Best Practices Analyzer As they have already done with Microsoft Exchange Server 2007 products, Microsoft has integrated its BPA technology into the Active Directory Domain Services and Active Directory Certificate Services roles in Windows Server 2008 R2. Administrators can initiate BPA scans using the graphical interface in Server Manager, or from a Windows PowerShell prompt. Note The BPA is included in the Windows Server 2008 R2 Standard, Enterprise, and Data-
center editions, but it is not included in Windows Web Server 2008 R2 or Windows Server 2008 R2 for Itanium-Based Systems, nor is it included in any Server Core edition.
The BPA has a collection of predefined rules for each role it supports—rules specifying the recommended architectural and configurational parameters for the role. For example, one AD DS rule recommends that each domain have at least two domain controllers. When you run a BPA scan, the system compares the recommendations to the actual role configuration and points out any discrepancies. The scan returns a status indicator for each rule that indicates whether the system is compliant or noncompliant. There is also a warning status for rules that are compliant at the time of the scan, but that configuration settings might render noncompliant under other operational conditions. To trigger an AD DS BPA scan in Server Manager, you select the Active Directory Domain Services node and, in the Best Practices Analyzer section, click Scan This Role. After a delay as the analyzer performs the scan, the results appear, as shown in Figure 5-12. You can exclude results that you don’t need, such as rules that you do not think you need to follow.
Figure 5-12 The Best Practices Analyzer for Active Directory Domain Services in Server Manager.
88
CHAPTER 5
Active Directory: Improving and Automating Identity and Access