Win2KServer Active Directory
Download as PPT, PDF2 likes528 views
Active Directory (AD) is a directory service integrated into Windows 2000 that centralizes network resource management, enhances security, and enables efficient user and resource management across multiple domains and trees in a hierarchical structure. It uses a multi-master replication model to maintain data consistency and supports various authentication protocols to strengthen network security. AD's architecture consists of logical and physical structures, including domains, organizational units, trees, and forests, which facilitate administrative tasks and user access control throughout a distributed network environment.
Win2KServer Active Directory
- 1. Active Directory Presentation Windows 2000 Server
- 2. Breakdown… • What is Active Directory • Structure of Active Directory • Objects • Domains – Trees and Forests • Replication • Security • Kerberos • Trusts
- 3. Overview of Active Directory • Active Directory is a directory service, which means it both stores data about your network resources and provides methods of accessing and distributing that data. Directory service that stores data about users and groups, shared folders, and other network resources. • Active Directory lets you centrally manage your network. • Administrative tasks can be performed from a single location.
- 4. What Is Active Directory? • Active Directory is an essential and inseparable part of the Windows 2000 network architecture that improves on the domain architecture of the Windows NT 4.0 operating system to provide a directory service designed for distributed networking environments.
- 5. • Active Directory lets organizations efficiently share and manage information about network resources and users. • Active Directory acts as the central authority for network security, letting the operating system readily verify a user’s identity and control for his or her access to network resources. • It acts as an integration point for bringing systems together and consolidating management tasks.
- 6. How does Active Directory Work? • AD lets organizations store information in a hierarchical, object-oriented fashion, and provides multi-master replication to support distributed network environments.
- 7. Single Point of Administration • For all published resources, incl. Files, peripheral devices, host connections, databases, Web access, users, services… • It uses the Internet Domain Name Service (DNS) as its locator service. • No primary domain controller (PDC) or backup domain controller (BDC). Uses domain controllers (DCs). • Allows multiple domains to be connected into a tree structure.
- 8. What are the benefits of Active Directory • Simplifies management tasks. • Strengthens network security. • Makes use of existing systems through interoperability.
- 9. Simplifies Management • Single place to manage users, groups and network resources, as well as distribute software and manage desktop. – Eliminates redundant management tasks. – Reduces trips to the desktop. – Better maximizes IT resources. – Lowers total cost of ownership (TCO).
- 10. • Eliminates redundant management tasks. • Provides a single point of management for Windows user accounts, clients, servers, and applications. • Reduces trips to the desktop. • Automatically distributes software to users based on their role in the company, reducing or eliminating multiple trips that system administrators need to make for software installation and configuration. • Better maximizes IT resources. • Securely delegates administrative functions to all levels of an organization. • Lowers total cost of ownership (TCO). • Simplifies the management and use of file and print services by making network resources easier to find, configure, and use.
- 11. Simplifies Management Delegate Management Tasks to Office Admins Company Users Machines Devices Applications Color Printer Marketing Personnel in Building 6 Give ‘Personnel’ Members the Human Resources Application
- 12. Strengthens Security • Support for multiple authentication protocols such as Kerberos, X.509 certificates, and smart cards. • Flexible access control model – enables powerful and consistent security services for internal desktop users, remote dial-up users, and external commerce customers. • Improves password security and management. • Ensures desktop functionality. • Speeds e-business deployment. • Tightly controls security.
- 13. • Improves password security and management. • Providing single sign-on to network resources with integrated, high powered security services that are transparent to end users. • Ensures desktop functionality. • Locking-down desktop configurations and preventing access to specific client machine operations. Ex: software installations and registry editing. • Speeds e-business deployment. • Built-in support for secure Internet-standard protocols and authentication mechanisms. Ex: Kerberos, public key infrastructure (PKI), lightweight directory access protocol (LDAP). • Tightly controls security. • Setting access control privileges on directory objects and the individual data elements that make them up.
- 14. Extends Interoperability • Active Directory provides a set of standard interfaces for application integration and open synchronization mechanisms to ensure that Windows can interoperate with a wide variety of applications and devices.
- 15. It Does So By… • Taking advantage of existing investments and ensures flexibility. • Consolidating management of multiple application directories. Using open interfaces, connectors, and synchronization mechanisms. Incl. Novell’s NDS, LDAP, ERP, e-mail… • Allowing organizations to deploy directory-enabled networking. Assign quality of service and allocated network bandwidth to users based on their role in the company. • Allowing organizations to develop and deploy directory-enabled applications.
- 16. Interoperability Application: Exchange Policy: Give ‘Personnel’ Mailbox information Access to ‘Change Salary’ Menu options. Company Users Machines Devices Applications Finance Personnel Policy: Give ‘Finance’ more bandwidth at the end of the month.
- 17. Active Directory as a Service Provider • Used to locate all network services and information. • Fulfills a wide variety of naming, query, administrative and registration needs. Submit Exchange Mail DNS Mail Client Mail Microsoft.com Recipient referral Lookup Address Book http/shttp Server Admin/ browse Directory Service Replication SQL Server Register Service Credential Security management Query Dynamic Services
- 18. Directory Partitions • The data stored within AD is actually broken into three distinct areas called directory partitions. • Each partition records and stores a specific type of information. • The three directory partitions that exists: • Domain Partition • Schema Partition • Configuration Partition
- 19. • Domain Partition • Holds data regarding domain-specific objects, including users, groups, and computers. • Schema Partition • Contains data that defines which objects can be created within AD and specifies rules regarding these objects, such as mandatory properties. • Configuration Partition • Contains information about your AD structure, such as domain and DCs that exist.
- 20. The Structure of Active Directory • Active Directory is made up of two distinct structures: • The logical structure. • The physical structure. • Design of Active Directory implementation deals with the logical aspects. • Deciding where each component will be on your network deals with the physical aspects.
- 21. The Logical Structure • There are five logical components in Active Directory: • Domains • Organization Units (OUs) • Trees • Forests • Global Catalogs (GCs)
- 22. Domains • A domain is a security boundary. • Each domain has its own administrators that can be assigned full control over the domain. • Entity which has its own users and groups. • Users can be granted permissions in other domains. • Domains are used for replication purposes. • Can run in one of two modes: • Native (must be running to achieve full functionality) • Mixed
- 23. Organizational Units (OUs) • Organizational Units are container objects that are used to organize objects within the directory. • Commonly contain user and group objects. • They can also contain computers and other OUs. • Permissions can be assigned at the OU level both to grant container objects access to other network resources (or to deny them) and to assign specific users administrative privileges. • Administration of objects within an OU can be delegated. • Assign permissions to manage these objects to groups other than domain administrators.
- 24. Hierarchical Organization • Active Directory uses objects to represent network resources such as users, groups, machines, devices, and applications. • It uses containers to represent organizations, such as marketing department, or collections of related objects, such as printers. • It organizes information in a hierarchical structure made up of these objects and containers, similar to the way the Windows Operating system uses folders and files to organize information on a computer.
- 25. Containers and Objects Company Users Machines Devices Applications Marketing Personnel = Container = Object
- 26. Objects in Active Directory • Objects within AD include users, groups, computers, servers, domains, and sites. • Since data is stored as objects, users can search through the directory for objects they wish to access. • Objects also have attributes which a user can use in his/her search. • In order to understand how data is defined within AD, you must be aware of the Schema.
- 27. The Schema • The Schema is a definition of all the objects and their attributes. • Since there is a single schema for an entire Windows 2000 forest, you can achieve consistency no matter how large the enterprise. • Two types of definitions can be stored in the schema. 1. Object Classes 2. Attributes
- 28. Object Classes • Object classes define the types of objects that can be stored within Active Directory. • Each class consists of a class name and a set of attributes that are associated with the object.
- 29. Attributes • Attributes are stored separately within the schema • Allows for further consistency within the database, because a single definition for the “last name” attribute can be used over and over again.
- 30. Object-Oriented Storage Company Users Machines Devices Applications Marketing Personnel Name: Bob Jones = Container Email: bob@abc.com = Object Phone: 555-1234 SSN: 456-7
- 31. Object-Oriented Storage • In this case, the system administrator has allowed global access to the Bob Jones object, but has locked access of the Social Security Number attribute.
- 32. Schema Security • To prevent it from being modified without permissions, each object is secured using Discretionary Access Control Lists (DACLs). • These DACLs ensure that only authorized users are able to access schema.
- 33. A little more about Schema • The file schema.ini contains the default schema’s definition, as well as the initial structure for the file ntds.dir (stores directory data). • The %systemroot%ntds directory contains the file schema.ini. • The file is in plain ASCII format.
- 34. Trees • Domains are combined to produce a tree. • A hierarchical representation of the Windows 2000 network. • First domain installed is called the root domain and all subsequent domains are installed beneath this root domain. • All domains is a tree share a common schema and GC.
- 35. Domain Tree • A domain tree exists when one domain is the child of another domain. • Ex. Root.com – since domains are DNS names. • If the administrator renames a part of the tree, all of the parent’s children are also implicitly renamed. • Ex. ntfaq.com renamed to backoffice.com, the child domain sales.ntfaq.com would change to sales.backoffice.com
- 36. Domain Tree Diagram root.com child1.root.com child2.root.com These child domains continue to utilize the same contiguous name (root.com) while branching out with additional naming for organizational gran.child1.root.com purposes. Ex. child1.root.com
- 37. Domain Tree Advantages • All members of a tree have Kerberos transitive trusts with the domain’s parent and all the domain’s children. • Transitive trusts also let any user or group in a domain tree obtain access to any object in the tree. • You can use one network logon at any workstation in the domain tree.
- 38. Forests • A forest is a collection of trees. • Tree in a forest do not have to share a contiguous namespace. • Must share a common schema and GC. • Forests allows users in two different trees to access resources in a different namespace. • Useful when a company has multiple root DNS addresses.
- 39. Forest Diagram Transitive Kerberos Trust Joining the two trees makes a forest root.com ntfaq.com child1.root.com child2.root.com legal.ntfaq.com ads.ntfaq.com gran.child1.root.com banner.ads.ntfaq.com
- 40. Benefits of a Forest • All the trees have a common Global Catalog (GC) that contains specific information about every object in the forest. • All the trees contain a common schema. • Performing a search in a forest initiates a deep search of the entire tree in the domain you initiate the request from and uses GC entries for the rest of the forest.
- 41. Global Catalogs (GCs) • A GC server is also a DC (Domain Controller). • It contains data about all objects within a forest. • GC contains the permissions list for all the objects, therefore can also grant access. • Stored locally on a DC – reduces network traffic. • Benefit: • To make the logical structure of the Windows 2000 network invisible to the users. • Reduction of network traffic.
- 42. Purpose of Global Catalog • Designed for high performance. • Allows users to easily find an object regardless of where it is in the tree – searching using selected attributes. • Attributes contained in a abbreviated catalog. • Technique known as partial replication.
- 43. Global Catalog Structure Domain 1 Partial Replicas Domain 2 Full Replicas Domain n The global catalog structure provides access to full and partial replication.
- 44. Physical Structure • Used to manage network traffic on the network. • Element that makes up the physical structure: • Domain controllers (DCs)
- 45. Domain Controllers (DCs) • A domain controller (DC) is a server on a Windows 2000 network that stores a replica of the Active Directory database. • Its job is to manage access to this data via searches and also accept and make changes to the data. • Replicates changes to all other DCs in the domain. • Manage authentication of users. • Assigning a security token that contains a list of group memberships and permissions to each user.
- 46. Replication • Replication ensures that data recorded in one copy is disseminated to all other copies in the domain. • Windows 2000 uses multi-master replication. • Each DC is a master of its copy of AD. • The DC can accept changes and will then propagate them out to other DCs. • Replication – updating information from one DC to another.
- 47. The Replication Process • Replication occurs when an update is made to a copy of AD. • Changes such as new user, deletion of an object, or modification to a single property of an object. • AD performs two types of updates: • Originating update – occurs only the first time a change is made to an AD replica. • Replicated update – occurs as a result of this change.
- 48. Multi-master Replication • Individual change made in one copy of the directory are automatically replicated to all other appropriate copies of the directory. • Active Directory uses Update Sequence Numbers (USNs). • Anytime a users writes something into an object in the directory, it gets a USN, which is held per computer and incremented any time a change is made. • A change cannot occur without the USN being incremented, therefore changes cannot be lost.
- 49. Update Sequence Number (USN) • These are stored in memory, in a table called the up- to-dateness table. • This table has an entry for every DC in the domain, along with the USN number at the time of the last originating update for that DC. • Ex. Entry for server A, changes caused the USN to increment to “130”, entry would be “A-130”. • USNs can be used to prevent unnecessary data being sent across the network. • Replication in AD is pulled only; data is never pushed across the wire.
- 50. USN Table • Each DC keeps track of the highest USNs of the DCs it replicates with. • This procedure lets a DC calculate which changes must replicate on a replication cycle. • At the start of a replication cycle, each server checks its USN table and queries the DCs it replicates with for the DCs latest USNs.
- 51. USN Table for Server A Domain Domain Domain • Server A queries the DC’s for Controller Controller Controller their current USNs and gets B C D the following information. 54 23 53 • From this information, Server Domain Domain Domain A can calculate the changes it Controller Controller Controller need from each server as B C D follows. 58 23 64 Domain Domain Domain • Server A then queries each Controller Controller Controller DC for the necessary changes. B C D 55-58 None 54-64
- 52. Property Version Number • Multiple changes to an object’s property can occur. • Every property has a property version number, which helps detect collisions. • Property version numbers work like USNs. • Each time a property is modified, the property version number increases by one.
- 53. Collision • A collision occurs when the property number version numbers are the same for two or more property updates. • In this case, the timestamps helps resolve the conflict. • In the case where the property version numbers and the timestamps match, a binary buffer comparison occurs; the larger buffer size change takes precedence.
- 54. Object Security Security Principal Security ID (SID) Security Descriptor Discretionary Access Control List (DACL) System Access Control List (SACL) Access Control Entries (ACEs) Access Tokens
- 55. Security Principal • This is an account to which permissions can be assigned-example, a user, a group, or a computer account. • Ex. • Bob, a member of the Accounting group on a computer with a domain computer account named System01, several security principals are involved that permissions could be applied toward-namely, the user “Bob”, the group “Accounting”, or the computer account “System01”
- 56. Security ID (SID) • Every security principal is issued a unique SID that is assigned once to an account and is never reused, even if the object is removed. A numeric value that is assigned automatically when an object is added to the directory. • The SID is a numeric value that is assigned automatically when an object is added to the directory.
- 57. Security Descriptor • Defines access control information for that object. • When a user attempts to access an object, the descriptor check its information against the user’s SID and then compares the SID against its access control list (ACL). • There are two types of ACLs: • DACLs • SACLs
- 58. Discretionary Access Control List (DACL) • List of access control entries (ACEs) that indicates security levels of Allow Access or Deny Access permissions. • Deny Access entries are placed first in the ACE. • The Deny will prove stronger than all the other options.
- 59. System Access Control List (SACL) • This is a list used for auditing object access based upon ACEs that indicates to the object when an account has accessed an object or has attempted to access an object.
- 60. Access Control Entries (ACEs) • ACEs are used by DACLs and SACLs. • When used with a DACL, the ACE determines the level of security access upon an object, through 4 types: • Access Denied • Access Allowed • Access Denied Object Specified • Access Allowed Object Specified • When used with a SACL, the ACE determines the level of security based upon: • System Audit • System Audit Object Specific
- 61. Access Tokens • When the user logs on, an access token is created and sent by the DC to the user’s machine. • This token is necessary for a user to access any network resource. • The access token is attached to that user and is needed to access any object, to run any application, and to use any system resources.
- 62. Access Permissions on AD Objects • The five standard permissions that can be applied to an object are: • Full Control • Write • Read • Create All Child Objects • Delete All Child Objects
- 63. • Full Control • Allows the user the ability to view objects and attributes, the owner of the object, and the AD permissions, along with the ability to change any of those settings. • Write • Enables the user to view objects and attributes, the owner of the object, and the AD permissions, also allows the user to change any of those settings. • Read • Enables the user to view objects and attributes, the owner of the object, and the AD permissions. • Create All Child Objects • Enables the user to create additional child objects to the OU (Organizational Unit). • Delete All Child Objects • Enables the user to delete existing objects from an OU.
- 64. The Flow of Permissions • The implementation of inheritance is utilized by Windows 2000. • Inheritance is automatic for child objects within parent containers; • Ex. If a parent object has permissions implemented upon it, the child objects beneath will automatically inherit the permissions from above.
- 65. The Flow of Inheritance Parent OU When you create a child Parent object within a parent Permissions: container that holds certain Administrator: Full Control permissions, the child Users: Read object automatically Sales OU Research OU contains the permissions of its parent. Child Child Permissions: Permissions: Administrator: Full Control Administrator: Full Control Users: Read Users: Read
- 66. Kerberos v5 • Developed by a team at MIT • Named after the three-headed dog in Greek mythology that guarded the gates of Hades. • There are three sides to Kerberos authentication: • User • Server • Key Distribution Center (KDC)
- 67. Like its Greek Counterpart… • User • A client that has a need to access resources off a server. • Server • Offers a service, but only to those that can prove their identity. That proven identity doesn’t guarantee access to the service; it just proves that they even have a right to request a service. • Key Distribution Center (KDC) • An intermediary between the client and the server that provides a way of vouching that the client is really who it says it is.
- 68. Kerberos Trust The trust relationships that connect members of a tree or forest are two-way, transitive Kerberos trusts. Thus, all the domains in a tree implicitly trust all the other domains in the tree or forest. DC DC DC
- 69. • Kerberos is Windows 2000’s primary security protocol. • Verifies a user’s identity and a session’s integrity. • Each DC (Domain Controller) has Kerberos services on it and every Windows 2000 workstation has a Kerberos client.
- 70. A Kerberos Transaction 1. A user logs on to the domain by supplying a username, a password, and a domain choice. Kerberos steps in and checks the info. Against the DC’s KDC database to verify that it knows the user. 2. If the user is valid, the user is provided a ticket- granting ticket (TGT). This means the user is preauthorized to access other resources on the domain. • In future transactions, the client doesn’t have to re-authenticate; rather, it presents the TGT to the KDC. This speeds up the process.
- 71. 1. If a client wants to access a server—for example, the internal mail server in order to obtain his/her email—he/she can now present that TGT to the KDC ticket-granting server (TGS). This server will give the client another ticket which although doesn’t grant permission to the mail server, rather, it authenticates the client to the mail server. 2. The email server checks to see if you have permission to read the mail. If so, the client will receive the mail.
- 72. The Four Steps of Kerberos KDC Print Server 3 4 2 1 KDC Client
- 73. Trusts • Trusts allow the domains to work with the user accounts from other domain in such a way that people in one domain can share resources with others. • The transitive concept enables smoother functionality. • Transitive means “by extension” • Under Win2000, the trust is automation between parents and children, and transitive between every other domain in the tree.
- 74. Transitive Trusts • Transitive trusts allow users in all connected domains to be validated as domain users. • Permissions are not transitive.
- 75. Two-way Transitive Trusts • If child domain a.corp.com trusts corp.com and corp.com trusts b.corp.com, then a.corp.com automatically trusts b.corp.com. corp.com a.corp.com b.corp.com
- 76. Few Points About Transitive Trusts They are two-way agreements that are automatically created. They exist between child domains and parents or the root domains of a forest. The trusts are transitive because the trees and forests with connecting trusts make information available with no further trust configuration issues. After trusts are established, permissions must be granted to an individual or group to allow them to access resources.
- 77. Summary of Features and Benefits • Support for open standards to facilitate cross- platform directory services, incl. DNS and standard protocols – LDAP. • Support for standard name formats to ensure ease of migration. • Fast lookup via the global catalog. • Multi-master replication. • Backward compatibility. • Interoperability with NetWare environments.
- 78. Installation of Active Directory • Installed using ‘dcpromo.exe’, which can be executed from the ‘Run’ dialog box. • ‘dcpromo.exe’ resides on the Windows 2000 partition. • ‘dcpromo.exe’ is an Active Directory installation wizard, which guides the user in a step by step installation. • Installation of Active Directory requires both a FAT and a NTFS partition.