's
going
to
ask
you
to
specify
an
object
so
that
could
be
user
account
or
group
or
something
like
that
and
then
a
specific
EC,
because
the
metadata
is
unique
per
DC
because
and
we'll
probably
get
to
that
in
the
in
the
next
slide.
All
right.
A
A
B
A
B
Oxidation
inspector
table
is,
is
this
index
of
USMS
per
database
in
the
entire
forest
right?
So
if,
in
a
forest,
you
have
ten
different
domain
controller,
ten
different
domain
controllers
and
they're
all
replicating,
you
know
five
database
positions,
there's
going
to
be
ten
times.
Five
USN
updates
in
each
of
the
up-to-date
data,
selector
tables
on
the
domain
controllers
right,
and
so
this
is
a
way
for
the
individual
domain
controller,
whether
to
be
able
to
track
have
I
seen
any
update
or
any
change
from
any
specific
domain
controller
in
a
specific
database
represent
right.
B
The
other
end
index
that
it
holds
is
the
high
watermark
table.
This
is
very
similar,
but
it
only
contains
the
last
the
last
maximum
update
sequence
number
four.
It's
direct
replication
partners
right.
So
if
you've
ever
opened
up
expiratory
sites
right,
you
can
configure
the
replication
topology
and
say,
like
a
the
main
controls
in
this
side
should
only
be
talking
to
domain
controllers
down
in
this
side.
Here
right.
B
A
A
B
Every
time,
every
time,
a
domain
controller
replicates
this
Delta
of
changes
that
that
it
gets
from
another
domain
controller,
each
replication
update
or
each
packet
of
updates
to
be
replicated.
It's
going
to
contain
the
update
value
right.
So
if
any
anything
has
been
updated,
what
was
added
to
this
model
value
attribute
or
what
is
the
new
name
of
this
object?.
B
Per
update
value,
it's
also
going
to
contain
something
called
the
invocation
ID
of
the
database
replica
in
which
the
update
originated
right.
So
the
invocation
ID
is
a
way
of
uniquely
identifying,
let's
say
the
default,
naming
conflicts
in
a
specific
database
replica
on
a
domain
controller
right.
So
if
I
have
mention
for
one
and
I
go
in
there
and
I
change
name,
let's
say
the
display
name
of
a
user
object.
For
example,
then.
A
B
Updates
that
eventually
ends
up
on.
You
know.
At
domain
controller,
three
sides
out
it's
going
to
contain
an
invitation
ID
specific
to
the
replica
on
dc1
and
then
obviously
the
information
about
about
the
value
change
itself
and
then
the
corresponding
user
and
the
corresponding
update
sequence
number
on
the
DC
holding
that
base
base
base
replica,
and
so
as
soon
as
it
promises
the
update.
It
uses
that
newest
end
value
to
go
back
to
its
up-to-date
Medford
table,
which
is
just
a
mapping
between
this
invocation.
B
I
do
that
I
have
inside
the
database
and
then
it
updates
with
the
last
mechanism
so
the
next
time
it
talks
to
another
replication
platter.
That
has
also
seen
this
update
event
from
you
know
some
DC
that
it
doesn't
talk
about
Richard
to
it's
going
to
be
able
to
set
up
a
chorus
update,
I'm
not
going
to
apply
there
again
right.
So
this
is
how
Active
Directory
keeps
track
of
consistency
across
you
know.
You
know
complex
of
the
replication
topologies
in
web
search
across
of
data
and
in
update
and
then
finally
to
replication.
B
Update
is
also
going
to
contain
the
new
maximum
use
and
for
the
replication
source
right.
So
the
direct
replication
pattern
that
is
talking
the
the
domain
controller,
that
I
asked
to
put
these
changes
or
that
it
refers
to
change
it
from
and
so
again
it
goes
back
and
updates
its
high
water
back
table,
and
so
this
this
way
it
knows
again,
you
so
have
a
new
offset
for
the
Delta
changes
that
we
need
to
replicate.
The
next
time
you
talk,
you
talk
to
them.
B
So,
okay,
maybe
maybe
a
little
life
wrenching,
if
you,
if
you
haven't
thought
or
looked
into
this
before,
but
this
is
so
cool
right-
and
this
is
this
is
like
this
is
the
core
Y
X
virtues,
so
it
just
seems
to
work
right
like
we
deploy
it.
We
use
it.
We
keep
integrating
applications,
onboarding
users
and
whatever,
unless
we
do
something
stupid
or
something
to
like
directly
unbind.
This
sort
of
just
works
right,
but
one
thing
I
want
to
mention
here
is
that
there's
sort
of
two
types.
B
This
is
an
oversimplification
again,
but
there's
sort
of
two
types
of
normal
replication.
What
we
call
interest
side,
replication,
so
domain
controllers
in
the
same
side,
talking
to
each
other
from
2008
or
2008
or
two
and
up
the
default
reputation.
Interval
is
15
seconds
plus
3.
That
is,
there
is
a
leader
in
each
side
that
says
I'm
going
to
wait.
B
15
seconds
before
I
notify
the
others
that
I
might
have
a
change
that
they
need
to
replicate,
and
then
it
waits
three
seconds
before
contacting
the
next
domain
controller
so
that
you
don't
sort
of
flood
every
both
your
neighbors
at
once
for
inter-site
replication,
that
is
between
sites
right.
You
have
site
a
you,
have
site,
B,
they're
cycling
between
them,
and
you
want
to
replicate
something
from
one
to
the
other.
B
B
And
so,
if
you
find
yourself
in
a
situation
where
you
have
where
you
see,
the
verification
is
show
slow
right,
like
someone
connects
an
application
and
it
connects
to
one
PC
and
they
get
a
different
result
than
the
other
easy
way
of
sort
of
countering.
This
is
by
enabling
change,
notifications
and
all
high
speeds
items
when
you
enable
this
thing,
called
change
notifications,
interest
at
replication
changes
so
that
it
starts
acting
like
in
facade
replication
instead.
So.
B
Of
every
15
minutes,
one
domain
controller
going
to
the
next
side
and
asking
you
haven't
changes
and
I
replicate
this.
Basically,
you
have
the
domain
controllers.
Every
time
they
update,
go
up
to
the
to
the
next
site
over
your
cycling
and
say
a
I
have
some
updates.
Please
pull,
and
as
soon
as
you
enable
change
notifications,
the
same
infrastructure
education
interval
is
going
to
apply.
This
can
be
changed
in
this
can
be
changed
in
the
registry
or
off
of
the
PCs
themselves.
As
soon
as
you
enable
change,
Manzano's
I
think
there's.
B
A
B
Religion,
so
if
there
is
no
changes
to
any
replicated
data
in
the
directory,
nothing,
it's
going
to
happen
right
and
so
the
next
time
it
changes.
Pers
it's
going
to
check.
Is
it
more
than
the
change
into
those
since
I
contacted
a
replication
partner?
If
it
is,
then
it's
just
going
to
notify
immediately.
If
it's
you
know,
12
seconds
to
go
and
the
the
interval
is
15
seconds,
it's
going
to
wait
3
seconds
and
then
it's
going
to
send
a
notice
in.
A
B
Yes,
that
would
be
appreciated
addition,
and
so
this
is
a
screenshot
from
2008
box,
the
basically
you
can
see
here,
here's
a
site
length
between
two
sides
Texas
and
in
Canberra
this
example
here
from
the
blog
post
I
referenced
before
we
probably
want
to
check
the
connectivity,
or
at
least
at
the
time,
because
Canberra
and
Australia's
is
pretty
far
away.
But
if
you
say
yeah,
you
know
what
the
internet
in
Australia's
slow,
but
it's
not
that
slow
and
we
don't
have
that.
Many
changes.
The
next
very
probably
go
ahead
and
enable
change
notifications.
B
When
you
go
down
to
the
site
link,
there's
going
to
be
an
options
attribute,
as
you
can
see
out
on
the
right
you
need
to
set.
This
is
a
binary
reflector,
so
you
need
to
set
it
to
if
it's
not
that
you
just
set
it
to
a
value
of
one,
but
otherwise
you
flip
your
flip
in
one
and
then
it's
going
to
show
you
use
as
the
notify
all
right
when,
when
Mike
published,
that
was
going
to
be
here,
talk
about
ribbon,
I,
think
Ashley,
magloan
commented
and
I
said
right.
Oh.
A
B
Here
you
can
see,
for
example,
I
was
talking
about
before
Reb
admin,
/
show
obj
meta
or
like
getting
method.
I
saw
right.
You
can
see
that
corresponds
to
the
the
command.
Now
is
talking
about
get
ad
replication
attribute
metadata,
and
is
there
there's
a
bunch
more
of
these
one
that,
like
I've,
seen
the
term
added
name
but
I'd
never
made
the
connection
and
I
just
realized
it
when
he
posted
this?
Is
that
Reb
admin
rebels
single
object?
So
you
can
replicate
a
single
object
rather
than
all.
B
If
you
want
the
day
to
that
right,
but
the
idea
behind
the
ad
recycle
bin
is
that
you
sort
of
get
a
grace
period
in
which
you
can
decide
to
sort
of
reanimate
at
deleted,
object
back
to
sort
of
full
state
right
or
most
effectively,
and
so
this
would
be
super
useful.
Like
you,
you
delete
something
and
all
of
a
sudden,
you
realize.
Oh
no,
we
are
not
actually
ready
to
decommission
whatever
application,
we're
relying
on
that
until
next
week,
so
it
would
be
nice
to
sort
of
have
a
recycle
bin.
B
A
B
Was
working
at
a
working
at
this
big
company
that
that
did
IT,
outsourcing
and
I
was
working
in
their
ops
department
right,
so
I
was
sort
of
third
level.
This
happened
for
a
you
know,
last
ray
of
enterprise
customers
and
everyone
else
was
at
lunch,
sort
of
just
me
and
two
other
guys,
and
then
a
project
manager
who
doesn't
have
anything
to
do
with
the
ops
department.
Sort
of
it
comes
down
to
her
floor
and
we
all
sort
of
weird-
and
you
have
this
terrible
expression
on
his
face.
A
little
bit
like
this
guy.
A
A
B
Anything
about
Active
Directory
and
he
sort
of
nervous
like
we
need
some
help
upstairs.
Okay,
I
know
a
little
bit
about
exit.
Very
free
I.
Think
I
visit
the
job
for
like
this
is
my
first
system
a
gig
and
I've
been
in
it
for
like
a
year.
Maybe
I
was
not
super
comfortable
with
that
coverage
of
blue
shirt
under
so
I
go
upstairs
and
we
sorta
ask
what
is
the
problem
right
and
so
what
they've
had
reported
sort
of
via.
A
A
B
They
started
seeing
sort
of
like
around
lunch
an
hour
an
hour
earlier.
Is
that
a
bunch
of
people
working
these
POS
systems,
all
of
a
sudden
like
they
would
lock
the
machine
and
then
also
they
couldn't
log
in
anymore,
and
it's
almost
like
extraverted
didn't
recognize
the
reducers
or
something
they
also
started
getting
like
other
weird
various
things
like
subsystems
in
the
machine
like
failing
in
group
ways,
and
we
were,
we
were
sort
of
just
this
acceptance
right
like
we
didn't,
have
hands-on
support.
B
We
didn't
own
their
help
this
for
anything,
and
our
customer
was
not
even
the
user
of
the
POS
systems
right.
So
there's
a
lot
of
sort
of
like
a
supply
chain
of
connections
in
between,
and
so
what
had
happened
was
that
the
first
line
help
disk
at
another
company
had
seen
all
these
errors.
They
were
started
getting
this
report
and
as
any
good,
you
know
sort
of
like
health
care.
They
had.
A
B
The
Machine
come
online
again
and
before
you
can
even
attempt
to
login
to
the
domain,
it
says
the
trust
relationship
between
this
workstation
primary
domains
failed.
Okay,
that's
not
a
good
thing
right,
because
it's
the
computer
and
the
domain
controller
can't
figure
out
how
to
talk
together,
then
you're
sure,
as
hell
not
going
to
get
any
users
logged
on
user
right.
So
at
some
point
they
realized.
This
is
pretty
bad
right
and
they
started
seeing
a
pattern
every
time.
B
Someone
was
that
reboot
like
this
happen,
so
they
sort
of
sort
of
stop
and
say
like
I'll,
let
you
touch
any
computers
and
so
that's
when
they
escalated
to
us
and
the
guy
who
takes
office
he's
not
a
nob
sky,
but
he
was
the
last
person
to
work
on
a
project
connected
to
this
set
up,
and
so
we
sort
of
we
get
hold
of
this
of
the
company.
We
asked
like
how
many
desktops
are
drawn
to
this
domain
in
this
era.
A
B
To
nine
thousand,
you
know
POS
endpoints
and
when
we
sort
of
when
we
sort
of
browse
with
expiratory
users
and
computers
or
des
query,
or
something
like
that,
we're
only
seeing
like
three
thousand
computer
objects.
This
also
a
weird
right,
like
that's
a
pretty
significant
discrepancy
right
and
it
sort
of
makes
sense
that,
like
you,
see,
sort
of
this
right
is
five
thousand
machines,
just
discipline
off
the
line
right
right,
and
so
we
look
a
little
more
disgusting
in
the
DC
system
event
log,
the
account
for
the
computer
was
not
found
at
the
Sam
database.
B
We
stopped
searching
for
yeah
as
I
said,
computer
objects
by
name,
and
you
search
and
capture,
recall
and
say,
like
give
us
the
host
name
with
this
machine
right.
We
wanted
like
take
a
look
at
one
of
these
samples
and
the
search
returns
no
results,
so
we
changed
main
controller
to
there
was
only
2,
2
DC's
in
this
setup,
so
I
change,
the
others
Mexico
and
all
sudden.
Some
of
these
host
names
return
results
right.
So
on
one
domain
controller,
most
of
it
is
gone
on
the
other
domain
controllers.
Some
of
it
is
gone.
B
B
So
someone
happy'
idea
to
fire
up
LEP,
and
so
we
try
to
see
if
we
can
discover
any
of
these
deleted
objects.
Sort
of
validate
this.
This
theory
that
someone
might
even
accidentally
or
some
process
or
a
piece
of
software
have
accidentally
to
lead
it
all
of
these
computer
reviews
and
sure
enough.
The
domain
contains
roughly
5,000
Deleuze
computer
objects.
B
B
So
at
this
point
the
project
manager
is
like
screaming
at
everyone
because
he's
afraid
that
we're
going
to
have
to
like
pay
a
big
fine
to
these
people
for
what's
going
on,
the
engineering
manager
starts
yelling
at
this
guy
who
click
on
anything
right
and
the
CEO
role
comes
in
and
yells
at
all
of
us
for
not
really
finding
a
solution
to
this
right.
It's
like
it's,
not
a
very
nice
environment
to
be
so
me.
B
Guy
who
are
like
helping
out
looking
at
this,
we
sort
of
just
take
on
our
headphones,
which
is
like
okay.
What
else
can
we
find
out?
So
we
dig
into
it
and
remember
this.
This
commands
on
up
here
get
ad
replication
attribute
metadata
right,
so
read
battling
to
do
that
so
I
like
this
is
this
is
one-to-one
mapping
with
the
show
OBG
meta
command,
and
so
what
we
do
is
we
run
web
admin
show
obg
metha
target.
B
You
won
the
domain
controller
where
everything
or
where
most
of
the
object
seems
to
have
been
deleted
from,
and
then
we
don't
actually
put
in
the
DN,
because
in
pre
2008
r2
Active
Directory,
when
a
computer
is
when
a
computer
is
deleted,
its
renamed
to
like
its
object,
rated
and
then
like
put
and
put
in
add
list
object
container,
so
we
figure
out
like
at
the
end
of
one
of
these.
We
throw
it
into
rep
admin,
and
we
see
something
really
strange.
B
It's
deleted
this
property
that
controls
whether
an
object
in
like
your
contacts,
periphery
has
been
tombstoned
or
not.
We
use
the.
We
use
the
method,
as
you
see
like
when
it
was
updated,
like
we
know
that
it's
been
updated
right.
We
know
that
if
delete,
it
has
been
said.
Otherwise
this
wouldn't
be
treated
as
leader
objects,
but
we
don't
know
when
and
sure
enough.
It
was
last
changed
like
a
month
ago
it
was
using
cash.
Maybe
we
can't
really
like.
B
None
of
us
can
really
like
explain
what's
going
on
here
at
this
point,
like
the
only
thing
we
knew
is
that
before
launch,
those
machines
were
definitely
not
deleted
right
because,
like
everything
worked
just
fine,
but
now,
apparently
their
deletion
has,
you
know
traveled
from
the
past,
and
somehow
you
know
rhetoric
actively
a
platter
failed,
and
so
what
gives
alright?
So
it's
back
the
guy
again
sure
you
did
not
believe
it
did
not
do
anything.
Ok,
let's!
Let's
try
this
a
different
walk
us
through
what
happens
before
lunch.
B
This
is
a
non
accusatory
version
of
trying
to
get
get
some
more
more
details.
Out
of
this
guy
he's
like
well,
I
was
demoting
vco2
in
the
test
environment,
the
test
environment.
What
good
food
it
failed
because
could
not
contact
DCO
one.
Ok,
but
DC
or
DC,
oh
one
at
least
the
one
in
the
test
environment
was
replaced
weeks
ago.
So
what
what
do
you
mean
replace
like
yeah?
We
stood
up
another
domain
controller
and
then
we
removed
the
DC
one.
So.
A
B
You
know
production
had
a
DC
o1,
so
I
requested
a
firewall
opening,
so
he
request
one
of
our
network
admins
to
open
up
for
TCP
3
3
at
9:00
across
these
two
environments
and
so
yeah
I
added
the
dcs
2dn
to
the
host
file
right.
The
IP
address
and
I
demoted
it
again
and
didn't
work
I'd.
Like
me,
he
noticed
that
it
took
a
little
longer
than
usual.
Right
like
it
was.
B
A
B
A
B
The
production
environment
associate
was
super
simple.
It
consisted
of
two
domain
controllers,
both
running
Windows
Windows,
Server
2008.
The
schema
version
is,
is
2008,
vanilla,
the
DFL
in
FL,
all
2008
right,
I.
Think
at
this
point
we
split
them
into
two
separate
sites
because
they
were
using
sites
for
load
balancing
of
whatever,
but
otherwise
super
center
line.
So
at
some
point
the
customer
requests
a
schema
prep
for
an
upgrade
to
2008,
r2
right
and
so
I'm.
Just
going
to
note,
like
the
the
imagined
forest,
distinguished
name
or
domain
distinguished
name
there.
B
A
B
A
B
You've
ever
looked
into
virtualizing
domain
controllers,
the
very
first
thing
microsoft's
going
to
tell
you
is:
don't
clone
your
domain
controllers
and
the
reason
you
shouldn't
clone
your
domain
controllers
has
something
to
do
with
that
invocation.
Id
thing
that
we're
talking
about
before,
and
so
you
might
know
that
for
vm's
running
I
think
it's
2012
r2.
If
you
have
a
generation
2
VM
on
hyper-v,
you
can
actually
set
something
called
VM
generation.
A
A
B
Going
to
do
is
it's
going
to
set
something
in
the
guest
services
plug-in
on
the
machine
and
that
machine
is
then
going
to
pick
that
up
when
it
reboots
and
say
oh
I
should
throw
B
regenerate
all
of
my
invocation
IDs
if
I'm
a
domain
controller.
So
we'll
get
back
to
why
that's
pretty
important
when
you
start
filling
your
domain
controllers,
so.
A
A
B
The
production
environment,
ok,
so
the
next
thing
they
do
is
they
decide
to
clean
up
a
little
bit
because
they
don't
need
nine
thousand
accounts
test
against
in
the
in
the
reference
environment
right
they
only
need
a
few
thousand
and
so
what
they
do.
They
take
some
of
their
Windows
7
or
Windows
system
test
machines,
virtualized
them
as
well.
So
they
can,
you
know,
retain
the
relationship
in
this
in
the
test
environment.
B
So,
ok,
the
only
thing
that's
sort
of
been
going
on
in
this
reference
clone
over
here
is
that
we've
deleted
around
five
six
thousand
objects,
and
so
the
next
thing
that
happens
as
part
of
this
test
is
we
stand
up
and
promote
s
third
domain
controller
running
2008
r2,
and
this
is
extremely
important
at
2008,
2008
r2.
Is
there
a
difference?
I
tell
you
there's
a
difference,
especially
when
it
comes
to
expiratory,
ok,
so
so
far,
so
good,
the
upgrade
sees
they're,
not
seeing
anything
weird
in
their
test
reference
environment
right.
B
A
B
A
A
A
B
B
A
B
B
That
changes
to
the
main
controller
DC
do
too
returned
some
results
right,
because
some
of
these
computer
objects
were
in
there,
okay.
So
what
a
disaster?
This
calls
for
disaster
recovery
right
technically.
This
was
not
a
use
and
roll
back
I!
Don't
don't
know
if
you,
if
you've
heard
that
the
term
it
was
more
like
a
u.s.
B
A
B
A
A
B
You
sort
of
propagate
out
all
the
changes
that
you've
just
restored,
so
this
is
this
is
sort
of
a
normal
disaster
recovery
procedure
in
in
Ex
territory.
Nothing
there.
We
did
that,
but
we
only
did
it
for
the
default
naming
context
which
sort
of
bit
us
a
little
bit.
We
had
to
go
back
and
like
do
the
same
thing
for
the
DNS
positions,
but.
B
Seems
to
work
right,
and
so
the
authoritative
resource,
C,
D
co2
replicates
all
this
restored
data.
I
should
say
at
this
point:
we've
like
completely
shut
off
just
reference
testing
around
like
no
more
dead.
Please
and
you
have
to
date
it
detector
values
on
both
of
them
are
in
sync.
We
still
have
some
weird
entries
on
e
co
2
in
the
up
dead,
Davis
vector
table,
but
it
doesn't
matter
right,
like
you
know,
this.
B
Grid
from
like
the
Edit
DC
in
the
reference
environment
is
never
going
to
see
that
again,
so
this
is
just
like
state
explained
and
the
client
machines
can
log
in
again
right
like
this,
is
sort
of
sort
of
what
we
were
trying
to
solve
in
the
first
place.
So
we
we
all
decided
okay
well
done.
We
got
this
so.
B
A
B
A
B
So
what
they've
been
trying
to
do
is
in
the
meantime,
they
start
like
a
proper
test
set
up
without
showing
in
domain
controllers,
they've
run
through
their
test.
It
verifies
that
all
the
applications
will
work
with
forest
functional
level,
2008,
r2
and
they're
ready
to
move
ahead
with
doing
the
same
operating
in
production
right,
and
so
they
start
doing
this
upgrade
in
production.
B
So
they
do
the
exact
same
thing
in
production
they
set
up
a
new
ec
o
3
on
2008
r2
and
they
promoted
to
a
domain
controller
and
then
in
anything
connecting
to
D,
Co,
3
sort
of
fails,
miserably
again
sort
of
not
necessarily
the
same
thing
but
like
the
same
weird
error.
Messages
that
don't
contextual
II
make
any
sense
that
we
sort
of
saw
during
the
first
incident.
B
A
B
Everything
still
works
in
the
old
2008
domain
controllers,
like
all
the
data
is
there
in
computer
connecting
plugin
it.
Everything
is
fine
right,
but
a
DC
o3
want
to
just
that
initial
represent
easy,
promo
right.
You
know
you
need
to
wait
to
the
north
replication
platter,
so
you
can
get
in
order
like
build
the
database
basically,
and
so
like
it's
almost
as
if,
during
that
process,
two-thirds
of
all
the
objects
and
directories
sort
of
vanish
into
a
magical
vacuum
cleaner
inside
the
DSA.
A
B
B
Asked
me
they
asked
me
to
have
a
look
at
this,
because
I've
sort
of
become
more
intimately
familiar
with
expert
in
first
place
sort
of
spurred
on
by
this
engine,
and
it's
like
I
need
to
know
more
about
this
and
I
need
to
know
more
about
what
is
this
so
having
sort
of
attained?
It's
not
an
expert,
then
at
least
sort
of
a
subject,
subject
matter
expertise
for
certain
things:
the
next
director
they
asked
me.
You
maybe
take
a
look.
Look
at
this
like
yeah,
okay,
we
have
a
look.
B
It
takes
a
while
there's
a
little
bit
of
time
pressure,
but
it's
not
like
it's
not
like
an
incident
right,
but
after
a
couple
weeks,
I
sit
down
and
say
you
know
what
I'm
going
to
take
a
sample
set
of
some
of
the
objects
that
seemed
to
work
right.
The
computer
objects
that
are
correctly
replicated
on
the
new
on
the
new
DC
and
then
a
sample
set
of
the
computer
objects
that
seemed
to
just
vanish
right.
A
B
Called
it's
recycled,
the
system
Oni
attribute
is
set
to
one
every
single
object
that
seems
to
vanish
into
thin
air
every
time.
Vco
three
tries
to
replicate
them
so
start
googling
and
start
looking
around
what
you
know
what
is
resizing.
Maybe
it
has
something
to
do
with
that:
recycle
bin
feature
and
some.
B
This
is
I
think
this
is
probably
the
best
way
of
showing
it.
This
is
from
the
block
of
sweet
directory
services,
MVP
Christopher,
Anderson
and
basically
the
way
that
this
transition
from
an
expiratory
at
forest
function
of
2008
and
with
2008
main
controllers
that
do
not
support
the
recycle
bin
to
a
system
that
does
support
this
intermediary
state
of
an
object
right
where
it's
deleted,
but
not
quite
needed,
and
so
I
think
this.
This
graphics
other
shows
that
pretty
pretty
nice
in
blue,
you
have
sort
of
the
pre
Windows
2008
r2
boxes
right.
B
B
B
B
What
happens
instead
is
that
when
you
introduce
the
first
2008
r2
order
and
it
starts
replicating
everything,
it
is
going
to
take
a
look
at
every
single
tombstone
that
already
exists.
That
is
every
single
object
with
is
deleted
set,
and
then
it's
going
to
set
its
recycled
as
well,
because
in
this
in-between
state
they
mean
the
exact
same
thing.
This
updates
soon
stone
and
so
for
both
the
newer.
The
order
to
make
installers
to
be
able
to
recognize
that
this
object
is
tombstone,
and
this
object
is
deleted
for
good.
B
A
B
A
A
B
A
B
B
A
B
Objects
that
were
actually
processed
correctly
and
have
said
this
recycled
and
also
someone
sets
that
on
all
the
copies
of
its
own
objects,
because
the
schemas
of
course
is
recycle,
even
though
it
doesn't
know
what
to
do
with
it
rises
just
done
the
data
change
I
update
for
now.
This
is
obviously
not
a
problem
yet
up
until
the
point
where
we
introduce
a
new
2008
r2
domain
controller
right,
because
up
until
now
there
have
been
two
after
we
do
this
email,
crater,
2008
or
two
right.
There
are
two
supported
states
for
two
supported
configurations.
B
Except
is
recycle,
it's
not
set
or
set
to
non
non
one
value
right.
On
the
left
hand,
side
you
see
how
a
2008,
er
2003
box
would
interpret
that
okay,
that's
it
some
stone.
That's
related
object,
not
I'm,
just
going
to
track
that.
So
until
the
tubes
on
a
lifetime
runs
up
on
the
right-hand
side,
you
see
the
you
see,
sort
of
the
2008
or
to
a
newer
interpretation
of
the
same
situation.
It
pleaded
its
leaders
this
set
and
is
recycled.
B
A
B
Still
so
2008
means
it's
a
tombstone
and
to
2008
r2
domain
controller
inure.
It
means
that
the
object
is
recycle,
recycle.
It
does
not
mean
that
it
has
been
reanimated.
It
means
that
it's
in
the
same
state
as
a
tombstone
right
it
can
no
longer
be
reanimated.
It's
been
no
after
the
garbage
disposal.
So
this
is
all
fine
right.
But
now
we've
inadvertently
introduced
an
unsupported
configuration
in
which
a
2008
domain
controller
will
see.
This
is
recycling
not
pay
any
attention
to
it,
because
it
does
not
know
what
it
is.
It
just
checks
its
leaves.
B
B
Odd
I'm
going
to
treat
that
as
deleted
object,
I'm,
not
even
gonna,
bother
right
like
this
is
a
tombstone
off
to
the
infrastructure
master.
It
does
not
update
its
lead
it
because
there's
no
code
in
the
BSA
that
checks
for
this
sort
of
thing,
because
if
you
were
doing
things
correctly,
no
domain
controller
can
actually
update
an
update
like
there's
no.
A
B
I
support
that
it's
like
export
directory
configuration
will
would
end
up
with
an
object
in
this
state,
so
Microsoft
does
not
take
it
into
account,
because
that
does
not
make
any
sense
right.
So
now,
I
mean
in
a
situation
where
I
have
these
these
weird
objects,
I,
don't
know
what
to
do
with
them.
We
can't
move
forward
with
you
upgrades
they
can't
get
their
ad
resided
bin.
Maybe
the
ad
recycle
bin
would
have
would
have
helped
us.
We.
B
This
is
not
me,
this
is
not
the
project
manager
I'm
starting
to
get
pretty
nervous,
Scott
right,
and
so
we
had
a.
We
had
a
premium
support
contract
with
Microsoft
and
so
had
12
hello
Microsoft
help
fix
please
and
there's
a
bunch
of
emails
in
a
bunch
of
calls
back
and
forth.
They
have
a
look
at
the
environment.
It
takes
a
couple
of
weeks
and
fights
to
get
back
and
I'll,
never
remember
what
they
said
in
that
floating
call.
You
seem
to
have
left
your
directory
in
an
unsupported
State.
We
can't
help
you.
B
Only
the
only
possible
solution,
according
to
Microsoft
premier
support,
was
we're
just
going
to
have
to
delete
like
properly
delete
of
all
the
objects
that
are
affected
by
this
issue,
recreate
them
again
again
since
the
the
majority
of
the
majority
of
objects
affected.
By
this,
we
could
reroll
out
all
the
users
and
like
they
had
some
password
management
and
user
management
so
like
we
could
sort
of
we
sort
of
do
that.
B
The
big
problem
was
that
we
needed
to
enjoin
delete
and
rejoin
all
the
domain
members
right
all
these
Windows
Vista
Windows,
7,
Windows,
XP
machines
and
again
more
than
three
thousand
machines
were
affected.
There
spread
over
like
five
hundred
physical
locations
in
you
know
not
the
smallest
European
country.
It
was
limited
on-site
tech
support
right,
there's
not
like
help
this
guy
in
every
single
store.
Yes,
the
desktop
management
software
that
they're
they're
using
couldn't
really
be
automated
for
this
task
right,
there's,
not
nothing
built
into
sort
of
like
drawn
and
rejoin
and
the
biggest
problem.
B
With
this,
when
we
started
like
running
these
steps
were
said,
it
was
super
time-consuming
because,
if
you've
ever
gone
in
to
like
rename
my
computer
and
do
like
on
join
the
domain,
the
first
thing
it's
going
to
pop
up
with
is
a
modal.
This
is
like
you
will
need
to
reboot
your
machine
for
this
to
take
effect.
Would
you
like
to
remove
your
machine?
It's
a
really
good
way
to
the
machine
to
come
up
now.
B
This
is
going
to
be
extremely
time
consuming
if
we're
going
to
do
this
in
5000
or
500
discs
locations
for
for,
like
a
number,
so
I
are
sort
of
looking
at
this
and
like
it
must
be
some
way
of
doing
this
programmatically
and
sure
enough.
There
is
a
way
of
doing
this
programmatically
the
win32,
a
computer
system
class,
which
I
suspect
this
is
what
the
renamed
computer
prompt
actually
calls
in.
The
background
exposes
two
methods:
one
called
join
domain
or
workgroup,
and
one
called
undo
andaman
or
workgroup.
The
nice.
A
B
Is
that
this
model
that
says,
you
need
to
reboot
your
machine
in
order
for
this
to
take
effect?
It's
not
hinged
on
W
mind.
This
is
something
that
the
window
shell
UI,
has
built
in
this
control.
Right
and
so
I
started
testing
this,
and
it
turns
out
that
you
can
enjoin
a
machine
join
it
again
with
a
new
name,
for
example,
reboot
the
machine
in
one
go
and
it
actually
works.
So
we.
A
B
This
20
times
Vista
Windows,
XP
and
seven,
and
it's
simple
sort
of
work.
So
the
solution
we
ended
up
coming
up
with-
and
this
was
sort
of
like
my
baptism
by
fire
using
partial
scale.
You
know
I've
been
doing
a
couple.
I've
been
doing
subscripts
to
like
nothing
like
this
before
right.
So
the
the
solution
we
ended
up
with
was
we
create
a
new
two
modules
were
to
join,
create
delete
new
computer
objects
in
in
the
computer.
So
you
we.
A
B
Group
policy
in
the
existing
machines
to
push
up
a
new
local
admin
user.
We
stopped
advertising
LDAP
and
caerbae
service
records
in
DNS
for
DC,
o2
and
I'll
get
to
either
this
in
a
second.
So
at
this
point
the
clients,
if
they
run
for
like
a
day
or
two,
they
will
always
end
up
hitting
ezo
one,
because
when
they
do
get
a
state
service
discovery
DCO
one
at
the
only
way.
It's
the
only
one
that
has
the
services
available
right.
So.
A
B
Couple
dates:
after
making
this
change
with
PowerShell
I
wrote
like
a
long
script.
That
per
machine
would
set
the
connections
to
fine,
except
we
locally
login
with
the
local
admin,
just
to
make
sure
that
we
so
have
foothold
on
the
machine
right.
Then
we
remote
call
to
unjoin
the
mix
domain
or
workgroup.
B
Now
the
big
problem
comes
because-
and
this
is
sort
of
why
I
stopped
advertising
el7
care,
be
sorry
Rachel,
because
I
wanted
to
make
sure
that
they
hit
a
specific
domain
controller,
so
that
I
could
recall
that
so
that
I
could
predict,
which
other
domain
controller
needed
to
replicate.
This
deletion
I
needed
to
replicate
this
change,
and
so.
A
B
Web
admin
gives
the
rebel
single
objects
targets
source
and
then
the
last
value
down
here.
Normally
you
put
a
distinguished
name
right.
You
put
like
the
distinguished
name
of
the
object
that
we
want
to
replicate,
but
given
that
we,
given
that
the
replication
intimate
well
may
have
lapsed
in
between
me
calling
on
drone
and
then
going
back
to
replicate
the
mission,
I,
don't
actually
know
the
efforts.
I,
don't
know
the
distinguished
name
of
lead,
control
of
you
or
I
can't
guarantee,
at
least
at
the
time
of
solution
right.
B
So,
instead
of
throwing
a
bunch
of
errors,
it's
about
that
when
you
need
a
distinguished
name,
you
can
actually
use
a
number
of
values.
You
can
use
the
object
with
an
object
to
address
a
distinguished
object
in
the
directory,
just
as
if
you
have
been
using
the
DM,
you
can
also
for
security
principles,
use
the
security
identifier.
So
if
down
here
you
do
enter
brackets
s
ID
and
then,
like
the
actual
security
identifier
string,
that's
going
to
address,
we
don't
watch
it
whatever
principle
actually
has
it
so.
B
You're
doing
like
resolution
of
users
based
on
a
status
I
read
like
your
enumerated.
Let's
say:
I'm
like
an
ACL
and
not
be
at
the
main
member
of
machine
and
for
some
reason
like
this,
it
API
is
not
working
slide.
Well,
you
can
just
look
up
the
next
third
like
which
object
does
this
should
actually
first
want
to
so
use
this
trick
with
the
object
grid
like
I?
Could
I
could
fetch
that
beforehand?
To
say,
like?
B
Please
replicate
the
deletion
of
this
object,
regardless
of
whether
it's
already
happening
on
once
I've
done
that
the
same
account
name
is
no
longer
induced
and
we
can
rejoin
the
Machine
with
the
same
name.
This
is
sort
of
another
complicating
factor,
because
there
are
distant
management.
Software
would
like
blow
up
in
the
POS
system
would
stop
working
for
some
reason
they
relied
on
the
hosting
right.
So
once
that's
150
confirmed
we
again
remotely
call
join
the
main
or
workgroup.
B
The
corn
itself
is
sophisticated
with
the
local
admin
user
they
yes
before,
and
then
you
pass
the
credentials
for
the
non
remaineth
and
domain
user
that
we
created
in
the
first
step
to
recreate
all
the
these
machines
and
then
finally,
the
script
does
you
know
down
em
computer
name
whatever
or
or
sim
lock?
Also
WI
akin
remember
so
the
real
solution
ends
up
being
sort
of
250
300
lines
of
very
awesome.
Powershell
again,
this
is
eight
years
ago,
I'm
pretty
sure
I'd
be
appalled
if
I
ever
sold
it
again.
A
B
B
This
up
so
yeah
I
managed
to
do
this
for
almost
3,000
computer
accounts,
with
this
WMI
driven
partial
horror,
horror,
script
and
ended
up
actually
competing
like
from
when
we
decided
on
the
solution
to
actually
executing
it
less
than
50
hours
like
again.
This
is
just
myself
right,
but
less
than
50
hours,
all
from
the
comfort
of
the
office
rather
than
having
to
go
to
another
country
and
do.
B
A
B
Look
it
up
and
post
it,
but
yeah.
This
is
like
a
supported
feature
next
directory,
you
can
take
a
single
domain
controller
and
it
doesn't
have
to
be
everything
right.
You
can
say,
like
you
know
what
this
guy
this
guy
over
here,
is
only
for
authentication
purposes,
he's
not
going
to
advertise
our
example.
Okay,.
A
A
B
A
B
B
A
B
In
row
it's
a
great
question,
and
this
is
the
first
thing:
I
ask
Microsoft
little
bit,
you
know
they
said
you
know
we're
not
going
to
touch
this
with
football
and
I
said.
Well,
maybe
we
can
do
it
ourselves
like
yeah.
Is
there
a
way
we
can
just
update
these
values
and
they
looked
at
it
and
they
said
no,
because
by
design
is
reassignment
and
it's
deleted.
B
If
you
go
and
look
at
the
attribute,
schema
entries
in
your
in
your
schema
partition
you're
going
to
see
that
they
have
the
system
only
flag
set
and
when
the
system
only
flag
is
set
for
an
attribute.
That
means
that
only
the
DSA
can
write
to
that
attribute.
So
there's,
no
you
know,
I
could
I
could
have
provided
an
LDS
and
uploaded
that
right
and
so
like
do
these
changes,
but
they
would
have
been
rejected
like
again,
it's
unsupported
flipping
these,
which
is
also
why
Microsoft
never
expected
this
to
happen
right.
A
B
A
A
B
A
B
But
we
have
customers
that
have
you
know
thirty
application
servers
and
there
plenty
if
there
are
plenty
of
sort
of
like
maintenance,
documentation,
there's
like
RDP
into
server.
One
now
repeat
for
two
through
twenty
nine
and
obvious
as
a
huge,
huge
sort
of
waste
waste
of
time,
energy
money,
whatever
right,
and
so
this
also
sort
of
opened
my
eyes
to
doing
things
like
I.
Think.
B
Scale
so
a
web
server
management
with
IAF
and
okay,
they
have
no
certificate
provider.
We
need
to
like
prep
it
with
like
a
new
route
CA
or
something
like
that's
like
there's
no
way
I'm
going
to
log
on
to
you
know.
Thirty
servers
hope
you
know
surf
manager
MSC,
oh,
no,
that
doesn't
work
I
need
it
for
the
computer
count
like
so
many
clicks
right
and
now
I've
only
done
it
for
one
machine
and
I've
already
wasted
ten
minutes
right
now.
B
I
have
to
do
twenty
one,
there's
twenty
nine
more
times,
or
you
figure
out
that
there's
a
net
API
that
that
wraps
access
to
the
certificate
store
with
which
you
can
push
public
key
certificates,
and
so
you
just
sort
of
you
do
that
in
a
script
right
and
then
you
just
need
to
feed
it
into
profile
with
30
host
names,
and
congratulations
right.
So
this
like
this,
the
experience
for
list
or
really
open
my
eyes
to
this,
and
so
it
also
kind
of
propelled
my
own
interest
in
using
using
partial
scaling.
Absolutely
you.
A
B
A
B
A
A
B
B
A
A
A
B
A
A
B
Number
I
think
sort
of
like
the
first
incident
I'd
like
the
original
incident
when
we
sort
of
resolved
or
thought
we
had
resolved
that
right.
We
had
been
working
on
this
we're
like
10
hours
straight
and
it
was
like
well
past
midnight
and
keeper
were
sort
of
like
having
a
beer
in
the
co-ceo
surface
and
like
this
and
then,
when
all
of
this
hit
me
right
and
I,
had
this
Epiphany,
it's
like.
B
A
A
B
By
the
end
of
resolving
it
right
like
where
we
are
right
here,
it
was
just
me
in
the
office
right,
like
11:00,
on
a
Tuesday
and
so
like
so
there's
a
sort
of
opened
a
bottle
of
champagne
for
myself,
but
it
felt
sort
of
a
bit
flat.
They
compared
to
the
original
thing,
but
I
like
the
the
customer
itself
right,
like
they're.
Trying
to
welcoming
this
salt
is
onto
another
company.
They
were.
B
They
thought
that
they
either
had
to
rebuild
their
entire
environment
from
scratch
or
go
through
this
process
of,
like
figuring
out
how
to
hire
someone
to
go
on,
like
reboot
3,000
machines
all
over
like
a
geographical
area
right
so
with
that
in
mind,
boss,
coming
back
and
saying
like
there's
a
chance,
this
might
work
and
then,
if
we
had
computed
this
over
a
couple
weeks
and
then
coming
back
and
saying
like
yeah,
you
know
we
actually,
we
actually
worked
it
out.
I
think
they
were.
They
were
pretty
happy
and
pretty
impressed
with
him
did.
B
A
A
B
B
A
B
Like
again,
sort
of
like
you
back
to
the
baby,
I
was
showing
before
I,
like
I
sort
of
had
that,
like
profound,
you
know,
moment
of,
but
first
having
figured
it
out
right
like
having
realised
something
new
that
I
didn't
think
possible
and
then
again
after
actually
having
solved
after
actually
having
run
the
last
batch
of
the
script
and
in
fixing
these
machines.
It's
like,
we
really
did
it.
You
know,
Microsoft
said
it
couldn't
be
done
and
we
did
it
read,
did.
B
We
did
we
actually
not
directly
through
our
support
contract,
but
we
ended
up
contacting
our
Technical
Account
Manager
at
the
time
and
saying
like
okay,
we
know
that
you
don't
want
to
solve
this.
We
know
that
you
don't
want
to
commit.
You
know,
for
whatever
support
liability
reasons
you
have
you
don't
want
to
commit
to
this
being
we're
on
the
ride.
I
just
need
someone
who,
like
you
know,
go
through
this
plan,
have
a
look
at
like
the
the
script
or
what
we're
trying
to
do
and
then
just
say
like
yeah.
B
This
is
a
terrible
idea
or
not
say
anything
right
like
you,
don't
have
to
commit
to
saying
like
yeah.
This
is
Microsoft
support
solution.
I
just
wanted
you
to
like
tell
me
if
this
is
a
really
bad
idea
and
they
basically
came
back
and
said
like
and
so
like.
That
was
where
we
got
from
Microsoft
and
we
fed.
A
B
A
B
B
Not
supposed
to
be
getting
into
that
state
right
and
like
the
the
support,
the
support
center
would
be
the
same.
Would
this
happen
next
week
to
another,
even
bigger,
bigger,
to
find
right
like
yeah?
No
too
bad?
You
need
to
get
yourself
out
of
this,
because
we
can't
so
yeah
it's
not
that
they
were
like
rejecting
or
being
mean
about
it
or
anything
is
just
no.
How.
B
This
is
the
first
time
or
the
second
time
we've
ever
seen,
I
think
they
said
this
like
this
has
never
happened
before
I'd
like
this
is
the
first
time
we've
seen
this
we're
not
going
to
invest
in
trying
to
reproduce
and
mitigate
this,
because
again
like
shock
yourself
and
seed
right
and
so
again,
then
there's
not
really
any
incentive
to
say
it's
like.
Oh,
if
you
just
figure
out
yourself
how
to
sort
of
maybe
sort
out
this
unsupported
state
that
you've
ended
up
and
we'll
sure
we
will
support
you
in
the
future
right.