790 likes | 1k Views
Chapter 4: Planning the Active Directory and Security. Learning Objectives. Explain the contents of the Active Directory Plan how to set up Active Directory elements such as organizational units, domains, trees, forests, and sites
E N D
Learning Objectives • Explain the contents of the Active Directory • Plan how to set up Active Directory elements such as organizational units, domains, trees, forests, and sites • Plan which Windows 2000 security features to use in an organization, including interactive logon, object security, and services security
Learning Objectives (continued) • Plan how to use groups, group policies, and security templates • Plan IP security measures
Windows NT Domain Structure • Security Accounts Manager (SAM) database holds data on user accounts, groups, and security privileges • One primary domain controller (PDC) has master copy of the SAM • One or more backup domain controllers (BDCs) have regularly backed up copies of the SAM • If PDC Fails, BDC is promoted
Using a PDC, BDCs, and the SAM database Figure 4-1 Windows NT SAM architecture
Windows 2000 Active Directory • Domain objects including user accounts, computers, servers, printers, groups, security policies, domains, and other objects compose the Active Directory
Windows 2000 Active Directory • Made up of the following files • NTDIS.DIT single file of the database • EDB*.LOG Log files associated with database transactions • EDB.CHK error tracking/correction info for database • RES1.LOG and RES2.LOG reserve disk space
Active Directory Objects Figure 4-2 Domain objects in the Active Directory
Active Directory Objects • Object Types • User Account • Computer Account • Domain Controller • Groups • Organizational Unit • Printers
Multimaster Replication • Multimaster replication: In Windows 2000 there can be multiple servers, called domain controllers (DCs), that store the Active Directory and replicate it to each other. Because each DC acts as a master, replication does not stop when one is down. Each DC is a master in its own right.
Multimaster Replication • Can create account on any of the DCs • Other DCs automatically updated • Can be done for changed data only, don’t have to replicate whole file • If one DC fails, others are up-to-date and system systems up • Don’t have to stop to promote a BDC
Schema • Schema: Elements used in the definition of each object contained in the Active Directory, including the object class and its attributes
Example Schema Characteristics of the User Account Class • Unique object name • Globally unique identifier (GUID) associated with each object name • Required attributes • Optional attributes • Syntax of how attributes are defined • Pointers to parent entities
Example User Account Attributes • Username • User’s full name • Password
Schema Example Figure 4-4 Sample schema information for user accounts
Default Object Classes • Domain • User account • Group • Shared drive • Shared folder • Computer • Printer
Object Naming • Common name (CN): The most basic name of an object in the Active Directory, such as the name of a printer • E.g. HPLaserMain • Distinguished name (DN): A name in the Active Directory that contains all hierarchical components of an object, such as that object’s organizational unit and domain, in addition to the object’s common name • CN=<object Name>, OU=<organizatoional unit, O=<Organization>, C=<CountryCode>
Namespace • Namespace: Can be set up as a DNS server
Active Directory Elements • Domains • Organizational units (OUs) • Trees • Forests • Sites
Active Directory Architecture Figure 4-5 Active Directory hierarchical containers
Functions of a Domain • Provide a security boundary for objects in a common relationship • Establish a set of data to be replicated among DCs • Expedite management of a set of objects
Using a Single domain Figure 4-6 Single domain
Using Multiple Domains Figure 4-7 Using multiple domains
Functions of an OU • Group related objects, such as user accounts and printers, for easier management • Reflect the structure of an organization • Group objects to be administered using the same group policies
Using OUs to Reflect Organizational Structure Figure 4-8 OUs used to reflect the divisional structure of a company
Design Tips for Using OUs • Limit OUs to 10 levels or fewer • OUs use less CPU resources when they are set up horizontally instead of vertically • Each request through an OU level requires CPU time in a search
Characteristics of a Tree • Member domains are in a contiguous namespace • chi.devry.edu tp.devry.edu under devry tree • Member domains can compose a hierarchy • Member domains use the same schema for common objects • Member domains use the same global catalog (encyclopedia of info about object)
Global Catalog • Global catalog: A grand repository for all objects and the most frequently used attributes for each object in all domains. Each tree has one global catalog.
Global Catalog Functions • Authenticating users • Providing lookup and access to resources in all domains • Providing replication of key Active Directory elements • Keeping a copy of the most attributes for all objects
Hierarchical Domains in a Tree Figure 4-9 Tree with hierarchical domains
Kerberos Transitive Trust • Kerberos Transitive Trust Relationship: A set of two-way trusts between two or more domains in which Kerberos security is used.
Trusted and Trusting Domains • Trusted domain: A domain that has been granted security access to resources in another domain • Trusting domain: A domain that allows another domain security access to its resources and objects, such as servers
Planning Tip • Make sure each tree has at least one DC that is also configured as a global catalog • Locate global catalog servers in a network design architecture that enables fast user authentication (so that authentication does not have to be performed over a WAN link, for example)
Characteristics of a Forest • Member trees use a disjointed namespace (but contiguous namespaces within trees) • Member trees use the same schema • Member trees use the same global catalog
Single Forest • Single forest:An Active Directory model in which there is only one forest with interconnected trees and domains that use the same schema and global catalog
Single Forest Architecture Figure 4-10 A forest
Separate Forest • Separate forest: An Active Directory model that links two or more forests in a partnership, but the forests cannot have Kerberos transitive trusts or use the same schema
Separate Forest Architecture Figure 4-11 Separate forest model
Design Tip • When you create a separate forest structure remember that: • Replication cannot take place between forests • The forests use different schema and global catalogs • The forests cannot be easily blended into a single forest in the future
Site • Site: An option in the Active Directory to interconnect IP subnets so that it can determine the fastest route to connect clients for authentication and to connect DCs for replication of the Active Directory. Site information also enables the Active Directory to create redundant routes for DC replication.
Characteristics of a Site • Reflects one or more interconnected subnets (512 Kbps or faster) • Reflects the same boundaries as the LAN • Used for DC replication • Enables clients to access the closest DC • Composed of servers and configuration objects
Site Links • Site link object: An object created in the Active Directory to indicate one or more physical links between two different sites • Site link bridge: An Active Directory object (usually a router) that combines individual site link objects to create faster routes when there are three or more site links