Active Directory Explorer is a free Active Directory viewer from Microsoft's Sysinternals tool suite. It allows you to view and edit the Active Directory database. Moreover, you can compare Active Directory snapshots. Active Directory Explorer offers a few useful additional features, which I will review in this article.
Latest posts by Michael Pietroforte (see all)
- Author and member of the year 2019 – Why DevOps still doesn't rule the IT world - Wed, Jan 1 2020
- Results of the 4sysops member and author competition in 2018 - Tue, Jan 8 2019
- Why Microsoft is using Windows customers as guinea pigs - Reply to Tim Warner - Tue, Dec 18 2018
Active Directory viewer ^
The utility is similar to the Active Directory viewer ADSI Edit from the Windows Server 2003 Support Tools, which is now also delivered with Windows Server 2008 R2. ADSI Edit, however, has no snapshot feature. I also like that you can bookmark Active Directory objects with Active Directory Explorer. This is helpful if you often have to view the same objects.
In theory, Active Directory Explorer can also replace other Active Directory viewers such as the Active Directory User and Computer interface (ADUC). One advantage of Active Directory Explorer is that you can browse more quickly through objects with it than with ADUC because a single click on an object is sufficient to view all attributes of the object.
Also useful is that you can copy the values of all object attributes to the Windows clipboard. This is helpful if you want to email the object attributes to a colleague. However, since Active Directory Explorer displays the real names of the attributes, this is only something for Active Directory geeks. If you often write Active Directory scripts, it certainly makes sense to learn the attribute names.
Modify Active Directory ^
You can also modify Active Directory objects by right-clicking the corresponding attribute. If you want to modify an empty attribute, you have to right-click any of the attributes displayed in the right pane and then choose the corresponding attribute in the property field.
Note that you can't modify all objects with Active Directory Explorer. For instance, if you right-click a user object in the Deleted Object container, the Modify menu point is grayed out. Thus, it is not possible to reanimate tombstone objects with the Sysinternals Active Directory viewer. I think, it would make sense to add support for the Windows Server 2008 R2 Active Directory Recycle Bin in AD Explorer.
Active Directory snapshot ^
Creating a snapshot of the Active Directory database can be done with just a mouse click. This is fast and easy compared to creating snapshots with ntdsutil in Windows Server 2008. However, you can't use the snapshots created with Active Directory Explorer as a backup. You can only browse and search in those snapshots.
It is also possible to compare two snapshots. This is useful if you want to know which changes have been made to the Active Directory database by an application, for example. You can restrict the comparison to certain objects and attributes.
To compare two snapshots you have to load the first snapshot with Active Directory Explorer and then click "compare" in the main menu. You can then select the second snapshot.
Unfortunately, Active Directory Explorer doesn't allow you to save or to export the output. It is also not possible to compare a snapshot with the current state of Active Directory.
I tested Active Directory Explorer v1.4.