Windows 2000 Active Directory Second Edition P2

Chia sẻ: Tuyen Thon | Ngày: | Loại File: PDF | Số trang:20

Thêm vào BST

Báo xấu

94
lượt xem 11
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

In November 1996, Microsoft delivered the ﬁrst preview of Active Directory for developers at the Professional Developers Conference held in Long Beach, California. At the time, it was just the directory service that was shipped with Windows NT 5.0, and the preview included many of other Windows NT 5.0 features. A lot of changes have taken place since then. For one,Windows NT 5.0 was renamed Windows 2000, and then it was released to the public ofﬁcially in February 2000, four years after its original preview to developers. The change of the name from Windows NT 5.0 to Windows 2000 was...

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Windows 2000 Active Directory Second Edition P2

Chapter 1 Introduction to Active Directory Solutions in this chapter: s Introduction to Directory Services s Introduction to Active Directory s Active Directory Architecture Summary Solutions Fast Track Frequently Asked Questions 3
4 Chapter 1 • Introduction to Active Directory Introduction In November 1996, Microsoft delivered the ﬁrst preview of Active Directory for developers at the Professional Developers Conference held in Long Beach, California. At the time, it was just the directory service that was shipped with Windows NT 5.0, and the preview included many of other Windows NT 5.0 features. A lot of changes have taken place since then. For one,Windows NT 5.0 was renamed Windows 2000, and then it was released to the public ofﬁcially in February 2000, four years after its original preview to developers. The change of the name from Windows NT 5.0 to Windows 2000 was a sur- face change only.Windows 2000 inherits the NT technology legacy from pre- vious versions. It has been established as the basic network operating system for Microsoft’s .NET platform. All .NET services run on Windows 2000 Server. Applications developed with the .NET framework also require servers to be running Windows 2000.The directory service used by .NET applications is Active Directory. The question remains, then, how can you take advantage of Active Directory and use its capabilities to reach your business objectives, not only for the present, but also in the future? That is the question that this book will answer. Introduction to Directory Services It would be tough to claim that Active Directory is the ﬁrst directory service ever created. In fact, directory services have been available in a variety of network operating systems (NOS). Directory services are used primarily for organizing, locating, and managing network information. People use directory services without even knowing they are doing so. Because it is used to translate server names to Internet Protocol (IP) addresses, the Domain Name System (DNS) is the most widely used directory service in the world. DNS is rather “usage-speciﬁc,” meaning that it organizes only a lim- ited amount of information about network hosts. DNS stores data about servers, their IP addresses, and services that they offer to the network. Although this is pretty much the extent of DNS, other directory services do not have the same limitations. A directory service can organize all sorts of information about a net- work. Usually, this information falls into the following categories: s Network resources Servers, printers, and other devices on a network. s Network services Capabilities on the network such as ﬁle storage, printing, and e-mail. www.syngress.com
Introduction to Active Directory • Chapter 1 5 s Network users and groups Identiﬁers for users on a network and for groups of users. As you can see, a directory service organizes the pieces of a network, enabling a way to create relationships between the pieces.The relationships between these pieces are what make the directory service so powerful. For example, in DNS, a DNS client computer can query a DNS server to ﬁnd out the IP address of a server that it wants to contact.The DNS server receives the host name and returns the IP address in short order. More complex relationships can be created in more complex directory services, such as providing access to network resources and services for users who logon. Directory Enabled Networks The Distributed Management Task Force (DMTF) is developing a standard for Directory Enabled Networks (DEN).You can access the DMTF Web site at www.dmtf.org. Even though many network operating systems support one or more types of directory services, most of those directory services are vendor spe- ciﬁc.This means that one server on a network might be able to access one partic- ular directory, but another server on the same network will not be able to access that directory simply because it is running a different vendor’s network operating system. As a result of using multiple network operating systems, you might be using multiple directory services on a single internetwork.This poses problems for users who are faced with multiple logons and for network administrators who must manage information that is duplicated across multiple directory services. As vendors create DEN-compliant directories, multiple network operating systems will be able to participate in a single directory service.This will solve the challenges of managing the same information in multiple directory stores. It will also reduce the number of logons that a user must execute in order to access net- work resources. The standard directory service being developed for DEN will extend beyond the simple organization of addresses and host names that DNS provides. Instead, the directory service will organize all the services and resources participating in a network, depicted in Figure 1.1. Once the DEN standard is ﬁnalized, Microsoft intends to make Active Directory comply with that standard. DEN standards eventually will apply to all future directory services, and also to a variety of network resources and services. For example, a router can comply with the DEN standard and automatically integrate with the DEN-compliant directory service running on a network. An object would be created in the www.syngress.com
6 Chapter 1 • Introduction to Active Directory directory service to represent that router. A variety of values for the router would be applied and the administrator could apply policies to the router and the trafﬁc that ﬂowed across it. In fact, because the DEN-compliant directory service included user objects, the trafﬁc that was associated to a particular user could be managed with the router performing queries against the directory service. In practice, an executive might be granted more bandwidth usage and the router would provide that to trafﬁc associated with that executive. All of this would be possible using queries against the directory service’s policies, without needing to know the IP addresses of the computers used or the location of the user. Figure 1.1 Directory Service Structure Application License Network Printer File Server el cel > > OK Next Canc Can Cancel> < B ack Next Directory Service • Organizes • Manages Information • Applies Security Settings User • Enables Access E-Mail Address DHCP Address DNS Address/Hostname History of the Directory Service In the not-too-distant past, networks were server-centric.. Each server had its own security system, which consisted of user accounts, group accounts, and net- work resources. It would associate those user accounts to the ﬁles, directories, printers, and other services or resources that it had to offer.These associations had a value to them, such that one person could have more access to one network resource than another person, simply due to the rights assigned to user and group accounts. In a way, this server-centric system was one of the ﬁrst directory services, but one whose scope existed only on a single server. www.syngress.com
Introduction to Active Directory • Chapter 1 7 Networks ﬁrst popped up in the military as a method to share data quickly across great distances.They offered a major advantage in times of war. Money was one of the main reasons that networking became prevalent in businesses. Hard drives were extremely expensive, as were printers. Many of the ﬁrst corporate networks sprang up out of a need to share printers and precious hard-drive space among multiple computers. Soon, these servers’ hard drives would ﬁll up.They would run out of printer ports. At some point in time, another server would be added to the network to allow further storage of shared ﬁles or to add new printers. Once an administrator established a server to share ﬁles and printers, the administrator was faced with an issue—how to protect sensitive ﬁles and printers from unauthorized users while allowing use of the remaining ﬁles and printers. In some cases, the administrator wanted to allow some users limited access to a ﬁle or a printer. Access rights were added to the system, and users given speciﬁc logon IDs.The server could then easily share ﬁles and printers to the correct users, depending on the administrator’s conﬁguration. When a network contained more than one server, administration became dif- ﬁcult. If a user needed to access ﬁles or printers residing on two or more servers, that user needed to know how to access each speciﬁc server. In addition the user needed a separate logon ID and password for each server. Some administrators used naming conventions to ensure that a user did not need to have more than one unique logon ID. Sometimes, a network had multiple administrators with different naming conventions, providing users with two or more unique logon IDs. For administrators, it was difﬁcult to keep passwords synchronized since each server might have a different timing mechanism to enforce password changes. For users, the end result in a multiserver environment was a convoluted and difﬁcult process of remembering the location of resources, remembering the correct logon ID, and remembering the correct current password, all just to be able to access resources on the network. Network operating systems soon developed a variety of ways to use a single logon ID and password to access multiple servers. For example, Microsoft Windows NT uses a domain architecture. An NT domain is a group of Windows NT servers that participate in a single security system listing users, groups, and network resources. It consists of a primary domain controller (PDC), any number of backup domain controllers (BDCs), and any number of member servers and client computers.The PDC is the security manager of the domain. BDCs main- tain a read-only copy of the security database, and the PDC remains the single point of change control. Member servers and client computers contact the www.syngress.com
8 Chapter 1 • Introduction to Active Directory domain controller (DC) to access network resources. Because of their member- ship, a PDC or BDC in the domain can use the security database to authenticate users to access resources. A member server can use the security database by querying a PDC or BDC. A domain is logically established in the structure shown in Figure 1.2. Figure 1.2 The Components of a Single Domain el > cel OK Can Next Canc Next Cancel Next > < Back Member Servers Domain Controllers of Client Computers Windows NT Domain Network Printers Users A domain is a security boundary, which means that if you need to separate one security set from another, you will need to have more than one domain. Using trust relationships, you could have multiple domains. A trust relationship is established between two domains. In order to enable users of domain A to access the resources such as the ﬁles and printers of domain B, domain B must trust domain A.When drawn out, this trust relationship is shown as an arrow pointing from the trusting domain to the trusted domain. Microsoft deﬁnes various models for a multiple domain structure: s Master Domain model All resource domains trust a single Master Domain that contains all user accounts.This is depicted in Figure 1.3. s Multiple Master Domain model All resource domains trust all Master Domains. Master Domains contain user accounts. Each Master Domain trusts all other Master Domains. s Single Domain model There is only a single domain that contains all users and resources.There is no trust relationship with other domains. s Complete Trust model All domains trust each other, regardless of whether they contain users, resources, or both. www.syngress.com
Introduction to Active Directory • Chapter 1 9 Figure 1.3 Legacy Windows NT Master Domain Model > el cel OK Can Canc Next Cancel Next > < Back Domain Controllers Member Servers Master of Client Computers Network Printers Users el > cel el > cel OK OK Can Canc Next Can Canc Next Cancel Next > < Back Cancel Next > < Back Member Servers Member Servers Domain Controllers Domain Controllers of Client Computers of Client Computers Resource Domain Resource Domain Network Printers Network Printers Domains contain the rudimentary elements of a directory service.They enable multiple servers to look up information and use it for authenticating users and granting those users access to network resources. Although a domain is effec- tive as a security model for a small or medium-sized organization, it does not have some of the features that a directory service can offer. An NT domain struc- ture is ﬂat rather than hierarchical like most directory services, which means that security cannot be applied at different levels. Since each domain is its own administrative area, the only way to implement distributed administration is to have multiple domains. Legacy NT domains require a signiﬁcant amount of trafﬁc between clients and the PDC or a BDC.These domains also require the security database to be copied from a PDC to the BDCs on a periodic basis.This trafﬁc overhead is undesirable over wide area network (WAN) links that may have a limited amount of bandwidth available, or that are costly to transmit trafﬁc across.To reduce this overhead, multiple domains can be created such that no domain spans a WAN link. Trust relationships between multiple domains become cumbersome as more domains are added. As a result, trade-offs may be made between WAN performance or administrative needs and domain structures. www.syngress.com
10 Chapter 1 • Introduction to Active Directory Directory services were developed as a way to overcome single server and domain architecture limitations.They are usually organized in a hierarchical fashion, encompass multiple servers and resources, and offer fully distributed administration. Furthermore, directory services normally are established in an efﬁcient database that is distributed throughout the network to prevent WAN overhead issues. Designing & Planning… The X.500 Directory Standard Many directory services state that they are X.500 compliant. X.500 is a directory service standard ratified by the International Tele- communications Union (ITU-T) in 1988 and modiﬁed in 1993 and 1997. It was intended to provide a means to develop an easy-to-use electronic directory of people that would be available to all Internet users. The X.500 directory standard speciﬁes a common root of a hierar- chical tree. Contrary to its name, the root of the tree is depicted at the top level, and all other containers (which are used to create “branches”) are below it. There are several types of containers with a speciﬁc naming convention. In this naming convention, each portion of a name is spec- iﬁed by the abbreviation of the object type or container it represents. A user has a CN= before the username to represent its “Common Name,” a C= precedes a country, and an organization is heralded by an O=. When compared to IP domain names—for example, host.subdomain .domain—the X.500 version of CN=host/C=US/O=Org appears exces- sively complicated. Each X.500 local directory is considered a Directory System Agent (DSA). The DSA can represent either single or multiple organizations. Each DSA connects to the others through a Directory Information Tree (DIT), which is a hierarchical naming scheme that provides the naming context for objects within the directory. Although Active Directory is derived from the X.500 model, Active Directory does not implement all of the X.500 protocols because of the excess overhead involved or the lack of their general usage. These protocols include: Continued www.syngress.com
Introduction to Active Directory • Chapter 1 11 s Directory Access Protocol (DAP) s Directory Information Shadowing Protocol (DISP) s Directory Operational Binding Management Protocol (DOP) s Directory System Protocol (DSP) Active Directory does implement the Lightweight Directory Access Protocol (LDAP), which affords an effective combination of DAP and DSP features without involving any excess overhead. What Is in a Directory Service? A directory is a place to store information.The type of information that is stored in a directory falls into three basic categories: s Resources s Services s Accounts Resources are the components attached to the network and made available to users. Examples of resources are: s A server’s hard drive s An IP address s A fax modem s A scanner s A printer s Any “thing” that can be used by a client workstation Services run from a server and usually interface to the heart of the Network Operating System.They provide functions on the network, usually so that resources can be shared. Most services are simply network applications, such as a messaging service that allows users to send e-mail.These two categories typically are related. For most services, there is an analogous resource, and for most resources, there is an analogous service (see Table 1.1). Sometimes, however, a resource or a service stands alone. www.syngress.com
12 Chapter 1 • Introduction to Active Directory Table 1.1 Examples of Resources and Analogous Services Resource Service that Supplies the Resource to Users Server hard drive File service IP address Dynamic Host Control Protocol (DHCP) Application Application service Printer Printing service Messaging database Messaging service Terminal Terminal service such as Telnet Modem FAX service VPN Connection Remote Access Service (RAS) The ﬁnal category in a directory is an account. An account is usually a logon ID and associated password used for access to the network. Groups work in a similar manner to user accounts. Directory services can contain a variety of other objects that are security principals, such as aliases. All objects that are used princi- pally for logon or authentication to resources for a user fall in the account cate- gory. A security principal is an object that can be granted the right to use a service or a resource. Each resource, service, and account is stored as an object in the directory.The hierarchy within the directory service, along with some planning, offers a consis- tent way to name, organize, access, administer, and secure the network. A direc- tory service, then, becomes the center of network operations for all servers providing services and resources, and for all client workstations and users requesting access to the services and resources.The information in the directory service manages how the services, resources, and accounts relate to each other. Each object in the directory service includes a set of properties, or attributes. For example, a user account property might be the city in which the user resides, or a DNS hostname would have the property for the IP address that host has been assigned. Each one of the attributes for a speciﬁc object in the directory can be given a value. For example, a user account property named “City” may have the value of “Paris” for the user account named “Joe.” Not all properties must be given values. Access Control Lists (ACLs) manage the security relationship between resources, services, and accounts. ACLs maintain a list containing the information about whether an account has been granted the privilege to access a given service or resource located in the directory. An ACL can even grant the privilege to access other accounts and their properties for administration purposes. www.syngress.com
Introduction to Active Directory • Chapter 1 13 A directory service may have one of three different structures: s A ﬂat ﬁle, where all the elements are lumped together in a single group, and all rights and privileges must be granted explicitly s Multiple groups in a relationship with each other to provide a ﬂow- through path for rights and privileges s A hierarchical tree structure, where rights and privileges can be inherited through nested Organizational Units (OUs) A well-planned organization of the directory service is critical to reducing administrative overhead. Administrative functions can beneﬁt from a hierarchical structure, but only when it is organized to take advantage of the hierarchy. Even when a directory service has a hierarchical structure, if you don’t implement that hierarchy or don’t design it to reduce administrative functions, then the native structure does not offer any beneﬁts. The Directory Database A directory typically is implemented in the form of a database, or directory store. Databases have a speciﬁc organizational composition called a schema. A schema deﬁnes the types of objects and properties that can exist in the directory. The database store is distributed throughout an internetwork with partitions of it being placed on special servers known as domain controllers. Many times, these partitions are called replicas because there are copies of them on multiple servers for redundancy. A directory service that is distributed and copied across multiple servers enables the same information to be accessible to a person in Tokyo, Japan as it is to a person in London, England. Distributed directory services are highly effective, with replicas offering failover so that users can always log on or query the database from any network location. It would not be efﬁcient if all people around the world were required to access a single server to ﬁnd information.That situation would present serious bandwidth concerns, not to mention the fact that it presents a single point of failure if that one server went down. However, placing replicas on strategic servers throughout an enterprise network provides a method of access that does not overwhelm the network, as well as a method of fault tolerance. When there are multiple replicas of a database, they must be synchronized so that updates to the information are identical throughout the entire installed set. The process of synchronization of information between multiple hosts is usually www.syngress.com
14 Chapter 1 • Introduction to Active Directory called convergence.The more efﬁcient a network is, the less time it takes for the network to be fully converged once a change has been made. Communication between the servers during convergence is handled best via a transaction-oriented database update protocol. A transaction-oriented database update protocol does not send entire copies of the directory across the network. Instead, as the name implies, it sends only the information changed due to some database transaction.This process is less time-consuming and bandwidth-intensive because only updates need to be changed throughout the replicas and not the entire database copied from server to server. Even when an object has a single property update, such as a change to a user account’s phone number, it is not necessary to copy the entire object with all its properties to each database replica. Instead, only the property value that changed needs to be updated along with enough information to locate the object for which the value has changed. For example, when a user is married, she may change her name.The Network Administrator would edit the Last Name prop- erty of the user account.The only information that must changed on the database replicas is that last-name property and the location of the user account object in the directory.This update-based replication will minimize the synchro- nization trafﬁc on the network, as well as the processing burden on the servers running the directory service.There are two fundamental tactics when replicating databases: s Master-Slave All changes to the directory must ﬁrst be made to a des- ignated master server and then propagated to all slave servers. Although effective from a change management perspective since there is a single point of administration, this method provides a single point of failure in the event the master server were to fail.Windows NT domains used the Master-Slave tactic. s Multi-Master Any changes made to the directory can be made to any directory server, which then propagates that change to the remaining directory servers.This method provides fault tolerance and distributed administration. However, the Multi-Master method requires a way to handle conﬂicting changes in the directory.Windows 2000 Active Directory domains use the Multi-Master replication tactic to address this issue. www.syngress.com
Introduction to Active Directory • Chapter 1 15 Directory Service Domino Effect When a directory service consists of a distributed database using Multi-Master replication and a hierarchical organization, it has a domino effect on the net- work’s management, dissolving administrative headaches suffered by networks that use Master-Slave replication and have a ﬂat ﬁle structure.These beneﬁts include: s Straightforward Administration It collapses the management for users, applications, and network devices into a single point, but can be administered from anywhere in the network. s Centralized Security It provides a single logon and consistent security mode throughout the network, reducing user administration. s Extensible and Interoperable It extends the capabilities of the net- work into the future. Not only is there a base of standards within the schema, but the schema can be extended to include new objects and properties. An extended schema may enable other systems, directory services, and applications to interoperate with the directory service. As a result of the hierarchy and Multi-Master replication, more resources and services can take advantage of the directory service, making the entire network an open system.This model and its rewards are all representative of the Active Directory Service that is part of the Windows 2000 Server family. Introduction to Active Directory Active Directory is the directory service provided with Windows 2000 Server products. Active Directory has the following characteristics: s It is a database that is distributed across multiple servers. s It uses a Multi-Master replication model to propagate updates throughout the network. s It has an extensible schema representing user accounts, group accounts, resources, and services as objects. s The database is organized in a hierarchical tree, which uses containers called Organizational Units (OUs) to enable rights and privileges to be inherited. www.syngress.com
16 Chapter 1 • Introduction to Active Directory Active Directory can provide a single directory and logon, its administration can be distributed, and the directory and its inherent security can be extended and scaled for small to large enterprises. Active Directory includes a few other features, too. Active Directory is an Extensible Storage Engine (ESE) database.This is the same type of database as that used by Microsoft Exchange Server. Exchange Server 2000 uses a newer ESE98 interface, whereas both Active Directory and Exchange Server 5.5 use the ESE97 interface. ESE allocates a database store of up to 17 terabytes and 10 million objects per domain. (One million objects is the recommended limit and approximate size of the largest tested number of objects per domain.) ESE efﬁciently utilizes only the disk space necessary to store the values for each object and its properties.When adding data to the data store, ESE uses the most rapid method possible; however, ESE gives up some database efﬁciency to do so.The data store can easily become fragmented. Active Directory does per- form online defragmentation to rearrange data after it has been stored, plus it provides a utility NTDSUTIL to perform ofﬂine defragmentation. Ofﬂine defragmentation will not only rearrange the data, but it will also reclaim disk space from the directory store, which is a ﬁle called NTDS.DIT. ESE does not claim a full object’s space when the object’s values are not fully completed. If an object class has multiple attributes available for data, but an object of that class is created with values assigned to a couple of those attributes, then the ESE engine will acquire only the space necessary to store the values assigned. For example, if there is a user account object in which the phone number and address are not ﬁlled out, then no space is reserved in the data store for that information—only enough space to store what values have been assigned to the user object. .NET Since many of the standards used with Active Directory are also Internet stan- dards, Active Directory can be integrated into any Internet or intranet environ- ment.The ability to extend the enterprise system into the Internet is one of the bases of Microsoft’s .NET strategy. .NET is based on Windows 2000 Server and extends to a host of services, as well as the .NET development framework. For developers, Microsoft provides a software development kit (SDK) for Windows 2000 and Active Directory that contains the Application Programming Interfaces (APIs) that a Web-based component can hook into.You can obtain SDKs and developer information for the .NET framework from the Microsoft Developer Network Web site at msdn.microsoft.com. Developers can use the .NET www.syngress.com
Introduction to Active Directory • Chapter 1 17 framework for integrating Active Directory into a Web solution. A program can use the native Active Directory APIs to hook a Web site into the Windows 2000 Active Directory. Since Web browsers are available on nearly every platform, this means that the Active Directory service can be universally accessible via the Web. Protocol Interoperability Active Directory uses a naming convention that is similar to X.500, an Internet standard for directory service namespaces. Although not exactly an X.500 direc- tory, Active Directory uses Lightweight Directory Access Protocol (LDAP), which was developed for use with X.500 directories and reduces the trafﬁc overhead that is associated with the X.500 system. Being able to use LDAP and to support the X.500 naming model enables Active Directory to manage other, application- speciﬁc directories.To take advantage of this capability, you must integrate the directories via some protocol or API, and usually this means LDAP because LDAP commonly is used by many directory services.The future of Active Directory may eventually bring about a single logon and password that can be synchronized throughout various directories in an enterprise network, even though those directories might otherwise be incompatible. All of this is possible through the use of standard protocols for communications. One thing that you must be prepared for is using IP for all communications involving the directory service.This may be an issue for a network that primarily depends on another protocol stack. However, with today’s proliferation of Internet-capable systems, using IP natively across an enterprise network is not usually an issue.The reason that you must use IP is that Active Directory is dependent upon the IP protocol stack. In particular, it is entirely dependent upon DNS to help both servers and workstations locate Active Directory servers called domain controllers. The IP protocol stack, also called TCP/IP, consists of multiple protocols; the main two are the Internet Protocol (IP) and Transmission Control Protocol (TCP).The IP protocol assigns a logical address to each station on the network, so that they can be found.The 32-bit IP address is usually illustrated in dotted- decimal notation, a format of four numbers, each ranging from 0 to 255 and sep- arated by dots. Each of the four numbers commonly is referred to as an octet. For example, 10.155.3.253 is an IP address.This format, though easier to remember than a string of 32 ones and zeroes, is not all that easy for humans to remember. Mnemonic systems usually associate a word to a visual, auditory, or tactile sensa- tion in order to stimulate memory. Numbers are difﬁcult to associate that way, and remembering multiple strings of numbers is difﬁcult for an average Internet www.syngress.com
18 Chapter 1 • Introduction to Active Directory user.To make it easier for people to remember which server is which, host names were given to the server.To make certain that the user could access the host using a host name, a ﬁle named “hosts” was placed on each computer, associating the host name of a computer to its IP address.This way, the user could access the host using a host name rather than having to remember the 32-bit numerical address. If a user needed to access a new computer, the user or the administrator had to update the host ﬁle with the new host name and IP address, or the user still was forced to use the IP address. After some time, it became obvious that man- aging multiple host ﬁles was time-consuming and tedious.Thus, DNS was born. DNS was developed to provide a central, hierarchical directory for IP addresses that reduced the host name-to-IP address management by reducing the number of machines that needed to be managed. Assuming network clients are utilizing DNS, a user simply can enter a host name and the computer queries its DNS server for the IP address. If the host that the user is trying to access is not listed on that server, the DNS server can pass the DNS query up to other DNS servers within the DNS hierarchy to a server that does have that listing for Name resolution. It takes only a short time for DNS to respond because of its well-organized hierarchy. In fact, the system is so transparent that most users are unaware that this host name-to-IP address transla- tion is taking place each time they type in a new Universal Resource Locator (URL) into their Web browser. Active Directory depends on DNS to locate domain controllers on the network through a special type of DNS record that maps a service to an IP address.This type of record is called a Service Location Resource Record, or SRV RR for short. Single Point of Administration Being able to manage the network from a single location reduces time and effort for administrators. Instead of logging off one server and then logging onto another, or even moving physically from one management station to another, all Active Directory servers, resources, and accounts are stored in a single location. An administrator can create custom Microsoft Management Consoles (MMCs) to provide quick access to the information that the administrator uses most, or the administrator can use the standard consoles provided with Windows 2000 Server. The reason that administrators no longer need to log off one server and onto another is partially due to Multi-Master replication, in addition to the MMC. Active Directory domains no longer use a PDC or BDCs because they have changed to a Multi-Master architecture in which all copies of the Active Directory database are maintained on DCs that are peers of each other.This www.syngress.com
Introduction to Active Directory • Chapter 1 19 means that a single Active Directory database is the repository for multiple pub- lished resources and can be administered from the same application using any replica of the Active Directory database through Multi-Master replication. Therefore, when an administrator logs onto a DC in a particular domain, it doesn’t matter which DC, because all the data will be converged at the time speciﬁed for synchronization. Active Directory brings about the concept of published resources. Published resources reduce time and effort for end-users. A published resource can be a ﬁle, network device, access sessions to mainframe and minicomputers, databases,Web services, and any other resource or service that is installed into Active Directory and secured for user access. Publishing a resource means that a user can execute a simple query to locate the resource anywhere on the network. In the case of printers, this capability is very powerful—printers can be published with informa- tion about their features. For example, a user can look for a printer in a particular building with the ability to print in color and duplex. If such a printer is pub- lished, the user’s query is returned with any information. Administrators can cus- tomize printer location with maps, if such are required. The NOS Windows 2000 Server is the network operating system (NOS) that is seamlessly integrated with Active Directory.Windows 2000 Server is scalable at the server level, with three products—Windows 2000 Server,Windows 2000 Advanced Server, and Windows 2000 DataCenter Server—that support different sizes of server equipment, as shown in Table 1.2. Active Directory takes the scala- bility of the Windows 2000 Server family of products and raises it to the network level, since multiple Windows 2000 servers of varying types (whether Advanced, DataCenter, or standard Server) can all participate in a single Active Directory. Table 1.2 Scalability of Windows 2000 Windows 2000 Windows 2000 Windows 2000 Component Server Advanced Server DataCenter Server Number of 4 8 32 processors RAM (Intel 4GB 8GB using Physical 64GB using Physical servers) Address Extensions Address Extensions Network load Not supported Up to 32 nodes Up to 32 nodes balancing supported supported Clustering Not supported Up to 2 nodes in Up to 4 nodes in a a failover group failover group www.syngress.com
20 Chapter 1 • Introduction to Active Directory Active Directory Architecture Active Directory is not automatically part of the Windows 2000 Server installa- tion process, although the capability is available should you need it.When a Windows 2000 Server (any version) is installed as a new install, by default it becomes a member server of a workgroup or domain. (Upgrades are handled dif- ferently if a Windows NT PDC or BDC is being upgraded to Windows 2000. In the case of upgrades of an NT PDC or BDC, the installer is prompted to upgrade the domain to Active Directory. If that did not occur, all information from the former domain would be lost.) Member servers use a security architecture identical to the Windows 2000 Professional client workstations, in which they have a ﬂat ﬁle local database with a set of local users and groups.This does not allow other servers or workstations to share in that security database. In fact, it hearkens back to the days of a server- centric network.The ﬂat ﬁle database allows local users and groups, as well as shared local ﬁles and printers, in a server-centric model. Only when a member server or client workstation joins an Active Directory domain can it participate in Active Directory.When a client workstation or member server joins a domain, that server-centric local database remains. However, if a member server is upgraded to a Domain Controller, the local database is removed. When a Windows 2000 Server joins an Active Directory domain as a member server, it can communicate with any DC for Active Directory security information. Domains are conﬁgured as top-level containers in a tree structure that is created through trust relationships and uses DNS naming. Domains sharing a contiguous DNS namespace are organized into domain trees. A contiguous namespace means that the domains are linked via the DNS names. For example, a domain named root.com and its subdomain named trunk.root.com are both part of the same contiguous namespace. However, a domain named trunk.com is not part of that contiguous namespace, and in fact, forms the basis for another domain tree.There can be multiple domains in Active Directory either with or without contiguous namespaces. Multiple domains with different namespaces that participate in a single Active Directory commonly are considered a forest of multiple domain trees, as depicted in Figure 1.4. However, it is important to note that a domain on its own can be its own forest. Internal to each domain, Active Directory provides OUs to create a tree structure.The OU tree is unique to each domain, and completely conﬁgurable by an administrator.Within the OU containers, Active Directory enables the administrator to create objects that represent user accounts, network services, and www.syngress.com
Introduction to Active Directory • Chapter 1 21 resources such as users, groups, workstations, and printers.The result is a logical structure that can be scaled to any enterprise of any size and organizational formation. Figure 1.4 Active Directory as a Forest of Trees Two-Way Transparent Trust Domain A Domain B Forest Subdomain A Sub- Subdomain A Designing & Planning… Multi-Master Replication Multi-Master replication occurs when a change is made to any object within a replica of the Active Directory database on any DC is updated automatically on all the others. In an Active Directory domain, each DC is a peer to all the other DCs. Furthermore, replication of forest-wide information, such as the schema and conﬁguration, occurs between all DCs in the forest. And Global Catalog replication occurs between all Global Catalog servers in the forest. This replication does not happen by all servers talking to all the other servers at once. In fact, Multi-Master replication is a controlled Continued www.syngress.com