Ithicos Solutions Customer Survey

If you are a customer of Ithicos Solutions and use our Active Directory self service tools such as Directory Update, Directory Manager, Directory Search, and/or Directory Password products, we would like your feedback:

Ithicos Solutions survey

This survey should take no more than 5 minutes to complete and will help us determine better ways to support you in the future.  The survey is completely anonymous, but if you can leave your email at the end for a chance to win an Amazon gift card.

Moving jpegPhoto photos to the thumbnailPhoto attribute

There are a lot of clever people out there.  Unfortunately, I'm not amoungst them.  But, Joe Richards and Brian Desmond are!  Thanks to Joe for developing some great tools and Brian for showing me how to use some of them to do something tricky.

Anyway, on past the credit.  There are quite a few organizations out there that used the jpegPhoto attribute to store photos of users for use with 3rd party applications including my Directory Update Self Service Updateand Directory Manager thumbnailphoto Active Directory applications.  Microsoft is now using thumbnailPhoto as their photo-attribute-of-choice for Exchange 2010 and Outlook 2010.  That leaves a lot of us with our photos in jpegPhoto.

Using the ADFind and ADMod applications from Joe Richards, though, you can copy the jpegPhoto data in to the thumbnailPhoto attribute.  First, download and unzip these two applications. 

Here is an example of how to move user LukeHusky's photo:
adfind -f "(&(objectCategory=person)(objectClass=user)(samAccountName=LukeHusky)(jpegPhoto=*))" jpegPhoto -adcsv | admod BIN##thumbnailPhoto::{{jpegPhoto}}

If this works for one user, you can actually run this against ALL users that have data in the jpegPhoto attribute with this command.
adfind -f "(&(objectCategory=person)(objectClass=user)(jpegPhoto=*))" jpegPhoto -adcsv | admod BIN##thumbnailPhoto::{{jpegPhoto}} -unsafe

You can also run this so that it will stop after a specific number of errors, such as 5 in the case below:
adfind -f "(&(objectCategory=person)(objectClass=user)(jpegPhoto=*))" jpegPhoto -adcsv | admod BIN##thumbnailPhoto::{{jpegPhoto}} -exterr -upto 5

As always, test before doing AD-wide deployments!

Addressing issues uploading photos or writing to logs in Directory Manager or Directory Update

If you are having issues with Self Service Active Directory Update or Human Resources Active Directory Update Directory Manager writing to either the "logs" folder or the "photo" folder, it is probably due to one of two problems.

  First, check the Security properties of the c:\inetpub\wwwroot\DirectoryUpdate\Photos (or .\DirectoryManager\ folder).  This also applies to the Logs folder.  Ensure that the "NETWORK SERVICE" user has "Modify, Read & Execute, List Folder Contents, Read, and Write" permissions to that folder.

  Second, open up IIS Manager, navigate down to the web site on which Directory Update or Directory Manager is installed, view the Advanced Settings of the virtual directory (\DirectoryUpdate or \DirectoryManager) and verify that the Application Pool is "DefaultAppPool" - unless you have created your own dedicated application pool for Directory Update or Directory Manager.)

 Finally, in IIS Manager, navigate to Application Pools, and view the Advanced Settings of the DefaultAppPool (unless you have created your own) and in the Process Model section, make sure that the Identity is set to "NetworkService".

Vote for Directory Update!!!

Directory Update users:  Windows IT Pro has opened voting for the 2011 Community Choice Awards.  Please vote for Ithicos Solutions' Directory Update product in the "Best Active Directory & Group Policy Product" category!!!! 

http://www.surveymonkey.com/s/windowsitpro-communitychoice2011-finalvoting

Uploading photos to Active Directory for use with Outlook 2010

One of the coolest new features in Outlook 2010 is the ability to view photos stored in the Active Directory. While this is supposed to work only with Exchange Server 2010, it seems to also work if you are running Exchange 2007 and Outlook 2010.  I am also expecting to see the capability to use this photo integrated in to other products such Office Communication Server (Lync) and SharePoint.  You can upload photos to the Active Directory using the Exchange 2010 Exchange Management Shell.

My company's products Self Service Active Directory Update and Directory Manager are great tools for getting the data in to the Active Directory and are MUCH easier to use than the Exchange Management Shell. Our Directory Search application can be configured to display a user's photo. For existing and future customers, here is some information:

• Use the thumbnailPhoto attribute NOT the default jpegPhoto attribute
• Microsoft's recommendation for the photo size is 96 x 96
• We recommend setting the photo size to 128 x 128
• Typical image sizes are between 5KB and 10KB
• Impact on the Active Directory is usually minimal
• Adjust the settings using the DirectorySettings.XML file in the section
• If you supply a photo at EXACTLY the size (such as 128x128) then we do not alter the photo
• Photos supplied at different sizes/resolutions are re-rendered to the size specified in the XML file
• The thumbnailPhoto must be flagged in the schema so that it replicates to global catalog servers
• The NETWORK SERVICE user must be given "modify" permissions to the \inetpub\wwwroot\directorymanager\photos or the \inetpub\wwwroot\directoryupdate\photos folder.  This folder is used for temporary storage only.
• The IIS application pool's Identity must use the NETWORK SERVICE account

Existing users of Directory Update v1.6 or later and Directory Manager v1.3 or later can modify their application to upload photos by editing the DirectorySettings.XML file.  If all you wish to do is upload photos, the other sections of Directory Update or Directory Manager can be hidden.

While Directoy Update and Directory Manager can both upload photos, we recommend using Directory Manager and designate the task to a small number of people (such as Human Resources) so that you get consistent and good quality photos.

Jeffrey Hicks writes about Directory Update

I had a nice surprised today looking through the Redmond Magazine web site and reading Jeffrey Hicks' Mr. Roboto scripting/automation column. Check out his article At Your Self-Service: Directory Update puts users in charge of their own Active Directory administration.

Ithicos Solutions has now released new versions of our Active Directory self service tools including Directory Update, Directory Manager, and Directory Search that includes the ability to store a user's photo in the jpegPhoto attribute. Now if the Global Address List could just make use of that!