Active Directory

Auditing. Changes made to Active Directory objects can be recorded so that you know what was changed on the object, in addition to the previous and current values for the changed attributes.

Fine-Grained Passwords. Password policies can be configured for distinct groups within the domain. No longer does every account have to use the same password policy within the domain.

Read-Only Domain Controller. A domain controller with a read-only version of the Active Directory database can be deployed in environments where the security of the domain controller cannot be guaranteed, such as branch offices where the physical security of the domain controller is in question, or domain controllers that host additional roles, requiring other users to log on and maintain the server. The use of Read-Only Domain Controllers (RODCs) prevents changes made at branch locations from potentially polluting or corrupting your AD forest through replication. RODCs also eliminate the need to use a staging site for branch office domain controllers, or to send installation media and a domain administrator to the branch location.

Restartable Active Directory Domain Services. Active Directory Domain Services can be stopped and maintained. Rebooting the domain controller and restarting it in Directory Services Restore Mode is not required for most maintenance functions. Other services on the domain controller can continue functioning while the directory service is offline.

Database Mounting Tool. A snapshot of the Active Directory database can be mounted using this tool. This allows a domain administrator to view the objects within the snapshot to determine the restore requirements when necessary.

Recovery of Deleted Objects. Domains in Active Directory now have a Recycle Bin feature that allows you to recover deleted objects. If an Active Directory object is inadvertently deleted, you can restore the object from the Recycle Bin. This feature requires the updated Windows Server 2008 R2 forest functional level.

Improved Process for Joining Domains. Computers can now join a domain without being connected to the domain during the deployment process, also known as an offline domain join. This process allows you to fully automate the joining of a domain during deployment. Domain administrators create an XML file that can be included as a part of the automated deployment process. The file includes all the information necessary for the target computer to join the domain.

Improved Management of User Accounts Used As Identity for Services. The maintenance of passwords for user accounts that are used as identities for services, also known as service accounts, is a time-consuming management task. When the password for a service account changes, the services using that identity also must be updated with the new password. To address this problem, Windows Server 2008 R2 includes a new feature, known as managed service accounts. In Windows Server 2008 R2, when the password for a service account changes, the managed service account feature automatically updates the password for all services that use the service account.

Install from Media Generation. The ability to create installation media for AD LDS by using Ntdsutil.exe or Dsdbutil.exe.

Auditing. Auditing of changed values within the directory service.

Database Mounting Tool. Gives you the ability to view data within snapshots of the database files.

Active Directory Sites and Services Support. Gives you the ability to use Active Directory Sites and Services to manage the replication of the AD LDS data changes.

Dynamic List of LDIF files. With this feature, you can associate custom LDIF files with the existing default LDIF files used for setup of AD LDS on a server.

Recursive Linked-Attribute Queries. LDAP queries can follow nested attribute links to determine additional attribute properties, such as group memberships.

Enrollment Agent Templates. Delegated enrollment agents can be assigned on a per-template basis.

Integrated Simple Certificate Enrollment Protocol (SCEP). Certificates can be issued to network devices, such as routers.

Online Responder. Certificate Revocation List (CRL) entries can be returned to the requestor as a single certificate response instead of the entire CRL. This reduces the total amount of network traffic consumed when clients validate certificates.

Enterprise PKI (PKI View). A management tool for AD CS, this tool allows a Certificate Services administrator to manage Certification Authority (CA) hierarchies to determine the overall health of the CAs and to easily troubleshoot errors.

Authentication Assurance. Active Directory Federated Services in Windows Server 2008 R2 includes a new feature known as authentication assurance. This feature allows administrators to establish authentication policies for accounts that are authenticated in federated domains. This enables a variety of advanced authentication scenarios, such as smart cards.

Availability As an Integrated Server Role. AD FS is a server role within Windows Server 2008 R2 that can be easily deployed and managed using Server Manager, instead of being handled as an added feature, as in Windows Server 2003 R2.

Integration with Microsoft Office SharePoint Server 2007. AD FS can be used to facilitate a single sign-on solution for Office SharePoint Server 2007.

Integration with Active Directory Rights Management Services (AD RMS). AD FS can integrate with AD RMS to support the sharing of rights-protected content between organizations without requiring AD RMS to be deployed in both organizations.

Improved Administration. Importing and exporting trust information has been enhanced so that each organization can quickly export or import XML files to facilitate the configuration of trust information.

Application Support. Support for AD RMS is already included within Windows Vista. Internet Explorer 7 and the 2007 Microsoft Office system already have support for AD RMS. The AD RMS client can also be installed on other Windows operating systems.

Persistent Protection. Your content can be protected on the go. You specify who can open, modify, print, or manage the content, and the rights stay with the content—even after it has been transferred outside of your organization.

Usage Policy Templates. If you have a common set of rights that you use to control access to information, a Usage Policy Template can be created and applied to content. This alleviates the need to recreate the usage rights settings for every file you want to protect.

AD RMS Software Development Kit. The AD RMS Software Development Kit (SDK) can be used by independent software vendors (ISVs) to rights-enable their applications, meaning the application investments you’ve already made may be (or will become) compatible with AD RMS.