Active Directory

Backlink attributes are constructed and not changeable. For example, in a group membership, the member attribute on the group is changeable, while the backlink attribute—the memberOf attribute on the user—is not.

The Windows PowerShell cmdlets in turn connect to the Active Directory Web Service (ADWS) that was introduced in Windows Server 2008 R2. If you want to use ADAC with a domain that does not have any Windows Server 2008 R2 or newer domain controllers, you’ll need to download and install ADWS for Windows Server 2003 or Windows Server 2008. We’ll discuss ADWS in more detail in Chapter 9, including details on how to add it to older domain controllers.

The benefit of converting a security group to a distribution group is usually not so obvious. The most useful aspect of this conversion is that you can safely disable a security group to verify whether or not it is being used for Windows security.