BACK
Planning Implementing Maintaining AD Infrastructure
(an AD planning 70-294 intro)
NOS – Network Operating System
- Definitions:
- A server-based network operating system, or NOS, provides networking
support for multiple simultaneous users as well as administrative, security,
and management functions.
- Typically used to run computers that act as servers
- Software that connects all devices on a network so that resources can
be shared efficiently
- Allows multiple computers to communicate, share files and hardware devices
with one another
- define:"network
operating system"
- wikipedia
- Services:
- File and print sharing
- Account administration for users
- Security
- Data backup
DS – Directory Service
- A collection of software, hardware, processes, policies and administrative
procedures involved in organizing the information in a directory and making
it available to users
- A network database used to locate objects such as printers, machines, and
users. The DS helps applications resolve names to network locations.
- define:"Directory
Service"
- wikipedia
NOS Examples: (in not particular order, some obsolete, not
all fit the NOS definition purely)
- E-Directory
- IBM OS/2 and AIX
- LDAP (*NIX)
- Macintosh
- Microsoft AD 2003 / AD 2000
- NIS (*NIX)
- Novell Netware
- NTDS (Microsoft Windows NT)
- SUN Solaris
Active Directory (AD) overview
- Some of the major things AD does:
- Authentication of AD user --> authorization to AD resource
- Centralized storage and search of resources and (directory) information
- Where resources and information is files, printers, email addresses,
etc.
- Server 2003 "flavors”
- Isolated non-networked (workgroup)
- Stand alone (workgroup)
- Member server (AD)
- Domain Controller - DC (AD)
AD vs Workgroup |
AD |
Workgroup |
| KRB - Kerberos |
SAM – Security Accounts Manager |
| SSO – Single Sign-On |
small |
| DDNS – Dynamic Domain Name System |
Decentralized administration |
| LDAP – Lightwieght Directory Access Protocol |
Decentralized security |
| Requires >= 2 DCs |
- |
Active Directory (AD) components
- AD definition: Microsoft's directory service included with Windows 2003/2000
that provides a single point of administration, storage for users, groups,
and computer objects.
- Central storage
- Central administration
- Central user authentication
- Delegation of administration
- DC
- Holds a copy of the AD database
- Performs user authentication
- Services requests and queries
- Multi-master replication
- Changes within a site replicated to other DCs in 15 sec
- Plus 3 sec for each additional DC
- One hour replication default
- Between sites replication default is 3 hours
- Built on DNS
- Naming
- Locating of resources
- Name resolution and service location
Contains objects
- Users
- Computers
- groups
- Etc.
- Schema
- Unique per forest
- Object classes
- Attributes
- The schema partition of the AD database exists on all DCs
- Domains
- Password policy – unique per domain
- Administrative boundary
- Replication boundary
- OU – Organizational Unit
- Group Policy Object (GPO)
- Tree
- One or more namespace-wise contiguous domains
- Forest
- Single AD instance
- One schema
- One or more trees
- Forest root domain
- Trust
- Site
- >= 1 network with higher speed connectivity (>=10 MB)
- >= 1 GC per site
- Physical AD != logical AD
- Site link
- GC – Global Catalog
- Supports Exchange 2000/2003
- Performs Universal group lookups
- Forest-wide index
- Partial replica of objects and attributes frequently used throughout
AD
- LDAP
- Used to query or update AD
- Universal Groups (UG)
- special considerations re UGs and GCs and WAN use and security
FSMO - Flexible Single Master Operations roles/services
- Schema Master - Forest level
- oversees all schema operations
- Domain Naming Master - Forest level
- oversees all domain instantiation
- RID (Relative ID) Master - Domain
level - Grants pools of ID numbers to be used by DCs (for object creation
by DCs)
- PDC (Primary DC ("old" NT term)) Emulator
- Domain level - used for backward compatibility
AND many other AD critical functions: authoritative password source, forest
and domain time masters, more
- Infrastructure Master - Domain level
- handles updates and name changes involving cross domain relationships
- Must know
- what will break with a FSMO down or inaccessible
- Where to place FSMOs site-wise
- Where to place FSMOs forest-wise
- how to transfer
- how to seize
- when to seize
- when not to return the seize to production
- Note that most everything else in AD is handled by Multi-Master replication,
where, for example, all DCs are read write, changes can be made anywhere and
replicate around. These five FSMOs are the exceptions. They are flexible roles
because they can be moved to different DCs by NTDSUTIL
or some GUIs
- FSMO placement and optimization on Active Directory domain controllers http://support.microsoft.com/default.aspx?scid=kb;en-us;223346
NEW to 2003
Tools to know - relevant to the 70-294 AD Planning subject area
Windows Server 2003 Security Guide: http://www.microsoft.com/downloads/details.aspx?FamilyID=8a2643c1-0685-4d89-b655-521ea6c7b4db&DisplayLang=en
Windows Server 2003 Deployment Kit: Designing a Managed Environment:
REDMOND MAG 70-294 Active Directory Planner http://redmondmag.com/reviews/exams/article.asp?EditorialsID=104
BACK