Overview of Active Directory Domain Services Lesson 1
Chapter Objectives • Identify Active Directory functions and Benefits. • Identify the major components that make up an Active Directory structure. • Identify how DNS relates to Active Directory. • Identify Forest and Domain Functional Levels.
Directory Service • A network service that identifies all resources on a network and makes those resources accessible to users and applications. • The most common directory service standards are: • X.500 • Lightweight Directory Access Protocol (LDAP)
X.500 • Uses a hierarchical approach in which objects are organized in a similar way to the files and folders on a hard drive.
Lightweight Directory Access Protocol (LDAP) • Industry standard. • Slim-down version of X.500 modified to run over the TCP/IP network.
Active Directory • A directory service that uses the “tree” concept for managing resources on a Windows network. • Stores information about the network resources and services, such as user data, printer, servers, databases, groups, computers, and security policies. • Identifies all resources on a network and makes them accessible to users and applications.
Active Directory • Used in: • Windows 2000 • Windows Server 2003 • Windows Server 2008 • Subsequent versions of Active Directory have introduced new functionality and security features.
Active Directory • Windows Server 2008 provides two directory services: • Active Directory Domain Services (AD DS) • Active Directory Lightweight Directory Services (AD LDS)
Active Directory Domain Services (AD DS) • Provides the full-fledged directory service that is referred to as Active Directory in Windows Server 2008 and previous versions of Windows Server.
Active Director Lightweight Directory Services (AD LDS) • Provides a lightweight, flexible directory platform that can be used by Active Directory developers without incurring the overhead of the full-fledged Active Directory DS directory service.
Domain Controller (DC) • Server that stores the Active Directory database and authenticates users with the network during logon. • Stores database information in a file called ntds.dit. • Active Directory is a multimaster database. • Information is automatically replicated between multiple domain controllers.
Active Directory Functions and Benefits • Centralized resource and security administration. • Single logon for access to global resources. • Fault tolerance and redundancy. • Simplified resource location.
Centralizing Resources and Security Administration • Active Directory provides a single point from which administrators can manage network resources and their associates’ security objects: • MMC Consoles found in Administrator Tools: • Active Directory Users and Computers • Active Directory Sites and Services • Active Directory Domains and Trusts • ADSI Edit
Fault Tolerance and Redundancy • Active Directory uses a multimaster domain controller design. • Changes made on one domain controller are replicated to all other domain controllers in the environment. • It is recommended to have two or more domain controllers for each domain.
Read-Only Domain Controller (RODC) • Introduced with Windows Server 2008. • A domain controller that contains a copy of the ntds.dit file that cannot be modified and that does not replicate its changes to other domain controllers with Active Directory.
Simplifying Resource Location • Allows file and print resources to be published within Active Directory. • Examples include: • Shared folders • Printers
Active Directory Components • Forests – One or more domain trees, with each tree having its own unique name space. • Domain trees – One or more domains with contiguous name space. • Domains – A logical unit of computers and network resources that defines a security boundary.
Active Directory Components • Some of these common attributes are as follows: • Unique name • Globally unique identifier (GUID) • Required object attributes • Optional object attributes
Understanding the Schema • Defines the objects stored within Active Directory the properties (attributes) associated within each object. • User has different properties, which has different properties than a group, which has different properties of a computer.
Active Directory Naming Standard • Example: • cn=JSmith, ou=sales, dc=lucernepublishing, dc=com
Domain Name System (DNS) • Provides name resolution for a TPC/IP network. • Active Directory requires DNS as the default name resolution method. • Example Resource Records (RR): • Host (A) – Host name to IP. • Pointer (PTR) – IP to Host name. • Service (SRV) – Locator service for LDAP/Domain controllers services.
Functional Levels • Allows interoperability with prior versions of Microsoft Windows. • Higher levels of functional level will not allow older versions of Windows to function but will add additional functionality or features. • Raising functional level is a one-way process.
Domain Functional Levels
Forest Functional Levels
Using Forest Functional Levels • To raise the functional level of a forest, you must be logged on as a member of the Enterprise Admins group. • The functional level of a forest can be raised only on a server that holds the Schema Master role.
Trust Relationships • Active Directory uses trust relationships to allow access between multiple domains and/or forests, either within a single forest or across multiple enterprise networks. • A trust relationship allows administrators from a particular domain to grant access to their domain’s resources to users in other domains.
Trust Relationships • When a child domain is created, it automatically receives a two-way transitive trust with its parent domain. • Trusts are transitive: If domain A trusts domain B And domain B trusts C Then domain A trusts domain C
Chapter Summary • Active Directory is a database of objects that are used to organize resources according to a logical plan. • These objects include containers such as domains and OUs in addition to resources such as users, computers, and printers. • The Active Directory schema includes definitions of all objects and attributes within a single forest. • Each forest maintains its own Active Directory schema.
Chapter Summary • Active Directory requires DNS to support SRV records. • Microsoft recommends that DNS support dynamic updates.
Chapter Summary • Domain and forest functional levels are new features of Windows Server 2008. • The levels defined for each of these are based on the type of server operating systems that are required by the Active Directory design. • The Windows Server 2003 forest functional level is the highest functional level available and includes support for all Windows Server 2003 features.
Chapter Summary • Two-way transitive trusts are automatically generated within the Active Directory domain structure. • Parent and child domains form the trust path by which all domains in the forest can traverse to locate resources. • The ISTG is responsible for this process.
Chapter Summary • Cross-forest trusts are new to Windows Server 2003, and they are only available when the forest functionality is set to Windows Server 2003. • They must be manually created and maintained.
