70-647: Windows Server Enterprise Administration Course 01 Planning for Active Directory

Transcription

1 70-647: Windows Server Enterprise Administration Course 01 Planning for Active Directory

2 Slide 1 Course 1 Planning for Active Directory Planning the Domains and Forest Structure Planning for Sites and Replication

3 Slide 2 Topic A: Logical Design Forests Domains Trusts Functional Levels Schema

4 Slide 3 The Forest This begins the foundation of the logical structure of Active Directory. The Forest design will precede the design of the Domain Structure.

5 Slide 4 How will AD DS be used? AD DS is considered your network operating system If this is the only requirement of AD DS, usually a single forest will suffice Using AD DS as an Enterprise solution There may be requirements to separate directories for security thus multiple forests may be involved AD DS as an Internet Directory may instead be replaced by AD LDS

6 Slide 5 Requirements Before beginning the design, you should look at the functional requirements for AD DS Organizational Structure Operational Requirements Legal Requirements Limited connectivity issues

7 Slide 6 Requirements Autonomy Services Data Isolation Services Data

8 Slide 7 How Many Forests are Needed? Based on the requirements, you should be able to determine how many forests would be needed Requirements Isolation Autonomy

9 Slide 8 Forest Model Organizational Forest Model Based on management Resource Forest Model Usually separate forests Restricted Access Forest Model Data or user restrictions

10 Slide 9 Domains Often considered the security boundary Goal is to determine: How many domains are needed In which forest should domains be created

11 Slide 10 Requirements Domains are often thought of ways to partition a forest to smaller units Consider replication capability Security Boundaries

12 Slide 11 The Domain Model Single Domain Model A forest with a single domain All directory data in one partition Regional Domain Model Example could be regional locations within the forest May be based on physical connectivity

13 Slide 12 How Many Domains? Often the choice of domains could be based on physical connectivity which affects replication Decisions could also be based on numbers of managed objects Not an actual limit, but rather how much replication traffic or security issues may be involved

14 Slide 13 Upgrade or Create New Domains Is there an existing Windows Network involved? Will the domain functional level work? Can you afford the downtime? Are there new features that are needed?

15 Slide 14 The First Domain The first domain is called the Forest Root Domain Usually the only domain that is immune to changes Destroying the forest root domain would destroy the forest Dedicated Forest Root Domain Regional Forest Root Domain Domain Trees in the forest

16 Slide 15 Functional Levels Domain Functional Levels Windows 2000 Native Windows Server 2003 Windows Server 2008 Domain Functional Level Windows 2000 Native Domain Controllers Supported Windows 2000 Server Windows Server 2003 Windows Server 2008 Windows Server 2003 Windows Server 2003 Windows Server 2008 Windows Server 2008 Windows Server 2008

17 Slide 16 Domain Functional Level Features Domain Functional Level Windows 2000 Native Windows Server 2003 Windows Server 2008 Enabled Features Universal Groups (security and distribution) Group Nesting Group Conversions (security, distribution, and scope) SID History Netdom.exe tool to prepare for DC rename Update of the logon time stamp Set userpassword attribute as the effective password on the inetorgperson Object Redirect Users and Computers Containers Constrained Delegation Support for Selective Authentication DFS Replication for SYSVOL AES 128 and 256 support for Kerberos Last Interactive Logon Information Fine-Grained Password Policies

18 Slide 17 Functional Levels Forest Functional Levels Windows 2000 Windows Server 2003 Windows Server 2008 Forest Functional Level Windows 2000 Native Domain Functional Levels Supported Windows 2000 Server Windows Server 2003 Windows Server 2008 Windows Server 2003 Windows Server 2003 Windows Server 2008 Windows Server 2008 Windows Server 2008

19 Slide 18 Forest Functional Level Features Functional Level Windows 2000 Windows 2003 Windows 2008 Features Supported All Default Features Forest Trusts Domain renaming Linked-value replication RODC Better KCC Create an instance of the dynamic auxiliary class Convert inetorgperson to User object Application basic groups LDAP query groups Deactivate and redefine attributes No additional features

20 Slide 19 Schema Only one Schema exists for the forest This is your dictionary of objects in the forest Once changed, it can t be reversed This means you need to be careful about design changes Practice changes in a lab environment

21 Slide 20 Working with Trusts You may need to change trust relationships to improve performance Shortcut Trusts One-Way Trusts Forest Trusts Transivity

22 Slide 21 Topic B: Physical Topology Sites Controlling Replication

23 Slide 22 Physical Networks Gather the Network Topology Information Domain Controller Placement can be crucial Designing Sites Subnet Objects Replication needs Review of Domain Controller Replication

24 Slide 23 Review of Domain Controller Replication

25 Slide 24 Site Design Options Single Site Model Already a default site Multiple Site Model Replication Control Site Links Bridgehead Servers

26 Slide 25 Site Replication Design Replication Topology All about Bandwidth Hub and Spoke Full Mesh Hybrid

27 Slide 26 Site Links The purpose of a site link is to control the direction of replication within a domain The design is to identify the sites that you want to connect All site links are by default a member of the default-first-site-link collection You can also choose the site link communication protocol to be used, either RPC over IP, or SMTP

28 Slide 27 Site Links Continued Site links have properties which should be considered when creating them Cost represents information regarding the KCC choosing the best path for replication Schedule represents the frequency of replication

29 Slide 28 Site Link Bridging Site Link Bridges connect site-links. This enables transitivity between the links. KCC can use these bridges to re-route paths for replication if necessary Uses a total sum for all site-links on path computation Bridgehead servers are the connections for the bridges that you create

30 Slide 29 Site Replication Example

31 Slide 30 Domain Controller Placement Replication is done between Domain Controllers, which means that the design of sites will correspond to where the sites and site links are created Forest Root DC responsible for trust paths, and is often the first DC created in your Forest Should be at hub locations RODC Usually found at remote locations Global Catalog Also a source of replication traffic

32 Slide 31 Domain Controller Placement Continued PDC Emulator Schema Master Domain Naming Master Relative Identifier Master Infrastructure Master Single Domain Forest Multiple Domain Forest

33 Slide 32 Printer Location Policies The physical aspect of your domain also includes printers Searchable from AD DS Accessible from the Web Consider Naming Convention Consider Description and other Attributes

34

35 Review Questions: 1. True or False: You cannot have more than one forest in your Active Directory design. A. True B. False 2. Before implementing Active Directory, you should look at which of the following functional requirements? A. Organizational chart of employees B. Administrative control C. Legal requirements D. Competition requirements E. All of the above F. Both B and C G. Both B and D 3. Your design will need more than one forest when your Active Directory design calls for a separation of user account information, such as in a Chinese wall design. What type of the following designs would this be an example of? A. Service Autonomy B. Service Isolation C. Data Autonomy D. Data Isolation 4. Which of the following forest models would be designed based on management? A. Organizational B. Resource C. Restricted D. Private 5. Which of the logical Active Directory structures is often considered a security boundary? A. Forest B. OU C. Domain D. GC 6. Which of the following is a single domain model? A. Each tree in a forest with just one domain B. Each domain with a single site C. Each forest made of just one domain D. Each domain with a single domain controller

36 7. What factors might be considerations for how many domains are to be made? A. Controlling intra-domain replication via creating domains on each side of a slow data link instead of sites B. Cost of the domain controller licenses C. Having met the maximum number of AD objects that can be stored within a domain D. Having too many objects in the AD domain database, not because of a storage limit but because of the designing of how much replication is to be done 8. What is the very first domain considered within your AD design? A. Tree Root B. Forest Root C. Single Domain Model D. FSMO Master 9. What forest functional level introduced the RODC? A. Windows 2000 Mixed B. Windows 2000 Native C. Windows 2003 D. Windows What acts as the dictionary of all objects and their attributes that can be configured within Active Directory? A. Global Catalog B. Schema C. Replication D. OU

37 Answer Key: 1. B You can create as many forests as you need, depending on the design structure needed to satisfy isolation and autonomy. 2. F Administrative controls determine much of the structure of your AD design, as well as any regulatory laws that must be followed. 3. D Data, in this case the AD Objects, would be separated by the forests, and that would be an isolation of the data. 4. A Organizational Forest Model is based on the management needs of the organization. 5. C The domain is a partition of the AD database, as well as a security boundary. 6. C A forest made of just one domain is a single domain forest. 7. F Controlling intra-domain replication and having too many objects in the AD domain database are both major factors in the design of your Active Directory structure. 8. B The first domain created is the root of the tree in the forest. 9. C Windows 2003 was the first forest functional level that supported the RODC. 10. B The schema acts as the dictionary of all objects and their attributes and can be configured within Active Directory.