Module 1: Introduction to Active Directory

Module 1: Introduction to Active Directory

Overview uintroduction to Active Directory uactive Directory Logical Structure urole of DNS in Active Directory uactive Directory Physical Structure umethods for Administering a Windows 2000 Network

Introduction to Active Directory uwhat Is Active Directory? uactive Directory Objects uactive Directory Schema ulightweight Directory Access Protocol (LDAP)

What Is Active Directory? Directory Service Functionality Centralized Management n Organize n Manage n Control Resources n Single point of administration n Full user access to directory resources by a single logon

uattributes Store Information About an Object Active Directory Objects Objects Active Directory Attributes Printers Printer1 Printers Users Printer Name Printer Location Attributes First Name Last Name Logon Name Users Printer2 Printer3 Don Hall Suzan Fine Attribute Value uobjects Represent Network Resources

Active Directory Schema Objects Class Examples Computers Users Printers Attributes of Users Might Contain: accountexpires department distinguishedname middlename Active Directory Schema Is: n Dynamically Available n Dynamically Updateable n Protected by DACLs Attribute Examples List of Attributes accountexpires department distinguishedname directreports dnshostname operatingsystem repsfrom repsto middlename

DNS and Active Directory Namespaces DNS Namespace Internet. (DNS root domain) com. Active Directory Namespace sales microsoft training microsoft.com training. microsoft.com computer1 sales. microsoft.com = DNS node (domain or computer) = Active Directory domain

Lightweight Directory Access Protocol (LDAP) uldap Provides a Way to Communicate with Active Directory by Specifying Unique Naming Paths for Each Object in the Directory uldap Naming Paths Include: n Distinguished names CN=Suzan Fine,OU=Sales,DC=contoso,DC=msft Suzan Fine n Relative distinguished names

Active Directory Logical Structure us uorganizational Units utrees and Forests uglobal Catalog

s ua Is a Security Boundary n A domain administrator can administer only within the domain, unless explicitly granted administration rights in other domains ua Is a Unit of Replication n controllers in a domain participate in replication and contain a complete copy of the directory information for their domain Replication Windows 2000

Organizational Units Network Administrative Model Sales Users Computers Organizational Structure Vancouver Sales Repair uuse OUs to Group Objects into a Logical Hierarchy That Best Suits the Needs of Your Organization udelegate Administrative Control over the Objects Within an OU by Assigning Specific Permissions to Users and Groups

Trees and Forests Two-Way Transitive Trust Forest contoso.msft Tree nwtraders.msft asia. contoso.msft au. contoso.msft Tree Two-Way Transitive Trusts asia. nwtraders.msft au. nwtraders.msft

Global Catalog Subset of the Attributes of All Objects Global Catalog Queries Group membership when user logs on Global Catalog Server

Introduction to the Role of DNS in Active Directory uname Resolution n DNS translates computer names to IP addresses n Computers use DNS to locate each other on the network unaming Convention for Windows 2000 s n Windows 2000 uses DNS naming standards for domain names n DNS domains and Active Directory domains share a common hierarchical naming structure ulocating the Physical Components of Active Directory n DNS identifies domain controllers by the services they provide n Computers use DNS to locate domain controllers and global catalog servers

DNS Host Names and Windows 2000 Computer Names n DNS host record and Active Directory. com. object represent the same physical computer n DNS allows computers to locate domain controllers within Active Directory sales microsoft training computer1 Active Directory training.microsoft.com Builtin Computers Computer1 Computer2 FQDN = computer1.training.microsoft.com Windows 2000 Computer Name = Computer1

DNS Requirements for Active Directory DNS Requirements to Support Active Directory Support for SRV records (mandatory) Support for the dynamic update protocol (recommended) Support for incremental zone transfers (recommended)

What Is a Tree? Tree Root Parent Parent contoso.msft Child Contiguous Namespace sales.contoso.msft Child sales.contoso.msft New

What Is the Forest Root? uthe Forest Root Is the First Created in a Forest Tree Root Forest Forest Root Global Catalog Configuration and Schema nwtraders.msft Tree contoso.msft Enterprise Admins Tree marketing.nwtraders.msft Schema Admins sales.contoso.msft

Characteristics of Multiple s Reduce Replication Traffic Maintain Separate and Distinct Security Policies Between s Preserve the Structure of Earlier Versions of Windows NT Separate Administrative Control

Active Directory Physical Structure u Controllers usites

Controllers Controllers: uparticipate in Active Directory replication uperform single master operations roles in a domain Replication Controller Controller = A Writeable Copy of the Active Directory Database

Sites Seattle Chicago New York Los Angeles Sites: u Optimize replication traffic IP subnet Site IP subnet uenable users to log on to a domain controller by using a reliable, high-speed connection

Introduction to Active Directory Replication Multimaster Replication with a Loose Convergence Controller B Replication Controller A Controller C

Replication Components and Processes uhow Replication Works ureplication Latency uresolving Replication Conflicts uoptimizing Replication

How Replication Works Active Directory Update n Add n Move n Modify n Delete Controller B Replicated Update Originating Update Replication Controller A Controller C Replicated Update

Replication Latency n n n Default Replication Latency (Change Notification) = 5 minutes When No Changes, Scheduled Replication = One Hour Urgent Replication = Immediate Change Notification Originating Update Controller A Change Notification Replication Change Notification Replicated Update Controller B Replicated Update Controller C

Resolving Replication Conflicts Controller A Stamp Originating Update Stamp Originating Update Controller B Conflict Conflict Stamp Version Number Timestamp Server GUID Conflicts Can Be Due to: u Attribute Value u Adding/Moving Under a Deleted Container Object or the Deletion of a Container Object u Sibling Name

Optimizing Replication Controller B GUID USN Up-To-Dateness Vector GUID Replicated Update USN Originating Update Controller A Controller C GUID Replicated Update USN

Replication Topology udirectory Partitions uwhat Is Replication Topology? uglobal Catalog and Replication of Partitions

Directory Partitions Directory Partitions Forest Schema Configuration contoso.msft Active Directory Database Contains definitions and rules for creating and manipulating all objects and attributes Contains information about Active Directory structure Holds information about all domain-specific objects created in Active Directory

What Is Replication Topology? A1 A2 B2 B1 A3 A4 B3 Controllers from from the Different Same s Topology A Topology B Topology Schema/Configuration Topology Schema/Configuration Topology

What Is Replication Topology? A1 A2 B2 B1 A3 A4 B3 Controllers from Different the Same s A Topology Topology B Topology Schema/Configuration Topology Schema/Configuration Topology

Using Active Directory for Centralized Management Active Directory: Search OU1 OU2 User1 Computer1 User2 Printer1 OU1 OU2 n Enables a single administrator to centrally manage resources n Allows administrators to easily locate information n Allows administrators to group objects into OUs n Uses Group Policy to specify policy-based settings Computers Users Users Printers Computer1 User1 User2 Printer1

Managing the User Environment 1 2 3 Apply Group Policy Once Windows 2000 Enforces Continually OU1 OU2 OU3 1 2 3 Use Group Policy to: ncontrol and lock down what users can do ncentrally manage software installation, repairs, updates, and removal nconfigure user data to follow users whether they are online or offline

Delegating Administrative Control OU1 Admin1 ssign Permissions: lfor specific OUs to other administrators lto modify specific attributes of an object in a single OU lto perform the same task in all OUs ustomize Administrative Tools to: lmap to delegated administrative tasks lsimplify interface design OU2 OU3 Admin2 Admin3

Review uintroduction to Active Directory uactive Directory Logical Structure urole of DNS in Active Directory uactive Directory Physical Structure umethods for Administering a Windows 2000 Network