Introduction

Active Directory Explorer

Copyright © 2007 Bryce Cogswell and Mark Russinovich

Sysinternals - www.sysinternals.com

Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. You can use AD Explorer to easily navigate an AD database, define favorite locations, view object properties and attributes without having to open dialog boxes, edit permissions, view an object's schema, and execute sophisticated searches that you can save and re-execute.

AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. When you load a saved snapshot you can navigate and explorer it as you would a live database. If you have two snapshots of an AD database you can use AD Explorer's comparison functionality to see what objects, attributes and security permissions changed between them.

AD Explorer works on Windows 2000 and higher.


connecting

Connecting to a Domain

To connect to a domain choose Connect from the File menu. You can connect to the default domain using the credentials of the account in which you're running by leaving all the fields blank.

The Save this connection checkbox saves a shortcut for a connection so that when you run AD Explorer again it appears in at the root of the tree. Note that AD Explorer does not save your password when saving a connection so you must re-enter it every time you reconnect.

To delete a saved connection, select the connection in the tree and chose Remove from the File menu or the context menu.


Navigating

AD Explorer display information in two panes: the left pane shows the AD object tree and the right pane shows the attributes defined for the selected object.

Navigation History

AD Explorer keeps a record of your steps as you navigate through objects. You can go forward and backward through the navigation history by using the Back and Forward entries in the History menu or the corresponding toolbar buttons.

To view the full navigation history, open the History toolbar button. You can jump to a particular object in the history by choosing it from the displayed list.

Favorites

Choose Add to favorites from the Favorites menu to add an object to the favorites list, which AD Explorer stores in the Favorites menu. Right click on an entry in the Favorites menu to delete or rename the entry.


inspecting

Objects

The Object Properties Dialog

AD Explorer shows an object's attributes in the right pane when you select the object. You can view additional information about an object, including the name of its schema object and security permissions, by selecting Properties from the Edit or context menus.

RootDSE Properties

When you view the attributes of the RootDSE node (the root node of a connection), by selecting it and opening the Properties dialog box. The dialog for the RootDSE node also reports statistics about the schema, including the number of defined properties and attributes.

Editing Objects

You can rename and delete an object using the corresponding menu items in the Edit menu. To create a new object, select the parent container and then New Object from the Edit menu. AD Explorer will guide you through the process of specifying the object's name, type and attributes.


inspecting_object

Attributes

AD Explorer shows an object's attributes in the right pane when you select the object and in on the Attributes page of an object's Properties dialog.

Attributes Properties

You can open an attribute's properties dialog by double-clicking on an attribute or by selecting it and choosing Properties from the Edit menu. The properties dialog also let's you jump to the schema object for the attribute type.

Editing Attributes

To edit an attribute's value, select it and pick from Modify from the Edit or context menus. The menus also include a Delete entry for deleting attributes. Use the New Attribute entry in the Edit menu to define additional attributes for an object. AD Explorer will guide you through the steps for specifying the attribute's type and value.


Searching

AD Explorer has rich search functionality that allows you to search a selected object container for objects that have a specific attribute value or combination of attribute values and to save common search definitions.

The Search Dialog

Open the search dialog by choosing the Search Container entry from the Search menu. If you want to narrow a search to a specific container's child objects, highlight the container object in the object tree and then chose Search Container from the object's context menu.

To add a search criteria, specify the attribute for which you wish to search, and optionally, the attribute's value. Then click Add. To remove a search criteria, select it from the list and click Remove.

After specifying the search criteria, press the Search button. The results pane will populate with the paths to objects that match and you can navigate to an object by double-clicking it or selecting it and pressing the Enter key.

Saving Searches

To save a search criteria, click Save. The name you assign the search will appear in the Search menu. You can rename or delete a saved search from the context menu that appears when you right-click on the saved search entry in the Search menu.


Snapshots

You can use AD Explorer to save a snapshot of an AD database that you can open later in AD Explorer to perform off-line inspection and searches of AD objects and attributes. You can also compare two snapshots to see what objects, attributes or permissions are different.

Saving a Snapshot

To save a snapshot, chose the file save toolbar button or the Create Snapshot entry from the File menu. The Snapshot dialog let's you add a comment to the snapshot, specify where the snapshot will save, and a throttle that you can set to slow the rate at which AD Explorer will scan the AD object tree in order to reduce the impact to the target domain controller.

Working with Snapshots

You load a saved snapshot using the Connect dialog in the File menu. When you load a saved snapshot you browse and search it as you would a live AD database. When the object selection is within a snapshot the Compare menu becomes active.

The Compare Snapshot submenu opens a comparison dialog where you specify the path to a second snapshot and the classes and attributes that you want to compare. Differences are listed when the comparison completes and double-clicking on a difference will cause AD Explorer to navigate within the loaded snapshot to the object.

The Compare Snapshot Security menu opens a dialog into which you enter the path to a second snapshot for a comparison of permissions settings.

Scheduling Snapshots

You can use AD Explorer to create scheduled snapshots by launching it with the -snapshot command line option. The option requires two parameters: the connection string and the snapshot name. For example, to snapshot the default domain use this command:

adexplorer -snapshot "" c:\snapshots\snapshot1.snp


Reporting Bugs

If you encounter a bug please send email to markruss@microsoft.com, including the behavior you observed, the behavior you expected, and steps for reproducing the problem.


attribute_commands

When you select an attribute in the Attribute Pane the following commands are available from the context menu that appears when you right-click.

  • Properties to open the Attribute Properties dialog box

  • Modify to edit the attribute

  • Delete to delete the attribute

  • New Attribute to insert a new attribute

Note

You must have sufficient rights to modify, delete, or add an attribute.


commands

AD Explorer commands

The following commands are available from the File menu.

  • Connect to connect to a domain

  • Remove to disconnect a selected domain

  • Exit to close AD Explorer

The following commands are available from the Edit menu when you select an object.

  • Properties to open the Object Properties dialog box

  • Rename to rename the object

  • Delete to delete the object

  • New Object to insert a new object

  • Copy Object Name to copy the object name to the Clipboard

The following commands are available from the Edit menu when you select an attribute.

  • Properties to open the Attribute Properties dialog box

  • Modify to edit the attribute

  • Delete to delete the attribute

  • New Attribute to insert a new attribute

The following commands are available from the Favorites menu.

  • Add to Favorites to add the current selection to the Favorites list

  • You can also choose any Favorites that you have saved.

The following commands are available from the Search menu.

  • New Search to open the Search Directory dialog box

  • You can also choose any searches that you have saved.

The following commands are available from the History menu.

  • Forward to go to the next selected object

  • Back to go to the previously selected object

  • All to choose from a list of objects selected in the current session

The following commands are available from the Help menu.

  • AD Explorer Help to open help

  • About for product information

The following toolbar buttons are available.

  • Connect to AD to connect to an Active Directory domain

  • Search to search for an object

  • Properties to view the properties of the selected object or attribute

  • Help to open help

  • Back to go to the previous item in the object history

  • Forward to go to the next item in the object history

  • History to choose from a list of objects selected in the current session


object_commands

When you select an object in the Object Pane the following commands are available from the context menu that appears when you right-click.

  • Properties to open the Object Properties dialog box

  • Search Container to open the Search Directory dialog box

  • Rename to rename the object

  • Delete to delete the object

  • New Object to insert a new object

  • Copy Object Name to copy the object name to the Clipboard

Note

You must have sufficient rights to modify, delete, or add an object.