Active Directory Quotas

[blub 115]

Hi,

Es gibt ab AD-2003 obiges Feature. Mein Problem ist, ich find nicht, wo ich das aktivieren/ konfigurieren kann. Und ich könnte das sehr gut brauchen..

 

Merci

blub

 

------

Quotas can be specified in Active Directory to control the number of objects a user, group, or computer can own in a given directory partition. Members of the Domain Administrators and Enterprise Administrators groups are exempt from quotas.

[grizzly999 11]

Aus dem Netz (engl.):

Ansonsten siehe letzten Satz des Artikels:

 

----------------------------------------------------------

Quotas and directory partitions

 

Quotas, a new feature with domain controllers running

Windows Server 2003, determine the number of objects that

can be owned in a given directory partition by a security

principal. (The owner of an object is usually, but not

always, the creator of the object.) Quotas can help

prevent the denial of service that can occur if a security

principal accidentally, or intentionally, creates objects

until the affected domain controller runs out of storage

space.

 

Quotas are specified and administered for each directory

partition separately. The schema partition, however, has

no quotas. On a given directory partition, you can assign

quotas for any security principal, including users,

inetOrgPersons, computers, and groups. Members of the

Domain Admins and Enterprise Admins groups are exempt from

quotas. In some cases, a security principal might be

covered by multiple quotas. For example, a user might be

assigned an individual quota, and also belong to one or

more security groups that also have quotas assigned to

them. In such cases, the effective quota is the maximum of

the quotas assigned to the security principal.

 

If a security principal is not assigned a quota either

directly or through a group membership, a default quota on

the partition governs the security principal. If you do

not explicitly set the default quota on a given partition,

the default quota of that partition is unlimited (ie,

there is no limit).

 

Tombstone objects owned by a security principal are also

counted as part of the quota consumption of that security

principal. For each partition, you can specify a tombstone

quota factor to determine the percentage weight given to a

tombstone object in quota accounting. For example, if the

tombstone quota factor for a given partition is set to 25

(or 25%), then a tombstone object on the partition is

counted as 0.25 (or ¼) of a normal object. If a quota of

100 is specified for a user on this partition, then the

user could own a maximum of 100 normal objects, or a

maximum 400 tombstone objects. The default tombstone quota

factor for each partition is initially set to 100 (or

100%), meaning that normal and tombstones objects are

weighted equally.

 

The following example illustrates how quotas can be used.

Consider the domain "sales.northwindtraders.com." Because

this domain supports a lot of printing activity, the

domain contains several print servers that each support

1,000 or more print queues. Initially, the default quota

of the sales.northwindtraders.com domain partition is set

to unlimited. To help control the number of objects

created and owned, the administrator specifies a default

quota of 500. Now, each user can own a maximum of 500

objects on the partition. Because print queues are

directory objects that are created and owned by the

respective print servers, the new default quota of 500

limits each print server to 500 print queues. To remove

this constraint, the administrator creates a group

called "Print Servers" and adds the computer account of

each print server to the group. The administrator then

specifies a quota of 2,000 for the Print Servers group.

Now, each print server can support its original number of

print queues, while the default quota continues to prevent

excess object creation by all other security principals.

 

Only domain controllers running Windows Server 2003 can

enforce quotas. Quotas are enforced only on originating

directory operations; quotas are not enforced on

replicated operations. In order for quotas to be fully

effective for any given directory partition, all domain

controllers that contain a writable copy of that partition

must be running Windows Server 2003. Therefore, for quotas

to be effective on a domain directory partition, all

domain controllers in that domain must be running Windows

Server 2003. For quotas to be effective on the

configuration partition, all domain controllers in the

forest must by running Windows Server 2003.

 

For information about creating, modifying, and querying

quotas, default quotas, and tombstone quota factors, see

dsadd quota, dsmod quota, dsadd quota, and dsquery quota.

-----------------------------------------------------------------------

 

Hope this helped.... ;)

 

grizzly999

[Lian 2.361]

Hallo,

 

soweit ich weiss geht das mit dem Befehl dsadd.exe

 

Syntax-besipiel:

dsadd quota -part dc=MeinDC,dc=lokal -acct MeinDC\Hans.Mueller -qlimit 15 -desc "Beschraenkung für Hans Mueller"

[blub 115]

Hi,

Vielen Dank!! Irgendwie muss ich meine Suchmechanismen überarbeiten :-)

Ich möcht jedenfalls damit verhindern, dass irgendein delegierter Pseudo-Admin in seiner OU per Skript 1000-ende von Objekten anlegt und das AD zum Platzen bringt.

 

Merci

blub

[grizzly999 11]

Irgendwie muss ich meine Suchmechanismen überarbeiten

Naja, ehrlicherweise: ist aus einem Teil des Netzes, wo nicht jeder Zugang hat... :wink2:

 

grizzly999

[Lian 2.361]

Grizzly war (latürnich?) wieder schneller ;)

 

Hier noch die Technet Referenz zu dem Befehl:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/entserver/dsadd.asp