Skip to main content

Installing and using the Active Directory Management Gateway Service (ADMGS)

ADMGS - How to install on Server 2003 and Server 2008

From someone who has done a lot of AD related scripting in powershell v1, it has taken me a while to get to grips with using the new AD cmdlets in PowerShell v2.  Needless to say, I have started 'dipping my toe' into the vast 'sea of cmdlets' now available and am finding them quite useful.  So much so, that enabling the ability to use the cmdlets in my older domains has become essential.   I no longer want to have to write v1 and v2 scripts, or more specifically, ad cmdlet and non-ad-cmdlet enabled scripts. 

Here enters the 'Active Directory Management Gateway Service' .This provides the connectivity for the AD-cmdlets to communicate with a domain controller in your domain.

Pre-requisites

For a small installer, this guy need a fair few prerequisites - each OS version being slightly different.

Windows 2008 (tested on 32bit)

It is best that you have SP2 installed as there is an issue with Windows 7 clients and 2008 DCs.  There is a hotfix but you have to request it, but it is included in Windows 2008 SP2

General installs

What ever platform you are using, these are required :
Windows 2003 (SP2 and R2 - again, tested on 32bit)

The only 2003 specific patch required is 969429, which is a request by email patch.  Don't be put off by this as I got the link emailed to me very quickly.

Once you have completed all these tasks, install the applicable version of the gateway

Using the gateway.

My R2 forest is single domain, so I have not given a second thought to how I access resources in other domains using the AD cmdlets.  I also have take for granted that the cmdlets just work.  I am, however, fortunate enough to have an R2 utility server to script on as well as R2 DC's.

The biggest thing here is the AD cmdlets only run on Windows 2008 R2 or Windows 7.  The gateway will run on the older OS's, but the cmdlets themselves do not. 

The second thing is that you need a gateway server in each domain.  I ran this in my test forest (from the root domain)
get-aduser -SearchBase "dc=child,dc=test2003,dc=com" -filter {name -like "*"}
and got this back :

Get-ADUser : A referral was returned from the server
At line:1 char:11
+ get-aduser <<<< -SearchBase "dc=child,dc=test2003,dc=com" -filter {name -like "*"} + CategoryInfo : ResourceUnavailable: (:) [Get-ADUser], ADReferralException + FullyQualifiedErrorId : A referral was returned from the server,Microsoft.ActiveDirectory.Management.Commands.Ge tADUser
The correct command is  : 
get-aduser -Server dc2.child.test2003.com -filter {name -like "*"}
...where server is the gatway server of that domain. 

For the future

I can see use for the gateway, as long as I can get the required R2 utility servers in the forests to run the scripts.  I would probably (on the said R2 util server) setup the profile to create variables for each domain gateway server.  This would not only make the scripting easier and more uniform, if I had to move my gateway server, I would change only the profile rather than all my scripts.

This being my research and testing, I am about to deploy this in my environments (this time 64 bit).  I'll report on the experience once I am up and running.
Labels:

Comments

Post a Comment

Popular posts from this blog

Enable Powershell Remoting (WinRM) via Group Policy

I have been doing some testing on enabling WinRM via group policy, being that WinRM is the service that Powershell v2 sets up it remoting capabilities. Here are the GPO settings that you need to configure WinRM .... set the winrm service to auto start Computer Configuration \ Policies \ Windows Settings \ Security Settings \ System Services Windows Remote Management (WS-Management)  set Startup Mode to Automatic start the service incorporated in to the above - you may need a restart. create a winrm listener Computer Configuration / Policies / Administrative Templates / Windows Components / Windows Remote Management (WinRM) / WinRM Service / Allow automatic configuration of listeners IPv4 filter: * * is listen on all addresses, or if you only want a particular IP address to respond use an iprange eg 10.1.1.1-10.1.1.254 - don't forget that this IP range has to be valid for all hosts that fall in the scope of the GPO you are creating.  You can use 1...
2 comments
Read more

Assigning Permissions - AGDLP

AGDLP It seems I have been mildly distracted away from the title of this blog site.   It does say AD Admin, but I seem to have been taken away by file system stuff.   I have to say, it has all been worthwhile, but it’s probably time I got back to the real heart of what I do. There are probably a million permission assigning advice pages, but I thought I would put another one out there after referring to AGDLP in my last post. So, what is this all about – AGDLP.   Well, it is something I learned in my MCSE 2003 studies and has become ingrained into my ideals since.   As a contractor, I get to move job often.   This enables me to forge opinions on how to configure things in a domain, and more importantly how NOT to configure things. AGDLP is definitely on the to do list…for anyone in any size domain or forest, as it follows some very basic principals.   I will explain these whilst I go through what AGDPL stands for. A A is for...
2 comments
Read more

Finding out what 'SearchFlags' are set on you AD attributes

Whilst doing some research into indexed attributes, I posted this  a while back on how to find your index attributes.  Since then, I have looked a little deeper into what indexing really means and found this excellent explanation on the numbers that can be found in the searchflags attribute of a schema object. Using Florian’s reference, I built the following script (which is both powershell v1 and v2 compatible) to get the schema attributes from the forest schema and return (among other things) the breakdown of your attributes search flags. $forest = [System.DirectoryServices.ActiveDirectory.forest]::getcurrentforest() $schema = [ADSI]('LDAP://CN=Schema,CN=Configuration,dc=' + ($($forest).name -replace "[.]",",dc=")) $attributes = $schema.psbase.children | where {$_.objectClass -eq "attributeSchema"} $collection = @() foreach ($attr in $attributes){ $store = "" | select "Name","lDAPDisplayName","singlev...
2 comments
Read more