Transcription
Module 1: Introductionto Active DirectoryInfrastructureContentsOverviewLesson: The Architecture of ActiveDirectory12Lesson: How Active Directory Works10Lesson: Examining Active Directory19Lesson: The Active Directory Design,Planning, and Implementation Processes29
Information in this document, including URL and other Internet Web site references, is subject tochange without notice. Unless otherwise noted, the example companies, organizations, products,domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious,and no association with any real company, organization, product, domain name, e-mail address,logo, person, place or event is intended or should be inferred. Complying with all applicablecopyright laws is the responsibility of the user. Without limiting the rights under copyright, nopart of this document may be reproduced, stored in or introduced into a retrieval system, ortransmitted in any form or by any means (electronic, mechanical, photocopying, recording, orotherwise), or for any purpose, without the express written permission of Microsoft Corporation.Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectualproperty rights covering subject matter in this document. Except as expressly provided in anywritten license agreement from Microsoft, the furnishing of this document does not give you anylicense to these patents, trademarks, copyrights, or other intellectual property. 2003 Microsoft Corporation. All rights reserved.Microsoft, MS-DOS, Windows, Windows NT, Active Directory, Active X, MSDN, PowerPoint,Visio, Visual Basic, Visual C , and Windows Media are either registered trademarks ortrademarks of Microsoft Corporation in the United States and/or other countries.The names of actual companies and products mentioned herein may be the trademarks of theirrespective owners.
Module 1: Introduction to Active Directory **illegal for non-trainer use******************************IntroductionThis module introduces the logical and physical structure of the ActiveDirectory directory service and its function as a directory service. The modulealso introduces the snap-ins, the command-line tools, and the Windows ScriptHost that you can use to manage the components of Active Directory and theActive Directory design, planning, and implementing processes.ObjectivesAfter completing this module, you will be able to:!Describe the architecture of Active Directory.!Describe how Active Directory works.!Use administrative snap-ins to examine the components of Active Directory.!Describe the Active Directory design, planning, and implementationprocesses.
2Module 1: Introduction to Active Directory InfrastructureLesson: The Architecture of Active Directory*****************************illegal for non-trainer e Directory consists of components that constitute its logical and physicalstructure. You must plan both the logical and physical structures of ActiveDirectory to meet your organization’s requirements. To manage ActiveDirectory, you must understand the purpose of these components and how touse them.Lesson objectivesAfter completing this lesson, you will be able to:!Describe the function of Active Directory.!Describe the logical structure of Active Directory.!Describe the physical structure of Active Directory.!Describe the operations master roles.
Module 1: Introduction to Active Directory InfrastructureWhat Does Active Directory Do?*****************************illegal for non-trainer e Directory stores information about users, computers, and networkresources and makes the resources accessible to users and applications. Itprovides a consistent way to name, describe, locate, access, manage, and secureinformation about these resources.The function of ActiveDirectoryActive Directory provides the following functions:!Centralizes control of network resources. By centralizing control ofresources such as servers, shared files, and printers, only authorized userscan access resources in Active Directory.!Centralizes and decentralizes resource management. Administrators canmanage distributed client computers, network services, and applicationsfrom a central location by using a consistent management interface, or theycan distribute administrative tasks by delegating the control of resources toother administrators.!Stores objects securely in a logical structure. Active Directory stores all ofthe resources as objects in a secure, hierarchical logical structure.!Optimizes network traffic. The physical structure of Active Directoryenables you to use network bandwidth more efficiently. For example, itensures that, when users log on to the network, they are authenticated by theauthentication authority that is nearest to the user, thus reducing the amountof network traffic.3
4Module 1: Introduction to Active Directory InfrastructureMultimedia: The Logical Structure of Active Directory*****************************illegal for non-trainer use******************************File locationTo view the presentation, The Logical Structure of Active Directory, open theWeb page on the Student Materials compact disc, click Multimedia, and thenclick the title of the presentation. Do not open this presentation unless theinstructor tells you to.ObjectivesAt the end of this presentation you will be able to:Key points!Define the elements of the logical structure of Active Directory.!Discuss the purposes of those elements.Active Directory provides secure storage of information about objects in itshierarchical logical structure. Active Directory objects represent users andresources, such as computers and printers. Some objects are containers for otherobjects. By understanding the purpose and function of these objects, you cancomplete a variety of tasks, including installing, configuring, managing, andtroubleshooting Active Directory.The logical structure of Active Directory includes the following components:!Objects. These are the most basic components of the logical structure.Object classes are templates or blueprints for the types of objects that youcan create in Active Directory. Each object class is defined by a group ofattributes, which define the possible values that you can associate with anobject. Each object has a unique combination of attribute values.!Organizational units. You use these container objects to arrange otherobjects in a manner that supports your administrative purposes. Byarranging objects by organizational unit, you make it easier to locate andmanage objects. You can also delegate the authority to manage anorganizational unit. Organizational units can be nested in otherorganizational units, which further simplifies the management of objects.
Module 1: Introduction to Active Directory Infrastructure!5Domains. The core functional units in the Active Directory logical structure,domains are a collection of administratively defined objects that share acommon directory database, security policies, and trust relationships withother domains. Domains provide the following three functions: An administrative boundary for objects A means of managing security for shared resources A unit of replication for objects!Domain trees. Domains that are grouped together in hierarchical structuresare called domain trees. When you add a second domain to a tree, itbecomes a child of the tree root domain. The domain to which a childdomain is attached is called the parent domain. A child domain may in turnhave its own child domain.The name of a child domain is combined with the name of its parent domainto form its own unique Domain Name System (DNS) name such ascorp.nwtraders.msft. In this manner, a tree has a contiguous namespace.!Forests. A forest is a complete instance of Active Directory. It consists ofone or more trees. In a single two-level tree, which is recommended formost organizations, all child domains are made children of the forest rootdomain to form one contiguous tree.The first domain in the forest is called the forest root domain. The name ofthat domain refers to the forest, such as nwtraders.msft. By default, theinformation in Active Directory is shared only within the forest. This way,the forest is a security boundary for the information that is contained in theinstance of Active Directory.
6Module 1: Introduction to Active Directory InfrastructureMultimedia: The Physical Structure of Active Directory*****************************illegal for non-trainer use******************************File locationTo view the presentation, The Physical Structure of Active Directory, open theWeb page on the Student Materials compact disc, click Multimedia, and thenclick the title of the presentation. Do not open this presentation unless theinstructor tells you to.ObjectivesAt the end of this presentation, you will be able to:Key points!Define the elements of the physical structure of Active Directory.!Discuss the purpose of those elements.In contrast to the logical structure, which models administrative requirements,the physical structure of Active Directory optimizes network traffic bydetermining when and where replication and logon traffic occur. To optimizeActive Directory's use of network bandwidth, you must understand the physicalstructure. The elements of the Active Directory physical structure are:!Domain controllers. These computers run Microsoft Windows Server 2003 or Windows 2000 Server, and Active Directory. Each domaincontroller performs storage and replication functions. A domain controllercan support only one domain. To ensure continuous availability of ActiveDirectory, each domain should have more than one domain controller.
Module 1: Introduction to Active Directory Infrastructure!Active Directory sites. These sites are groups of well-connected computers.When you establish sites, domain controllers within a single sitecommunicate frequently. This communication minimizes the latency withinthe site; that is, the time required for a change that is made on one domaincontroller to be replicated to other domain controllers. You create sites tooptimize the use of bandwidth between domain controllers that are indifferent locations.Note For more information about Active Directory sites, see Module 7,“Implementing Sites to Manage Active Directory Replication” in Course2279: Planning, Implementing, and Maintaining a Microsoft WindowsServer 2003 Active Directory Infrastructure.!Active Directory partitions. Each domain controller contains the followingActive Directory partitions: The domain partition contains replicas of all of the objects in thatdomain. The domain partition is replicated only to other domaincontrollers in the same domain. The configuration partition contains the forest topology. Topology is arecord of all domain controllers and the connections between them in aforest. The schema partition contains the forest-wide schema. Each forest hasone schema so that the definition of each object class is consistent. Theconfiguration and schema partitions are replicated to each domaincontroller in the forest. Optional application partitions contain objects that are unrelated tosecurity and that are used by one or more applications. Applicationpartitions are replicated to specified domain controllers in the forest.Note For more information about Active Directory partitions, see Module7, “Implementing Sites to Manage Active Directory Replication,” in Course2279: Planning, Implementing, and Maintaining a Microsoft WindowsServer 2003 Active Directory Infrastructure.7
8Module 1: Introduction to Active Directory InfrastructureWhat Are Operations Masters?*****************************illegal for non-trainer use******************************IntroductionWhen a change is made to a domain, the change is replicated across all of thedomain controllers in the domain. Some changes, such as those made to theschema, are replicated across all of the domains in the forest. This replication iscalled multimaster replication.Single masteroperationsDuring multimaster replication, a replication conflict can occur if originatingupdates are performed concurrently on the same object attribute on two domaincontrollers. To avoid replication conflicts, you use single master replication,which designates one domain controller as the only domain controller on whichcertain directory changes can be made. This way, changes cannot occur atdifferent places in the network at the same time. Active Directory uses singlemaster replication for important changes, such as the addition of a new domainor a change to the forest-wide schema.Operations master rolesOperations that use single-master replication are arranged together in specificroles in a forest or domain. These roles are called operations master roles. Foreach operations master role, only the domain controller that holds that role canmake the associated directory changes. The domain controller that isresponsible for a particular role is called an operations master for that role.Active Directory stores information about which domain controller holds aspecific role.
Module 1: Introduction to Active Directory Infrastructure9Active Directory defines five operations master roles, each of which has adefault location. Operations master roles are either forest-wide or domain-wide.!Forest-wide roles. Unique to a forest, forest-wide roles are: Schema master. Controls all updates to the schema. The schema containsthe master list of object classes and attributes that are used to create allActive Directory objects, such as users, computers, and printers. Domain naming master. Controls the addition or removal of domains inthe forest. When you add a new domain to the forest, only the domaincontroller that holds the domain naming master role can add the newdomain.There is only one schema master and one domain naming master in theentire forest.!Domain-wide roles. Unique to each domain in a forest, the domain-wideroles are: Primary domain controller emulator (PDC). Acts as a Windows NTPDC to support any backup domain controllers (BDCs) runningMicrosoft Windows NT within a mixed-mode domain. This type ofdomain has domain controllers that run Windows NT 4.0. The PDCemulator is the first domain controller that you create in a new domain. Relative identifier master. When a new object is created, the domaincontroller creates a new security principal that represents the object andassigns the object a unique security identifier (SID). This SID consists ofa domain SID, which is the same for all security principals created in thedomain, and a relative identifier (RID), which is unique for each securityprincipal created in the domain. The RID master allocates blocks ofRIDs to each domain controller in the domain. The domain controllerthen assigns a RID to objects that are created from its allocated block ofRIDs. Infrastructure master. When objects are moved from one domain toanother, the infrastructure master updates object references in its domainthat point to the object in the other domain. The object referencecontains the object’s globally unique identifier (GUID), distinguishedname, and a SID. Active Directory periodically updates thedistinguished name and the SID on the object reference to reflectchanges made to the actual object, such as moves within and betweendomains and the deletion of the object.Each domain in a forest has its own PDC emulator, RID master, andinfrastructure master.Note For more information about operations master roles see, Module 9,Managing Operations Masters in Course 2279: Planning, Implementing, andMaintaining a Microsoft Windows Server 2003 Active Directory Infrastructure.
10Module 1: Introduction to Active Directory InfrastructureLesson: How Active Directory Works*****************************illegal for non-trainer use******************************IntroductionThis lesson introduces the function of Active Directory as a directory service.Understanding how Active Directory works will help you manage resourcesand troubleshoot problems with accessing resources.Lesson objectivesAfter completing this lesson, you will be able to:!Describe the function of Active Directory as a directory service.!Define the purpose of the Active Directory schema and how it is used.!Define the purpose of the global catalog.!Determine the distinguished name and relative distinguished name of anActive Directory object.!Describe how Active Directory enables single sign-on.
Module 1: Introduction to Active Directory Infrastructure11What Is a Directory Service?*****************************illegal for non-trainer rces in large networks are shared by many users and applications. Toenable users and applications to access these resources and information aboutthem, you require a consistent way to name, describe, locate, access, manage,and secure information about these resources. A directory service performs thisfunction.What is a directoryservice?A directory service is a structured repository of information about people andresources in an organization. In a Windows Server 2003 network, the directoryservice is Active Directory.Capabilities of ActiveDirectoryActive Directory has the following capabilities:!Enables users and applications to access information about objects. Thisinformation is stored in the form of attribute values. You search for objectson the basis of their object class, attributes, attribute values, their locationwithin the Active Directory structure, or any combination of these values.!Makes the physical network topology and protocols transparent. This way,a user on a network can access any resource, such as a printer, withoutknowing where the resource is or how it is physically connected to thenetwork.
12Module 1: Introduction to Active Directory Infrastructure!Permits the storage of a very large number of objects. Because it isorganized in partitions, Active Directory can expand as an organizationgrows. For example, a directory can expand from a single server with a fewhundred objects to thousands of servers and millions of objects.!Can run as a non-operating system service. Active Directory in ApplicationMode (AD/AM) is a new capability of Microsoft Active Directory thataddresses certain deployment scenarios related to directory-enabledapplications. AD/AM runs as a non-operating system service and, as such,does not require deployment on a domain controller. Running as a nonoperating system service means that multiple instances of AD/AM can runconcurrently on a single server, with each instance being independentlyconfigurable.Note For more information about AD/AM, see “Introduction to ActiveDirectory in Application Mode” nfo/overview/adam.mspx.
Module 1: Introduction to Active Directory Infrastructure13What Is a Schema?*****************************illegal for non-trainer use******************************IntroductionThe Active Directory schema defines the kinds of objects, the types ofinformation about those objects, and the default security configuration for thoseobjects that can be stored in Active Directory.What is the ActiveDirectory schema?The Active Directory schema contains the definitions of all objects, such asusers, computers, and printers that are stored in Active Directory. On domaincontrollers running Windows Server 2003, there is only one schema for anentire forest. This way, all objects that are created in Active Directory conformto the same rules.The schema has two types of definitions: object classes and attributes. Objectclasses such as user, computer, and printer describe the possible directoryobjects that you can create. Each object class is a collection of attributes.Attributes are defined separately from object classes. Each attribute is definedonly once and can be used in multiple object classes. For example, theDescription attribute is used in many object classes, but is defined only once inthe schema to ensure consistency.Active Directory schemaand extensibilityYou can create new types of objects in Active Directory by extending theschema. For example, for an e-mail server application, you could extend theuser class in Active Directory with new attributes that store additionalinformation, such as users’ e-mail addresses.Note For more information about extending the Active Directory schema, seeExtending the Schema in the MSDN Library online reference.Schema changes anddeactivationOn Windows Server 2003 domain controllers, you can reverse schema changesby deactivating them, thus enabling organizations to better exploit ActiveDirectory’s extensibility features.You may also redefine a schema class or attribute. For example, you couldchange the Unicode String syntax of an attribute called SalesManager toDistinguished Name.
14Module 1: Introduction to Active Directory InfrastructureWhat Is the Global Catalog?*****************************illegal for non-trainer rces in Active Directory can be shared across domains and forests. Theglobal catalog feature in Active Directory makes searching for resources acrossdomains and forests transparent to the user. For example, if you search for all ofthe printers in a forest, a global catalog server processes the query in the globalcatalog and then returns the results. Without a global catalog server, this querywould require a search of every domain in the forest.What is the globalcatalog?The global catalog is a repository of information that contains a subset of theattributes of all objects in Active Directory. Members of the Schema Adminsgroup can change which attributes are stored in the global catalog, dependingon an organization’s requirements. The global catalog contains:What is a global catalogserver?!The attributes that are most frequently used in queries, such as a user’s firstname, last name, and logon name.!The information that is necessary to determine the location of any object inthe directory.!A default subset of attributes for each object type.!The access permissions for each object and attribute that is stored in theglobal catalog. If you search for an object that you do not have theappropriate permissions to view, the object will not appear in the searchresults. Access permissions ensure that users can find only objects to whichthey have been assigned access.A global catalog server is a domain controller that efficiently processesintraforest queries to the global catalog. The first domain controller that youcreate in Active Directory automatically becomes a global catalog server. Youcan configure additional global catalog servers to balance the traffic for logonauthentication and queries.
Module 1: Introduction to Active Directory InfrastructureFunctions of the globalcatalogThe global catalog enables users to perform two important functions:!Find Active Directory information anywhere in the forest, regardless of thelocation of the data.!Use universal group membership information to log on to the network.Note For more information about the global catalog, see Module 8,“Implementing the Placement of Domain Controllers,” in Course 2279:Planning, Implementing, and Maintaining a Microsoft Windows Server 2003Active Directory Infrastructure.15
16Module 1: Introduction to Active Directory InfrastructureWhat Are Distinguished and Relative Distinguished Names?*****************************illegal for non-trainer t computers use the Lightweight Directory Access Protocol (LDAP)protocol to search for and modify objects in an Active Directory database.LDAP is a subset of X.500, an industry standard that defines how to structuredirectories. LDAP uses information about the structure of a directory to findindividual objects, each of which has a unique name.DefinitionLDAP uses a name that represents an Active Directory object by a series ofcomponents that relate to the logical structure. This representation, called thedistinguished name of the object, identifies the domain where the object islocated and the complete path by which the object is reached. A distinguishedname must be unique in an Active Directory forest.The relative distinguished name of an object uniquely identifies the object in itscontainer. No two objects in the same container can have the same name. Therelative distinguished name is always the first component of the distinguishedname, but it may not always be a common name.Example of aDistinguished NameFor a user named Suzan Fine in the Sales organizational unit in theContoso.msft domain, each element of the logical structure is represented in thefollowing distinguished name:CN Suzan Fine,OU Sales,DC contoso,DC msft!CN is the common name of the object in its container.!OU is the organizational unit that contains the object. There can be morethan one OU value if the object resides in a nested organizational unit.!DC is a domain component, such as “com” or “msft”. There are always atleast two domain components, but possibly more if the domain is a childdomain.The domain components of the distinguished name are based on the DomainName System (DNS).
Module 1: Introduction to Active Directory InfrastructureExample of a RelativeDistinguished NameIn the following example, Sales is the relative distinguished name of anorganizational unit that is represented by this LDAP naming path:OU Sales,DC contoso,DC msft17
18Module 1: Introduction to Active Directory InfrastructureMultimedia: How Active Directory Enables a Single Sign-on*****************************illegal for non-trainer use******************************File locationTo view the presentation, How Active Directory Enables a Single Sign-on, openthe Web page on the Student Materials compact disc, click Multimedia, andthen click the title of the presentation. Do not open this presentation unless theinstructor tells you to.ObjectivesAt the end of this presentation, you will be able to:Key points!Describe the process by which Active Directory enables a single sign-on.!Discuss the importance of a single sign-on.By enabling a single sign-on, Active Directory makes the complex processes ofauthentication and authorization transparent to the user. Users do not need tomanage multiple sets of credentials.A single sign-on consists of:!Authentication, which verifies the credentials of the connection attempt.!Authorization, which verifies that the connection attempt is allowed.As a systems engineer, you must understand how these processes work in orderto optimize and troubleshoot your Active Directory structure.
Module 1: Introduction to Active Directory Infrastructure19Lesson: Examining Active Directory*****************************illegal for non-trainer ws Server 2003 provides administrators with snap-ins and command-linetools to manage Active Directory. This lesson introduces these snap-ins andcommand-line tools and explains how you use them to examine the logical andphysical structure of Active Directory.Lesson objectivesAfter completing this lesson, you will be able to:!Explain how Active Directory is designed to enable centralized anddecentralized management.!Describe common Active Directory administrative snap-ins and commandline tools.!Examine the logical and physical structure of Active Directory.
20Module 1: Introduction to Active Directory InfrastructureActive Directory Management*****************************illegal for non-trainer use******************************IntroductionBy using Active Directory, you can manage large numbers of users, computers,printers, and network resources from a central location, using the administrativesnap-ins and tools in Windows Server 2003. Active Directory also supportsdecentralized administration. An administrator with the proper authority candelegate a selected set of administrative privileges to other users or groups in anorganization.How Active Directorysupports centralizedmanagementActive Directory includes several features that support centralized management:!It contains information about all objects and their attributes. The attributescontain data that describes the resource that the object identifies. Becauseinformation about all network resources is stored in Active Directory, oneadministrator can centrally manage and administer network resources.!You can query Active Directory by using protocols such as LDAP. You caneasily locate information about objects by searching for selected attributesof the object, using tools that support LDAP.!You can arrange objects that have similar administrative and securityrequirements into organizational units. Organizational units providemultiple levels of administrative authority, so that you can apply GroupPolicy settings and delegate administrative control. This delegationsimplifies the task of managing these objects and enables you to structureActive Directory to fit your organization’s requirements.!You can specify Group Policy settings for a site, a domain, or anorganizational unit. Active Directory then enforces these Group Policysettings for all of the users and computers within the container.
Module 1: Introduction to Active Directory InfrastructureHow Active Directorysupports decentralizedmanagement21Active Directory also supports decentralized management. You can assignpermissions and grant user rights in very specific ways. For example, you candelegate administrative privileges for certain objects to the sales and marketingteams in an organization.You can delegate the assigning of permissions:!For specific organizational units to different domain local groups. Forexample, delegating the permission Full Control for the Sales organizationalunit.!To modify specific attributes
the physical structure of Active Directory optimizes network traffic by determining when and where replication and logon traffic occur. To optimize Active Directory's use of network bandwidth, you must understand the physical structure. The elements of the Active Directory physical structure are: ! Domain controllers.
