1 / 56

Advanced Active Directory Deployments

Advanced Active Directory Deployments. Rick Claus IT Pro Advisor Microsoft Canada rclaus@microsoft.com http://blogs.technet.com/rclaus. What Will We Cover?. Multiple Forest Design Multiple Domain Design Site Design. Helpful Experience. Experience with Active Directory concepts

justus
Download Presentation

Advanced Active Directory Deployments

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Advanced Active Directory Deployments Rick Claus IT Pro Advisor Microsoft Canada rclaus@microsoft.com http://blogs.technet.com/rclaus

  2. What Will We Cover? • Multiple Forest Design • Multiple Domain Design • Site Design

  3. Helpful Experience • Experience with Active Directory concepts • Experience administering Active Directory • Experience supporting TCP/IP networks Level 200

  4. Agenda • Designing Multiple Forests • Implementing Multiple Forests • Designing Multiple Domains • Designing a Site Topology

  5. Designing Forests • Shared directory • Security boundary Forests • Identify business requirements • Determine number of forests Forest Design

  6. Service Administrator Authority Service administrators have full access You should ensure they can be trusted

  7. Reasons for Multiple Forests Generic Reasons Legal Asset isolation Autonomy Operational Structure Organizational Reasons

  8. Autonomy vs. Isolation Autonomy Isolation Service Autonomy Data Autonomy Service isolation Data isolation

  9. Forest Design Considerations • Isolation requirements limit choices • Allow enough negotiation time • Consider the cost benefit • Avoid co-ownership by two IT orgs • Avoid outsourcing to multiple partners

  10. Organizational Forest Model Key Forest trust User accounts Resource servers Organizational Forest Organizational Forest

  11. Resource Forest Model Key User accounts Forest Trust Forest Trust Resource servers Organizational Forest Resource Forest Service accounts Alternate user accounts Resource Forest

  12. Restricted-Access Forest Model Key Forest Trust User accounts Resource servers Organizational Forest Servers with classified data Restricted-Access Forest

  13. Scenario: Same Corporation Plant.contoso.com Contoso.com hr.contoso.com Physically unsecured domain controllers Application that requires a different schema Dedicated Connection

  14. Scenario: Different Corporations Internet Firewall Firewall Contoso.com Fabrikam.com

  15. Scenario: Perimeter Network Firewall Passport Internet Web App Perimeter Firewall DMZ.Contoso.com Internal Contoso.com

  16. Mapping Requirements to Models Requirements: Solution: Join an existing forest for data autonomy

  17. Mapping Requirements to Models Requirements: Solution: Use an organizational or resource forest for service isolation

  18. Mapping Requirements to Models Requirements: Solution: Use an organizational forest or domain and reconfigure the firewall for service autonomy with limited connectivity

  19. Agenda • Designing Multiple Forests • Implementing Multiple Forests • Designing Multiple Domains • Designing a Site Topology

  20. Forest Trusts Corp.Fabrikam.com Corp.Contoso.com Requirements • Domain controllers running Windows Server 2003 • DNS infrastructure • Windows Server 2003 Forest Functional Level • Enterprise Admin privileges

  21. Authentication across Forests Corp.Fabrikam.com Corp.Contoso.com DC3 DC2 DC4 GC DC1

  22. Authorization across Forests Windows XP SP2 and Windows Server 2003 Windows 2000 Windows NT 4.0 and earlier Exchange Server 5.5 and SQL Server 2000 Can browse and search principals Use UPN or NT 4.0 name Use NT 4.0 name Use NT 4.0 name

  23. Restricting Forest Scope: Scenario 1 Fabrikam.com Contoso.com Disable DomainInfo or TopLevelName Not Trusted

  24. Restricting Forest Scope: Scenario 2 Forest Trust Allowed to authenticate Contoso.com Fabrikam.com

  25. Other Forest Considerations Forest Trust Recommended Contoso.com Fabrikam.com Not Recommended Plant.contoso.com Contoso.com

  26. Smart Cards and Forest Trusts PKI Trust Forest Trust Contoso.com Fabrikam.com

  27. Agenda • Designing Multiple Forests • Implementing Multiple Forests • Designing Multiple Domains • Designing a Site Topology

  28. Active Directory Domains Active Directory Partition Administrative Functions • User identity • Authentication • Trust relationships • Replication Domain

  29. Factors that Impact Domain Model Network Capacity Number of Users 128K ISDN T1

  30. Reasons for Multiple Domains • Administrative considerations (politics) • Unique policies • Network traffic • Network connectivity • Capacity • International differences • In-place upgrade of existing domains

  31. Design Recommendations If deploying more than one domain, remember:

  32. Domain Cost Implications • Management • Consistency • User moves

  33. Domain Models: Single Domain

  34. Domain Models: Regional Forest Root Regional Domain Regional Domain Regional Domain

  35. Domain Models: Organizational Central IT Team Enterprise Admins Domain Admins Schema Admins Div 1 IT Team Div 2 IT Team Div 3 IT Team Domain Admins Domain Admins Domain Admins Corp Division 1 Division 2 Division 3

  36. Determining the Number of Domains

  37. Agenda • Designing Multiple Forests • Implementing Multiple Forests • Designing Multiple Domains • Designing a Site Topology

  38. Site Functions Domain Site 1 Site 3 Site 2

  39. Typical Network Topologies Site Site Site Site Site Hub Site Site Site Site Ring Topology Hub and Spoke Topology Site Hub Hub Site Site Complex Topology

  40. Active Directory Replication DC-1 DC-2 DC-3 Intrasite replication connection over LAN DC-4 DC-5 Intersite replication connection over WAN London Site Tilbury Site

  41. DC Placement: Forest Root Root DC Root DC Hub Site Network Hub Datacenter Hub and Spoke Site Topology Spoke Site Spoke Site http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/4af3271a-4407-4ca5-9cd5-e05b79046d08.mspx

  42. DC Placement: Regional No No Yes Do not place DC Yes Yes Yes WAN link stable? Logon good? Are DCs physically secure? Admin for DCs? No No No 24x7 required? Yes Place DC

  43. Global Catalog Placement No Do not place GC No No No Place DC and enable UGMC WAN link to GC Roaming users? App that requires a GC? > 100 Users? Yes Yes Yes Yes Place GC

  44. Operations Masters Review Domain Roles Forest Roles PDC Emulator Schema Master RID Master Domain Name Master Infrastructure

  45. Operations Masters Guidelines http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/edeba401-7f51-4717-91bd-ddb1dca8a327.mspx

  46. Operations Masters Placement • Single-domain forest • Make all DCs into GCs • Leave roles on first DC • Forest root domain (multiple domains) • Move roles to second DC • Don’t make the second DC a GC • Regional child domain • Leave roles on first DC • Don’t make the second DC a GC

  47. Creating Sites Include subnet of location in the closest site No No Yes Yes Is DC at location? Site required by apps? Create site for location

  48. Site Links Site 2 Site 1 Default-First-Site-Link Connection Transports • RPC over IP • SMTP Site 3 Site1-Site2 Site1-Site3 Site2-Site3

  49. Site Link Cost Site1-Site2 Site1-Site3 Site2-Site3 KBps: 256 Cost: 425 KBps: 9.6 Cost: 1024 KBps: 256 Cost: 425

  50. Site Link Schedule Site 2 Site 1 Not available from 8:00 A.M. to 6:00 P.M. Site 3 Site1-Site2 Cost: 425 Site1-Site3 Cost: 1024 Site2-Site3 Cost: 425

More Related