270 likes | 416 Views
A Course on Global Catalog And Flexible Single Master Operations (Fsmo) Roles. Prepared for: *Stars* New Horizons Certified Professional Course. UNDERSTANDING THE GLOBAL CATALOG. Central repository for forest-wide data. Subset of attributes from objects forest-wide.
E N D
A Course on Global Catalog And Flexible Single Master Operations (Fsmo) Roles Prepared for: *Stars* New Horizons Certified Professional Course
UNDERSTANDING THE GLOBAL CATALOG • Central repository for forest-wide data. • Subset of attributes from objects forest-wide. • First domain controller in the forest is automatically configured as a global catalog server. • Other domain controllers can become global catalog servers.
FUNCTIONS OF THE GLOBAL CATALOG • Facilitate searches for objects in the forest • Resolve User Principal Names (UPNs) • Provide universal group membership information • If the domain is in Microsoft Windows 2000 native functional level or later, global catalog information is required in order for users to log on.
UNIVERSAL GROUP MEMBERSHIP CACHING • New for Microsoft Windows Server 2003. • When enabled, non-global catalog domain controllers can process logons without contacting a global catalog server. • Refreshed on an eight-hour interval. • Eliminates the need to place a global catalog server in a remote site to facilitate logons. • Provides better logon performance. • Can be used to minimize wide area network (WAN) link usage.
LOGON PROCESS AND THE GLOBAL CATALOG • Universal group membership is used in creation of the access control list (ACL) when the user logs on. • Global catalog is used to verify universal group membership. • Users might be denied logon if the global catalog is not available and universal group membership caching is not enabled. • Built-in Administrator account can logon, regardless of global catalog availability or the universal group membership caching configuration.
PLANNING GLOBAL CATALOG SERVER PLACEMENT CONSIDERATIONS • There is additional global catalog replication traffic when a global catalog is configured. • Consider placing a global catalog server in each site or configure universal group membership caching for that site. • Consider placing a global catalog server in each site where applications need to make global catalog queries.
UNDERSTANDING FLEXIBLE SINGLE MASTER OPERATIONS ROLES • Flexible Single Master Operations (FSMO) roles • Assigned automatically to the first domain controller in a domain • Roles can be transferred to other domain controllers • Used to reduce conflict and facilitate communication concerning replication between domain controllers
FIVE FSMO ROLES • Domain naming master • Relative identifier (RID) master • Infrastructure master • Primary Domain Controller (PDC) emulator • Schema master
DOMAIN-SPECIFIC ROLES • RID master—Assigns RIDs to other domain controllers • Infrastructure master—Allows security principals to be tracked between domains • PDC emulator • Backward compatibility with Microsoft Windows NT Server version 4.0 domains and later client computers (Microsoft Windows 98 and Windows Me) • Time synchronization • User account password change replication
RID MASTER • Used when security principals are created • RID makes the individual security principal security identifier (SID) unique within a domain • Built-in RIDs are consistent between domains, for example, Built-in Administrator has a RID of 500 • RID master gives other domain controllers RIDs to use when new objects are created
WHAT IF THE RID MASTER ISN’T AVAILABLE? • Doesn’t affect existing users • Might cause a problem when creating new objects, if the existing RID pool on the domain controller is depleted • Problems moving objects between domains
INFRASTRUCTURE MASTER • Manages user and group references for objects between domains • Updates ACLs and group memberships as required • Queries the global catalog to ensure that references are current • Role should not be assigned to a global catalog server • Exception 1: There is only a single domain in the forest • Exception 2: All domain controllers are also global catalog servers
PDC EMULATOR • Provides backward compatibility for pre–Windows 2000 client computers • Acts as the PDC in Windows 2000 mixed functional level for any Windows NT Server version 4.0 backup domain controllers (BDCs) that are present on the network • Acts as a central manager for user password changes, replication, and account lockouts • Handles time synchronization
ALTERNATE TCP/IP ADDRESS CONFIGURATION • Domain naming master • Schema master • These roles are assigned to only one domain controller in the entire forest • Usually these roles are assigned to domain controllers in the forest root domain
DOMAIN NAMING MASTER • Allows additions or removals of domains. • Ensures domain names are unique in the forest. • Domains cannot be added or removed if the domain naming master is not available. • Enterprise Admins level access is required in order to add and remove domains.
SCHEMA MASTER • Controls access to the schema. • Ensures modifications are replicated to all domain controllers in the forest. • The schema cannot be modified if the schema master is not available. • Schema Admins level access is required to modify the schema.
PLACING FSMO SERVERS • In a multi-domain environment, you’ll likely move some of the FSMO roles. • Decisions on placing domain controllers involve. • Number of domains that are a part of the forest • Physical structure, including sites • Number of domain controllers in each domain
MANAGING FSMO ROLES • What happens when a domain controller holding a given FSMO role fails? • Transferring roles. • Seizing roles.
WHAT ARE THE IMPLICATIONS OF FAILURE? • Schema master • Domain naming master • PDC emulator • RID master • Infrastructure master
MANAGING ROLES • Active Directory Users And Computers • RID master • Infrastructure master • PDC emulator • Active Directory Domains And Trusts—domain naming master • Microsoft Management Console (MMC) Schema snap-in—schema master • Repadmin • NTDSUtil—All roles
SUMMARY • Global catalog function • Global catalog server placement • Domain-wide operations masters • Forest-wide operations masters • Implications of FSMO failure • Tools to manage FSMO roles