x86 installations:
Outlook 2003 : “C:\Program Files\Common Files\System\MSMAPI\1033\mlcfg32.cpl”
Outlook 2007 : “C:\Program Files\Microsoft Office\Office12\MLCFG32.CPL”

x64 installations:
Outlook 2003 : “C:\Program Files (x86)\Common Files\System\MSMAPI\1033\mlcfg32.cpl”
Outlook 2007 : “C:\Program Files (x86)\Microsoft Office\Office12\MLCFG32.CPL”

If you do not have ADSIEDIT.MSC ready (test by run ADSIEDIT.MSC from Run), you should install first.
It’s available on the Windows Server 2003 CD, in folder \Support\Tools. Install by double-click on suptools.msi.
For Windows Server 2008, it has been available on the Domain Controller since you installed the Active Directory.

Create connection to open the Domain partition.
Then you can modify the permissions of an OU just like the following picture:

This tip has been tested to work successfully, such as in the following picture.

The Office location attribute was changed to Semarang.

User Attributes that can be changed after the custom delegation:
Job Title, Department, Company, Manager, and Direct Reports.

Testing will be done by user Jet Lee (JetL) as a member of Human Resources group.

Attributes that Will Be Allowed to Be Changed in This Custom Delegation Example

Delegation Control Steps
Right-click on Finance OU, for example, and then click Delegate Control. It will launch the Delegation of Control Wizard.

Select users or groups for delegation

Select Create a custom task to delegate

Select Only the following objects in the folder, then select User objects.

On the Permissions page, select Property-specific. Then select read and write permissions for the following attribute:
- Department
- Job Title
- Company
- Direct Reports
- Manager
Click Next, and then click Finish.

Test the Delegation
For testing I use user Jet Lee (JetL) that is a member of Human Resources group.

Now, JetL can modify the user properties in the Organization tab like the following picture:

Here the result of setting the Manager property as you can see in Direct Reports list in the user properties for the manager (NaomiW)

You can install .NET Framework 1.1, but you may find error on other web applications. See my previous post, Error on Certificate Services Web Enrollment After Installing .NET Framework 1.1 on Windows Server 2003 R2 x64.

After installing .NET Framework 1.1 and some troubleshooting when necessary, you can install install GPMC sucessfully.

Here the test of GPMC usage after installation

To avoid problems with incompatibility of .NET Framework 1.1, it is recommended for you to install GPMC on client computers, such as Windows XP or Windows Vista. I wrote this post just to show you that actually we can install GPMC on Windows Server 2003 x64 that includes only .NET Framework 2.

I installed .NET Framework 1.1 on Windows Server 2003 R2 x64 that includes only .NET Framework 2.0 in Add/Remove Windows Components.

The installation completed successfully, then the problem come when I run Certificate Services Web enrollment.

Even access to the Default Web Site or http://server-name returns errors.

To Resolve the Problem:
Open Command Prompt. Go to Windows\Microsoft.NET\Framework64\v2.x.xxx (replace x.xxx with the correct version of the .NET Framework installed). Type:

> aspnet_regiis -i

The Result of Previous Step:

I also got another problem when running Certificate Services Web Enrollment. You may find another error message like “Unexpected Error getting the templates list”.

How to Resolve the Second Error:
I have to Unregister and Register some DDLs

• regsvr32 /u scrdenrl.dll
• regsvr32 scrdenrl.dll
• regsvr32 /u xenroll.dll
• regsvr32 xenroll.dll

Then I can continue the certificate enrollment process till completed.

Note:
I can solve the problem after googling the related error message and found this answer.
http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/a80a4eeb-d592-4d53-a1fc-3b0a993630f3

I wrote the previous post to make deep understanding of the tombstone reanimation concept.

AdRestore.exe
Formerly Sysinternals and now Microsoft, Mark Russinovich has created a command-line freeware application called ADRestore. The tool enumerates all of the currently tombstoned objects in a domain and allows you to restore them selectively, and provides a convenient command-line interface for using the Active Directory reanimation functionality.

You can download this tool from here:
http://technet.microsoft.com/en-us/sysinternals/bb963906.aspx

ADRestore.NET
Restoring objects with ADRestore.net
Guy Teverovsky has written a GUI version that allows you to easily restore deleted AD objects.
I found this tool will help you a lot when you need to restore more than one deleted objects, for example, an OU contains some objects.

You can download the ADRestore.NET here:
http://blogs.microsoft.co.il/files/folders/guyt/entry40811.aspx

Here the demo steps:
I deleted an OU named Accounting contained some objects including users and groups.

Enumerating Tombstones

First restore the OU.

Then restore the other objects one by one.

Until the last object

Then view the result

You can see from the steps above that using ADRestore.NET will be a lot of easier to restore more than one objects.

What Is a Tombstone?
When Active Directory deletes an object from the directory, it does not physically remove the object from the database. Instead, Active Directory marks the object as deleted by setting the object’s isDeleted attribute to TRUE, stripping most of the attributes from the object, renaming the object, and then moving the object to a special container in the object’s naming context (NC) named CN=Deleted Objects. The object, now called a tombstone, is invisible to normal directory operations.

Obviously, objects don’t remain in the CN=Deleted Objects container forever. The default tombstone lifetime is 60 days for forests initially built using Windows® 2000 and Windows Server 2003, and 180 days for forests that were initially built with Windows Server 2003 SP1. You can change the tombstone lifetime by setting the tombstoneLifetime attribute of the CN=Directory Service,CN=Windows NT, CN=Services,CN=Configuration, DC= object.

Every 12 hours, each domain controller starts a garbage collection process. (This can be changed by setting a new value for the garbageCollPeriod attribute of the CN=Directory Service,CN=Windows NT, CN=Services,CN=Configuration,DC= object.) This garbage collection scans all of the tombstones on the DC and physically deletes any that are older than the tombstone lifetime.

The Deleted Objects container is hidden and can not be viewed by using Active Directory Users and Computers and ADSIEDIT.MSC. But you can use LDP.EXE.

For example, in this documentation, I delete an account with distinguishedName: CN=Jenny Gates,OU=Marketing,DC=Microship,DC=com.
That account will be stored in Deleted Objects container in the form:
CN=Jenny GatesADEL:c7f41f06-7f02-42c9-8701-d5ad5ee3a7d0,CN=Deleted Objects,DC=Microship,DC=com
and with the attribute isDeleted is set TRUE.

To restore the user account, you have to use LDP.EXE to modify the properties of the deleted objects.
Here the snapshots

The previous condition
Jenny Gates (username: JennyG) has the following attributes:

Jenny has permissions set to C:\Data\Marketing folder.

Delete the user account Jenny

As the Result of Deletion
The Jenny’s previous account will be shown in the folder as her old SID. If you create a new user, it actually create a new object with the new SID for the user. That’s why you have to use the Tombstone Reanimation method to restore the old object.

For preparation to restore the deleted object, you have to install Windows Server 2003 Support Tools. From the Windows Server 2003 Installation CD, it is located on \SUPPORT\TOOLS\SUPTOOLS.MSI
You do not need to follow this step, if using Windows Server 2008.

Process to Restore the Deleted Object
Run LDP.exe.
On LDP window, click Connection menu, click Connect, type the appropriate server name and port.
Click Connection menu, click Bind, and type the Administrator account and password.

Click Options menu, click Controls.
On Load Predefined, select Return deleted objects.
This option will show the Deleted Objects container that is hidden by default.

Click View menu, click Tree, and then select the distinguished name of the domain name.
On the left, select DC=Microship,DC=com.
Then expand the Deleted Objects container, and find Jenny Gates.

Right click on the Jenny account, then click Modify.

In the Attribute box, type isDeleted. Under Operation, click Delete, and then click Enter.
In the Attribute box, type distinguishedName, in the Values box, type CN=Jenny Gates,OU=Marketing,DC=Microship,DC=com. Under operation, click Replace, and then click Enter.
Select the Extended check box, and then click Run.

The result of restoring deleted objects using Tombstone Reanimation procedure is not perfect. You will restore a disabled account with all attributes has been stripped. You have to set the password and enable the account.

But as you can see from the following picture that the permissions for Jenny has been restored.
Now Jenny can access the shared folder.

The next pictures show that, although you can restore the object, but many attributes has gone including the membership of the user.

If you want to have a successful restore including all attributes of the user, you should consider to do Authoritative Restore that need you to restore from backup. and you can not restore the active directory database from backup without restarting to Active Directory Restore Mode.

I do not give a really details documentation for step by step implementation. If you need more information about the steps, see the details here:
http://msdn.microsoft.com/en-us/library/bb232815.aspx

Here are the snapshots of Visio Connector for MBSA usage:

Security Update Scan Results

You can download or view the security update information directly from Microsoft Update web site.

Windows Scan Results

How to correct this information

Additional System Information

Other Microsoft Products Scan Results

You can download from here:
http://technet.microsoft.com/en-us/security/cc184923.aspx

Setup

Scanning

You can select whether scan a computer, scan multiple computers, or view existing security scan reports.

Select Configure computers for Microsoft Update and scanning prerequisites, if you want to automatic install the Windows Update Agent to the computers you want to scan in case they don’t have meet the scanning prerequisites.

It downloads the Security Update Catalog from the Internet and continue scanning.

Reports