A while ago I put some AD feature thoughts in a textfile not knowing
what to do with them at that moment
Here goes:
* Active Directory thoughts:
* OU = security principal
* Possibility to merge Forests
* "Cut and paste" a domain from one forest to another
* Domain concept:
* Domain controller -> directory server (not specific to
a certain domain, but hosting naming contexts)
* Password policies not only per domain but also per OU
* Keep domain as a replication boundary but remove the
flat structure (prevent context login like NDS -> Aliases?)
* Multiple replication boundaries (naming contexts) per
directory server
* Remove domain as an entity. Forest is only entity
needed
* Integrate file system and possible other resources into the
directory (e.g. search where security principals are used)
* Permissioning TOP-DOWN and BOTTOM-UP (file system)
* Delegation of Control: ability to dictate MEMBERS attribute
AND the MEMBEROF attribute (so the possibility exists to dictate which
users can be added to what groups)
* Disabling sidhistory?
* Loginscripts at container level
* Using the new DFS-Replication mechanism in R2 for the SYSVOL
Just some thoughts. Interesting?
Cheers,
#JORGE#
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Tuesday, August 02, 2005 18:25
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Biggest AD Gripes
So what are everyone's biggest AD Gripes? I am not talking about gripes
about things that use AD like GPOs[1] or Exchange or NFS or anything
else like that. I mean actual AD really missed the boat because of this
that or the other thing.
Like
o I dislike that when you defunct an attribute it doesn't purge the
information in the directory for that attribute.
o The fact that AD Security policy is managed through a technology
dependent on AD and replicates both within AD and the other technology.
o I dislike that there is no true schema delete.
o I dislike the fact that I can't specify which branches of the tree
replicate where.
o I dislike the fact that GUIDs are represented in multiple ways in the
directory.
o I dislike the implementation of property sets especially since they
could be so incredible awesomely cool. Specifically I dislike that an
attribute can only be in a single property set.
o I dislike creator/owner on SDs.
o I dislike the lack of configurable business rules.
o I dislike the fact that I can't run multiple domains on a single
domain controller.
Etc etc. I have more but lets see what others say. Everyone pipe up.
Let's pretend that MS will actually see this, let's further say let's
pretend MS AD Developers will see this. What would you tell them if you
were sitting in the room with them?
joe
[1] I do not consider GPOs to be part of AD. They are a technology that
leverages AD.
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
This e-mail and any attachment is for authorised use by the intended
recipient(s) only. It may contain proprietary material, confidential
information and/or be subject to legal privilege. It should not be copied,
disclosed to, retained or used by, any other party. If you are not an intended
recipient then please promptly delete this e-mail and any attachment and all
copies and inform the sender. Thank you.
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
