Well, I knew this would happen. A couple of people pointed out after my last entry that I haven’t really been posting any PowerShell related stuff. My apologies, but PowerShell isn’t the only thing that I do. I tend to cover topics based on whatever I happen to be working on at the time. So based on my past postings you can almost build a calendar of projects that I have worked on since the inception of this blog. :>) In addition, for some strange reason, I haven’t really been called upon to write any cool PowerShell scripts. So outside of creating little automation scripts for myself. I have for the most part only been answering PowerShell questions for my peers. Needless to say, having people tackle the chore of understanding and using PowerShell is a good development. In the past, I used to be the bottle neck for kicking out scripts. Now, I’m increasing just providing ring-side assistance. Nice! So, now that you understand my excuse. I promise to more routinely post PowerShell tidbits. After all, I’m sure everyone is getting bored with the PKI related stuff that I’ve been posting. **Crickets… Cough… Silence*** And, with that, on to the blog. Today, I want to talk about a topic that may be a bit of a mystery to most people. Exactly, how much space does Credential Roaming take in Active Directory? To tell you the truth, you may never really know unless you write an automation script that retrieves the sizes of the following two attributes for all user objects in Active Directory:
Or, if you happen to really understand the internals about Microsoft Cryptography and PKI in general you can get some really good size estimates based on information that is already known (For example, a certificate tends to be 2KB). But, what if I’m an IT Pro and I just want to get a good estimate for future Credential Roaming growth or just get a general idea of current sizing based on the number of users using it without digging into the dark reaches of cryptography? Well, until recently, these were trying activities that required a bit of black magic unless you were of the lucky few that had access to internal Microsoft information about Credential Roaming. Unfortunately, there just wasn’t anything public that gave hard core details about how Credential Roaming worked. Luckily, Microsoft decided to give IT Pros a helping hand and recently posted a really good whitepaper that explains the ins and outs of Credential Roaming. Link By using this link, you will find a section strangely named “Deploying Group Policy for Credential Roaming” (editors crack me up sometimes). Anyhow, in this section you will find sizing information. For example, there is a really good table that explains the different credential components that roam and their sizes (I’d show you this table, but it is kind of hard to build it using the NetworkWorld blogging interface). In addition, to this table the whitepaper also gives you a really good formula for figuring out Credential Roaming sizing information: (((CertificateSizeInByte + KeySizeInByte) * (#UserCertificates * #PastCertificateRenewals * #Machines) + (DPAPIkey * ProfileAgeInYears * 4) + DPAPIpreferredfile + (#StoredUserNamesAndPasswords * 400)) / 1024 Don’t worry if the parameters don’t make sense the whitepaper also gives you a nice little table explaining what each parameter means. Using the information that is provided you can then gain a good understanding for how much space a Credential Roaming deployment will or is taking. For all of today’s Microsoft news, visit the Microsoft Subnet.
