The Security Configuration Wizard (Figure A) is designed to help you to reduce the attack surface of your servers. It analyzes the way in which your servers are configured and then recommends how you can change various aspects of the configuration to make them more secure. The Security Configuration Wizard is included with Windows Server 2008 and Windows Server 2008 R2, but you can also download a Windows Server 2003 version.

Another of my favorite tools is ADSI Edit (Figure B). ADSI Edit allows you to manually edit the Active Directory database. Whenever someone asks me about ADSI Edit, I usually compare it to the registry editor. The registry editor allows you to manually change various configuration parameters within a system, but if you use it incorrectly, you can destroy Windows. ADSI Edit is similar: It gives you free rein over Active Directory, but if you make a mistake, you can destroy it.

I have found ADSI Edit most useful for working with Exchange Server deployments. It is sometimes impossible to remove Exchange public folders through conventional means. When this happens, you can use ADSI Edit to get rid of the folders that the Exchange Server management tools leave behind.

The Microsoft Application Compatibility Manager (Figure C) is part of the Application Compatibility Toolkit. It’s designed to ease the transition from one version of Windows to the next by compiling an inventory of the applications running on your desktops and determining whether each one is compatible with the new version of Windows.

As time goes on, server hardware continues to improve. Some organizations are finding that they can decrease management costs by consolidating their aging file servers. The Microsoft File Server Migration Wizard (Figure D), which is included in the File Server Migration Toolkit, helps organizations merge the contents of aging file servers into DFS root.

Although domain controllers are usually fairly reliable, problems do occasionally occur — particularly with regard to Active Directory replication. The dcdiag utility (Figure E), which is included with Windows Server, lets you run a full series of diagnostic tests against malfunctioning domain controllers.