IceMage's questions

We are migrating away from an old Windows 2003 domain controller, and moving to a Windows 2012 R2 domain controller. However, there are a few issues I need to clear up due to the configuration of the original domain controller.

We would like to remove the .local suffix on our domain, and use a real domain that we own instead, since this is no longer best practice (and is actually bad practice IIRC). However, the question I have is this;

Would it be better to

• rename the domain first, then migrate,
• migrate, then rename the domain, or
• rebuild the (new) domain from scratch and then import/recreate the users?

We have Office 365 with synced login credentials, so the users cannot be simply recreated on the new domain without re-associating all of the Office 365 accounts again (not out of the question though).

The Scenario: I use a dedicated volume (RAID volume) to store all of my data for my Exchange 2007 server. Today, out of curiosity, I decided to check up on how fragmented the files on this data volume were. To my surprise, the answer is extremely. So, a three part question:

First and Foremost, SHOULD I defragment this volume (after a full backup of course)? Be specific as to why not if I should not, or reasons I absolutely should if I should.

Second, about how much time should I allow for during this maintenance period per gigabyte. The drives are all 7200 RPM SATA drives on a Hardware RAID 5 controller (Perc 5i/6i, can't remember), the files are extremely fragmented. (Over 5000 file fragments per gigabyte).

Third, is there something wrong here? It seems to me like the drive shouldn't be this fragmented. Could something be configured incorrectly that could be causing this to happen?

The Scenario:
I'm using integrated authentication to grant access to an ASP.net intranet site. When that user accesses the site, certain information is loaded from their active directory profile and made available to them. Also, the site maintains certain information on that user for the web-application that it runs.

What is the best way to both retrieve information from Active Directory (I'm using LDAP), and then furthermore, link active directory profiles to the web application profiles. The web application is using a database of its own, so it's not storing anything in Active Directory.

Do not suggest using the username, as name changes can and do occur, I'm trying to use some form of unique identifier from Active Directory. The unique identifier must be compatible with my SQL Server 2005 database.

I have a barracuda spam firewall 300 that I just got installed the other day. I'm working on an LDAP query for using it with my exchange server. What i have so far is:

(&
(!userAccountControl:1.2.840.113556.1.4.803:=2)
(|
    (sAMAccountName=${recipient_local_part})
    (othermailbox=smtp:${recipient_local_part}@ourdomain.com)
    (proxyaddresses=smtp:${recipient_local_part}@ourdomain.com)
    (mail=${recipient_email})
    (userPrincipalName=${recipient_local_part})
)
)

I've formatted it for your convenience. What I'm trying to do is filter out users who are disabled in the directory, since they may have valid addresses, but I don't want to accept mail for them anymore. We keep their email addresses for a long time, but company policy prevents me from deleting them from the directory.

When the query runs, i get the following error:

failed to issue LDAP find operation: Bad search filter

The query works without the (!userAccountControl:1.2.840.113556.1.4.803:=2), but that is the line that filters out disabled accounts.

How do I use LDAP to effectively filter out disabled accounts?