Active Directory. Planning Timeline Comparison. Prepared by Microsoft Version Baseline

Size: px

Start display at page:

Download "Active Directory. Planning Timeline Comparison. Prepared by Microsoft Version Baseline"

Ralph Hicks
5 years ago
Views:

1 Active Directory Planning Timeline Comparison Prepared by Microsoft First published 7 February 2008

2 Copyright This document and/or software ( this Content ) has been created in partnership with the National Health Service (NHS) in England. Intellectual Property Rights to this Content are jointly owned by Microsoft and the NHS in England, although both Microsoft and the NHS are entitled to independently exercise their rights of ownership. Microsoft acknowledges the contribution of the NHS in England through their Common User Interface programme to this Content. Readers are referred to for further information on the NHS CUI Programme. All trademarks are the property of their respectivee companies. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Microsoft Corporation and Crown Copyright 2008 Disclaimer At the time of writing this document, Web sites are referenced using active hyperlinks to the correct Web page. Due to the dynamic nature of Web sites, in time, these links may become invalid. Microsoft is not responsible for the content of external Internet sites. The example companies, organisations, products, domain names, addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organisation, product, domain name, address, logo, person, places, or events is intended or should be inferred. Page ii

3 TABLE OF CONTENTS 1 Introduction Assumptions Environment Assumptions Other Assumptions Active Directory Design Scenarios No Healthcare Platform Optimisation Healthcare Platform Optimisation Solution Analysis Chart Representation Further Benefits of the Healthcare Platform Optimisation High Level Activities Breakdown... 5 APPENDIX A Document Information... 7 Page iii

4 1 INTRODUCTION The purpose of this document is to provide a comparison of the required timelines to design a Microsoft Active Directory authentication service, with and without using the Active Directory Design Guide 1 guidance. Directory service design is a significant undertaking because it impacts (and includes) many aspects of infrastructure design and deployment, which the Active Directory Design Guide {R1} guidance aims to consolidate into one location. It should be noted that the estimated timelines described in this document are based upon field experience of carrying out an Active Directory design. The deployment timelines compare IT administrators with the following levels of experience and guidance: No prior knowledge or experience of Active Directory and without any specific guidance. Healthcare Platform Optimisation specific guidance of the type that an experienced consultant would provide. The value of the Active Directory Design Guide {R1} guidance is that it provides healthcare-specific guidance in the design of Active Directory, and links to all the relevant information required to make other design decisions, as such it will reduce the time taken to design Active Directory within a healthcare organisation. Section 4.3 illustrates the activities of the Active Directory design process that will be shortened through use of the Active Directory Design Guide {R1} guidance. These are indicative figures and should not be considered as definitive timelines for a specific project to design an Active Directory authentication service, because every design and deployment project will have its own unique situation and requirements. 1 Active Directory Design Guide {R1}: Page 1

5 2 ASSUMPTIONS For the purposes of this document, a number of assumptions are made regarding the healthcare organisation for which the Active Directory will be designed with a view to future deployment as an authentication service and to aid Microsoft desktop management. 2.1 Environment Assumptions The following assumptions are made regarding the types of IT environment that are covered by the scenarios in this document: It is anticipated that if a healthcare organisation wishes to use a Microsoft authentication service, they will implement their own production Active Directory (single domain forest) If multiple healthcare organisations collaborate closely, it would be advantageous to implement a single domain Active Directory forest infrastructure across this larger cohesive unit. This would aid the ability for users to roam using a single logon and access services, and resources, within the healthcare organisations Within the chosen physical scale for the Active Directory design (especially if healthcare organisations want to share services and resources between sites), a suitable IP Addressing scheme is already in place to enable successful site to site communication. That is, unique IP Addressing schemes assigned to each participating healthcare organisation with no overlap Note The use of NAT (Network Address Translation) within an Active Directory environment is neither recommended nor supported by Microsoft. 2.2 Other Assumptions The following assumptions are made regarding other factors within the healthcare organisation s environment that are covered by the scenarios in this document: The Active Directory design project will be carried out by a MCSE qualified healthcare IT administrator The healthcare IT administrators have no prior Active Directory knowledge or skills Page 2

6 3 ACTIVE DIRECTORY DESIGN SCENARIOS This section details the two scenarios considered when creating the Active Directory design timelines. The scenarios are: No Healthcare Platform Optimisation Healthcare Platform Optimisation available 3.1 No Healthcare Platform Optimisation In this scenario, healthcare IT administrators with no prior knowledge or experience of Active Directory are to design an Active Directory without any Healthcare Platform Optimisation specific guidance. They will be required to gain the skills necessary for the design using a combination of the following: Formal training courses Self-study Using the publicly available Microsoft documentation for Active Directory, such as the information contained in the Microsoft Windows Server 2003 Active Directory Technology Center 2 General research from the Internet 3.2 Healthcare Platform Optimisation In this scenario, healthcare IT administrators with no prior knowledge or experience of Active Directory are to design an Active Directory using the Active Directory Design Guide {R1} guidance. Active Directory service design is a complex undertaking and there are many different possible approaches to designing and implementing an Active Directory service. The Active Directory Design Guide {R1} guidance seeks to provide healthcare-specific guidance to reduce the diversity of Active Directory implementations across healthcare organisations, thereby reducing the support and management requirements of this service. The provision of a standardised design approach, including key design recommendations, will reduce the time and effort needed to design and deploy a directory service within a healthcare organisation. 2 Windows Server 2003 Active Directory {R2}: Page 3

7 4 SOLUTION ANALYSIS 4.1 Chart Representation Figure 1 below displays the indicative numbers of required days to read the prerequisite training material and then plan and design an Active Directory infrastructure. Designingg an Active Directory Service - Timelines to Deployment Without HPO Scenarios With HPO Training Design Planning Associated Planning 0 5 Figure 1: Timelines Comparison Days Further Benefits of the Healthcare Platform Optimisation The following additional benefits of using the Healthcare Platform Optimisation guidance should be noted: Supports rapid knowledge transfer to help reduce the learning curve of designing an Active Directory service Collates the numerous public references related to Active Directory design into a consolidated healthcare-specific document Provides order to Active Directory design through a sequenced checklist of design and deployment steps Identifies current best-practiceexperience, to minimise design-time and reduce risk for designing an Active Directory service, based on industry Identifies key design decisions pertinent to healthcare and provides design solutions which reduce configuration diversity across multiple implementations Provides a standardised design and configuration approach to reduce the administration and management overheads of the system, thereby reducing overall support costs Provides a consistent and reliable directory service to users as they move around their healthcare organisation, thereby increasing their utilisation and service-quality perception of the infrastructure Page 4

8 4.3 High Level Activities Breakdown The chart shown in Figure 1 is based on the data in Table 1, which indicates the number of days required to complete the following phases, with and without the Healthcare Platform Optimisation guidance: 1. Active Directory technical learning activities 2. Active Directory design planning activities 3. Active Directory associated network services design planning activities These are the phases that are required in order to achieve a detailed low level design of an Active Directory infrastructure, which is ready for deployment. Activity No HPO With HPO Time Saved By Active Directory technical learning activities Active Directory design planning activities 20 5 The Healthcare Platform Optimisation guidance contains hyperlinks to the current public best-practice documentation most appropriate for each Active Directory topic; such that it provides a consolidated view of numerous information sources, thereby helping to support rapid knowledge transfer Healthcare Platform Optimisation guidance contains the required components which are logically structured into the appropriate order for approaching an Active Directory design in the most efficient, effective and comprehensive method. Healthcare Platform Optimisation guidance contains current best-practice guidance and recommendations on the most common Active Directory design decisions required, therefore accelerating the design process. Areas include: Organisational Unit design and administration Group Policy design Delegation of administration Security requirements Physical structure requirements Placement of Flexible Single Master Operations role holders Active Directory functional levels Healthcare Platform Optimisation guidance contains current best-practice guidance and recommendations on healthcarespecific Active Directory design decisions required, therefore accelerating the design process. Areas include: Forest Design number and structure Domain Design number and structure Domain naming practice Object naming conventions Page 5

9 Activity No HPO With HPO Time Saved By Active Directory associated network services design planning activities 10 5 Healthcare Platform Optimisation guidance contains the required components, which are logically structured into the appropriate order, for approaching the network services design to support Active Directory in the most efficient, effective and comprehensive method. Healthcare Platform Optimisation guidance contains current best-practice guidance and recommendations on the most common network services design decisions required to support Active Directory, therefore accelerating the design process. Areas include: DNS Infrastructure requirements WINS Infrastructure requirements Healthcare Platform Optimisation guidance contains current best-practice guidance and recommendations on healthcarespecific network services design decisions required to support Active Directory, therefore accelerating the design process. Areas include: DNS naming practice Total Days Table 1: Timeline Breakdown Page 6

APPENDIX A DOCUMENT INFORMATION PART I Abbreviation DNS HPO IT MCSE NAT WINS Terms and Abbreviations Definition Domain Name Service Healthcare Platform Optimisation Information Technology Microsoft

10 APPENDIX A DOCUMENT INFORMATION PART I Abbreviation DNS HPO IT MCSE NAT WINS Terms and Abbreviations Definition Domain Name Service Healthcare Platform Optimisation Information Technology Microsoft Certified Systems Engineer Network Address Translation Windows Internet Name Service Table 2: Terms and Abbreviations PART II References Reference Document Version R1. Active Directory Design Guide: R2. Microsoft: Windows Server R2: Windows Server 2003 Active Directory: Table 3: References Page 7

Healthcare Desktop Office GPO Templates for GPMC v1

Healthcare Desktop Office GPO Templates for GPMC v1 Release Notes Prepared by Microsoft First published 27 September 2007 Copyright This document and/or software ( this Content ) has been created in partnership