Module 1: Introduction to Active Directory

Transcription

1 Module 1: Introduction to Active Directory

2 Overview uintroduction to Active Directory uactive Directory Logical Structure urole of DNS in Active Directory uactive Directory Physical Structure umethods for Administering a Windows 2000 Network

3 Introduction to Active Directory uwhat Is Active Directory? uactive Directory Objects uactive Directory Schema ulightweight Directory Access Protocol (LDAP)

4 What Is Active Directory? Directory Service Functionality Centralized Management n Organize n Manage n Control Resources n Single point of administration n Full user access to directory resources by a single logon

5 uattributes Store Information About an Object Active Directory Objects Objects Active Directory Attributes Printers Printer1 Printers Users Printer Name Printer Location Attributes First Name Last Name Logon Name Users Printer2 Printer3 Don Hall Suzan Fine Attribute Value uobjects Represent Network Resources

6 Active Directory Schema Objects Class Examples Computers Users Printers Attributes of Users Might Contain: accountexpires department distinguishedname middlename Active Directory Schema Is: n Dynamically Available n Dynamically Updateable n Protected by DACLs Attribute Examples List of Attributes accountexpires department distinguishedname directreports dnshostname operatingsystem repsfrom repsto middlename

7 DNS and Active Directory Namespaces DNS Namespace Internet. (DNS root domain) com. Active Directory Namespace sales microsoft training microsoft.com training. microsoft.com computer1 sales. microsoft.com = DNS node (domain or computer) = Active Directory domain

8 Lightweight Directory Access Protocol (LDAP) uldap Provides a Way to Communicate with Active Directory by Specifying Unique Naming Paths for Each Object in the Directory uldap Naming Paths Include: n Distinguished names CN=Suzan Fine,OU=Sales,DC=contoso,DC=msft Suzan Fine n Relative distinguished names

9 Active Directory Logical Structure us uorganizational Units utrees and Forests uglobal Catalog

10 s ua Is a Security Boundary n A domain administrator can administer only within the domain, unless explicitly granted administration rights in other domains ua Is a Unit of Replication n controllers in a domain participate in replication and contain a complete copy of the directory information for their domain Replication Windows 2000

11 Organizational Units Network Administrative Model Sales Users Computers Organizational Structure Vancouver Sales Repair uuse OUs to Group Objects into a Logical Hierarchy That Best Suits the Needs of Your Organization udelegate Administrative Control over the Objects Within an OU by Assigning Specific Permissions to Users and Groups

12 Trees and Forests Two-Way Transitive Trust Forest contoso.msft Tree nwtraders.msft asia. contoso.msft au. contoso.msft Tree Two-Way Transitive Trusts asia. nwtraders.msft au. nwtraders.msft

13 Global Catalog Subset of the Attributes of All Objects Global Catalog Queries Group membership when user logs on Global Catalog Server

14 Introduction to the Role of DNS in Active Directory uname Resolution n DNS translates computer names to IP addresses n Computers use DNS to locate each other on the network unaming Convention for Windows 2000 s n Windows 2000 uses DNS naming standards for domain names n DNS domains and Active Directory domains share a common hierarchical naming structure ulocating the Physical Components of Active Directory n DNS identifies domain controllers by the services they provide n Computers use DNS to locate domain controllers and global catalog servers

15 DNS Host Names and Windows 2000 Computer Names n DNS host record and Active Directory. com. object represent the same physical computer n DNS allows computers to locate domain controllers within Active Directory sales microsoft training computer1 Active Directory training.microsoft.com Builtin Computers Computer1 Computer2 FQDN = computer1.training.microsoft.com Windows 2000 Computer Name = Computer1

16 DNS Requirements for Active Directory DNS Requirements to Support Active Directory Support for SRV records (mandatory) Support for the dynamic update protocol (recommended) Support for incremental zone transfers (recommended)

17 What Is a Tree? Tree Root Parent Parent contoso.msft Child Contiguous Namespace sales.contoso.msft Child sales.contoso.msft New

18 What Is the Forest Root? uthe Forest Root Is the First Created in a Forest Tree Root Forest Forest Root Global Catalog Configuration and Schema nwtraders.msft Tree contoso.msft Enterprise Admins Tree marketing.nwtraders.msft Schema Admins sales.contoso.msft

19 Characteristics of Multiple s Reduce Replication Traffic Maintain Separate and Distinct Security Policies Between s Preserve the Structure of Earlier Versions of Windows NT Separate Administrative Control

20 Active Directory Physical Structure u Controllers usites

21 Controllers Controllers: uparticipate in Active Directory replication uperform single master operations roles in a domain Replication Controller Controller = A Writeable Copy of the Active Directory Database

22 Sites Seattle Chicago New York Los Angeles Sites: u Optimize replication traffic IP subnet Site IP subnet uenable users to log on to a domain controller by using a reliable, high-speed connection

23 Introduction to Active Directory Replication Multimaster Replication with a Loose Convergence Controller B Replication Controller A Controller C

24 Replication Components and Processes uhow Replication Works ureplication Latency uresolving Replication Conflicts uoptimizing Replication

25 How Replication Works Active Directory Update n Add n Move n Modify n Delete Controller B Replicated Update Originating Update Replication Controller A Controller C Replicated Update

26 Replication Latency n n n Default Replication Latency (Change Notification) = 5 minutes When No Changes, Scheduled Replication = One Hour Urgent Replication = Immediate Change Notification Originating Update Controller A Change Notification Replication Change Notification Replicated Update Controller B Replicated Update Controller C

27 Resolving Replication Conflicts Controller A Stamp Originating Update Stamp Originating Update Controller B Conflict Conflict Stamp Version Number Timestamp Server GUID Conflicts Can Be Due to: u Attribute Value u Adding/Moving Under a Deleted Container Object or the Deletion of a Container Object u Sibling Name

28 Optimizing Replication Controller B GUID USN Up-To-Dateness Vector GUID Replicated Update USN Originating Update Controller A Controller C GUID Replicated Update USN

29 Replication Topology udirectory Partitions uwhat Is Replication Topology? uglobal Catalog and Replication of Partitions

30 Directory Partitions Directory Partitions Forest Schema Configuration contoso.msft Active Directory Database Contains definitions and rules for creating and manipulating all objects and attributes Contains information about Active Directory structure Holds information about all domain-specific objects created in Active Directory

31 What Is Replication Topology? A1 A2 B2 B1 A3 A4 B3 Controllers from from the Different Same s Topology A Topology B Topology Schema/Configuration Topology Schema/Configuration Topology

32 What Is Replication Topology? A1 A2 B2 B1 A3 A4 B3 Controllers from Different the Same s A Topology Topology B Topology Schema/Configuration Topology Schema/Configuration Topology

33 Using Active Directory for Centralized Management Active Directory: Search OU1 OU2 User1 Computer1 User2 Printer1 OU1 OU2 n Enables a single administrator to centrally manage resources n Allows administrators to easily locate information n Allows administrators to group objects into OUs n Uses Group Policy to specify policy-based settings Computers Users Users Printers Computer1 User1 User2 Printer1

34 Managing the User Environment Apply Group Policy Once Windows 2000 Enforces Continually OU1 OU2 OU Use Group Policy to: ncontrol and lock down what users can do ncentrally manage software installation, repairs, updates, and removal nconfigure user data to follow users whether they are online or offline

35 Delegating Administrative Control OU1 Admin1 ssign Permissions: lfor specific OUs to other administrators lto modify specific attributes of an object in a single OU lto perform the same task in all OUs ustomize Administrative Tools to: lmap to delegated administrative tasks lsimplify interface design OU2 OU3 Admin2 Admin3

36 Review uintroduction to Active Directory uactive Directory Logical Structure urole of DNS in Active Directory uactive Directory Physical Structure umethods for Administering a Windows 2000 Network