Creating Snapshots With ADExplorer

Source:http://www.frickelsoft.net/blog/?p=160

Those who already looked into Server 2008 (I hope almost all of you did!) surely have noticed of read about Server 2008’s snapshot capability. You can take snapshots of the directory database to save them away to mount them later using the dsadmin tool to have it run besides your current AD. The clue is that you can make some before-after-comparison with the snapshot you took a few days, hours, minutes before you made a change to the directory.

Obviously, the built-in tool isn’t really nice when it comes to comparing the live database with the snapshot. Mounting and dismounting instances isn’t either. So I’d like to take the opportunity to write a few words about ADExplorer. ADExplorer is one of the free Sysinternals tools. You can grab it free fromhttp://technet.microsoft.com/en-us/sysinternals/bb963907. What’s cool about ADExplorer is that it allows you to make snapshots of your AD, just like you know it from regmon and filemon (they merged to procmon afaik). Do a ‘before’ snapshot, do a ‘after’ snapshot and let the tool compare them.

The usage is pretty easy. You first connect to the domain you want.

You can browse the domain and the objects in a ADSIedit-way. Changes and deletions as well as editing objects can be done as easy. Some point in time, when you feel the directory runs great, you might want to create a snapshot. You go select “File”, “Create Snapshot”.

Enter a description and a name (“Vorher” is German and equivalent to “before” in this context :-). The file is saved with a *.dat extension. Note that, once you have dumped the directory to the snapshot, you should save the .dat file on a place somewhere safe. You surely don’t want all naming contexts be in wrong hands. I’d basically treat the export like a backup – lock it up.

We do some modifications and after them, we feel like doing a second snapshot and then comparing the two. Fast said, even faster done. We create the second snapshot just like the first – and save it on a place somewhere safe. To compare to two shortcuts, we restart ADExplorer. This time, we don’t choose the domain but use the “Enter the path of previous snapshot to load” option.

It loads the snapshot and you can browse – again in ADSIEdit-style – the snapshot you took a while ago. For comparison, we go select “Compare”, “Compare Snapshot”. Already bored? Okay, here comes the cool stuff:

You get to choose, what objects and attributes the tool needs to compare! The first box lets you choose the second snapshot. After that, you can tick all objects and attributes you want to be added to the comparison and which ones ignored. This is a kind of filtering, if you’re searching for something specific. Clicking okay generates the comparison.

This is what it put out for me. You can see I deleted a user called “Jack Black” (the first line indicates user creation – “Object missing in first”, the last line indicates object deletion, “Object missing in second”. That is because the user is moved from its original OU to the “Deleted Objects” container). Also, the user object of Florian got a few changes. Someone added a street, the location and a few more attributes. You can also see that the administrator logged on several times and that the lastLogon and logonCount numbers differ. You can see the before and after values in the log.

I like the tool. It allows quick comparison of before-after-snapshots and can be loaded on every machine (in case you want to view the snapshots on your desktop). Exactly what you could need when evaluating some application that modifies the directory – or test AD functions  and you need to track down the attributes and objects the function changes (that use case is geek-only, of course! 😉

Source: http://www.davitools.com/fepstools/fepstools.aspx This is a GUI for the SYSINTERNALS PSTOOLS