Active directory ii
- 2. Basics of Active Directory in Windows Server 2003 Active Directory partitions Logical structures “Physical” structures Functional levels
- 4. Schema Logical partition in Active Directory database “ Template” for Active Directory database Forms the database structures in which data is stored Object classes Attributes Extensible Dynamic Protected by ACLs (Access Control Lists)- DACLs and SACLs (Discretionary ACLs and System ACLs) One schema per Active Directory forest
- 5. Schema Users Servers Attributes of Users might contain: List of attributes accountExpires badPasswordTime mail cAConnect dhcpType eFSPolicy fromServer governsID Name … accountExpires badPasswordTime mail name Attribute Examples: Object Class Examples: Dynamically available, updateable, and protected by DACLs Computers
- 6. Configuration Logical partition in Active Directory database “ Map” of Active Directory implementation Contains information used for replication, logon, searches Domains Trust relationships Sites & site links Subnets Domain controller locations
- 7. Domains Logical partition in Active Directory database Collections of users, computers, groups, etc. Units of replication Domain controllers in a domain replicate with each other and contain a full copy of the domain partition for their domain Domain controllers do not replicate domain partition information for other domains Windows 2000/WS03 Domain Replication User1 User2 User1 User2
- 8. Directory Partitions Configurable Replication Application Domain-wide replication Forest-wide replication (every DC in forest has a replica) All Partitions Together Comprise the Active Directory Database Zoom.com Configuration Schema Contains information about all domain-specific objects created in Active Directory Contains information about Active Directory structure Contains definitions and rules for creating and manipulating all objects and attributes Contains application data ForestDNSZone DomainDNSZone
- 10. Tree One or more domains that share a contiguous DNS namespace, e.g. ZOOM.COM MCSE.ZOOM.COM CCNA.ZOOM.COM
- 11. Forest One or more domains that share: Common schema Common configuration Automatic transitive trust relationships Common global catalog Forest can contain from as few as one domain to many domains and/or many trees First domain created is forest root- this cannot be changed without rebuilding the entire forest
- 13. Trust Relationships Secure communication paths that allow security principals in one domain to be authenticated and accepted in other domains Some trusts are automatically created Parent-child domains trust each other Tree root domains trust forest root domain Other trusts are manually created Forest-to-Forest transitive trust relationships can be created-Windows Server 2003 forests only
- 14. Default - two-way- transitive Kerberos trusts (intraforest) Shortcut - one or two-way – transitive Kerberos trusts (intraforest) Reduce authentication requests Forest – one or two-way – transitive Kerberos trusts* *.WS2003 Forests- Windows 2000 does not support forest trusts Only between Forest Roots Creates transitive domain relationships External – one-way – non-transitive NTLM trusts Used to connect to/from Windows NT or external 2000 domains Manually created Realm – one or two-way – non-transitive Kerberos trusts Connect to/from UNIX MIT Kerberos realms Trust Relationships in Windows Server 2003
- 15. Trees and Forests Tree Forest External One-Way Non-Transitive Trust Tree Forest Forest Two-Way Transitive Trusts (Forest/Tree Root) contoso.msft nwtraders.msft (Forest/Tree Root) japan. contoso.msft (Child Domain) tailspintoys.msft (Tree Root) japan. nwtraders.msft (Child Domain) china. nwtraders.msft (Child Domain) Windows NT Domain Tree
- 17. Forest and Domain Functional Levels Functional levels determine Supported domain controller operating system Active Directory features available Domain functional levels can be raised independently of one another Raising forest functional level is performed by Enterprise Admin Requires all domains to be at Windows 2000 native or WS03 functional levels
- 18. Forest Functional Levels Windows Server 2003 Server family Windows Server 2003 Server family Windows NT 4.0, Windows Server 2003 Server family Windows Server 2003 Interim Windows NT 4.0, Windows 2000, Windows Server 2003 Server family Windows 2000 (default) Domain Controllers Supported Forest Functional Level
- 19. Forest Functional Levels- Features Same as Windows Server 2003 Interim, plus: Schema de-/reactivation Domain rename Forest trust Windows Server 2003 Server Family Same as Windows 2000, plus: LVR replication (Linked Value Replication- new group structuring) Improved ISTG (Inter-Site Topology Generator- generates replication connections) Windows Server 2003 Interim Universal group caching Windows 2000 Features Supported Functional Level
- 20. Domain Functional Levels Windows 2000 Mixed Mode- NT4, Windows 2000 or WS03 DCs Domain Controller (Windows 2000) Domain controller (Windows NT 4.0) Domain Controller (Windows Server 2003) Windows 2000 Native Mode- No NT 4 DCs Domain Controller (Windows Server 2003) Domain Controller (Windows 2000)
- 21. Domain Functional Levels Windows Server 2003 Interim- No 2000 DCs Domain controller (Windows NT 4.0) Domain Controller (Windows Server 2003) Windows Server 2003 Server Level- All WS03 DCs Domain Controller (Windows Server 2003) Domain Controller (Windows Server 2003)
- 22. Domain Functional Levels- Features Same as Windows 2000 Native, plus: Kerberos KDC version numbers Domain Rename Windows 2003 Server Family Same as Windows 2000 mixed, plus: Group nesting and converting Universal security and distribution groups Universal group membership caching SID history Windows 2000 Native/Windows Server 2003 Interim Universal group caching Application directory partitions Windows 2000 mixed Features Supported Functional Level
- 24. “Physical” Components of Active Directory Sites Areas of “good” connectivity Single site may contain many domains Single domain may span many sites Domain Controllers Store replicas of the Active Directory database Associated with a given site Site Domain
- 25. Sites Subnets are defined and associated with sites Used by domain controllers to determine replication behavior Used by computers to locate close domain controllers for authentication and searches of the directory Chicago Seattle New York Los Angeles IP Subnet Site IP Subnet
- 26. Domain Controllers Domain controllers replicate common partitions Every DC in the forest has a replica of schema & configuration partitions Every DC in a domain has a replica of that domain’s domain partition DCs may contain replicas of application partitions
- 27. Roles of Active Directory
- 28. Roles of a Domain Controller Roles Global Catalog Server Domain Naming Master Schema Master RID Master PDC Emulator Infrastructure Master Operation Masters Forest Wide Roles Domain Wide Roles
- 29. Global Catalog Like a telephone book contains limited information about all people and businesses within a city, the global catalog contains limited information about every object in a forest Within the schema, certain attributes are marked for inclusion in the GC Searches are commonly performed against these attributes By searching against the GC, individual domains do not have to be queried in most cases- GC can resolve Servers that hold a copy of the global catalog are called global catalog servers
- 30. Global Catalog Server Application Solaris.com Ccna.com Mcse.com Configuration Schema Holds read only copy of all other domain directory partitions- all objects, but only attributes marked for GC inclusion Holds full copy of domain partition for own domain Holds full copy of configuration partition for forest Holds full copy of the schema partition for forest Contains application data if configured ForestDNSZone, DomainDNSZone, user-defined application partition(s)
- 31. Global Catalog Servers Global Catalog Server Universal Group membership when user logs on Global Catalog Queries Include in GC Telephone Email Name … Object Attributes Domain Domain Domain