C UNIT 3. Global Catalog & Flexible Single Master Operations (FSMO)

Transcription

1 UN 3 Global atalog & Flexible Single Master perations (FSM) PW PW onna Warren

2 opics for this Unit Functions of the Global atalog Functions of Universal Group Membership aching he Five FSM roles Management of FSM roles ransfer and seizing of FSM roles PW PW onna Warren

3 Global atalog ritical component of ctive irectory cts as a central repository by holding complete copy of objects from the host server s local domain partial copy of objects from other domains within the same forest Used dfor logon, object searches, and universal group memberships By default, the first domain controller installed in the forest root domain is designated as a global catalog server ny or all domain controllers in a domain can be designated as global catalog server PW PW onna Warren

4 Global atalog Where you put the global catalog depends on he speed and reliability of the WN link he amount of traffic that will be generated by replication he size of the global catalog database ctive irectory searches are automatically sent to P port 3268 Global l catalogs tl are identified d by NS through h S records (global catalog, or _gc, service) PW PW onna Warren

5 Universal Group Membership aching Server 2003 and Windows Server 2008 Used for sites that do not have a global catalog server available Stores universal group memberships on a local domain controller so no global catalog is needed provided he user successfully logged on at some point Universal group caching was turned on nabled on a per site basis By default, cache is refreshed every eight hours f caching not available and link down, can t login PW PW onna Warren

6 dding a Global atalog Server Use ctive irectory Sites and Services from the dministrative ools folder PW PW onna Warren

7 nabling Univ Group Membership aching Use ctive irectory Sites and Services PW PW onna Warren

8 FSM oles First domain controller in a new forest holds both of the forest wide FSMs and the three domain wide FSMs Flexible Single Master perations (FSM) roles elative dentifier Master nfrastructure Master Primary omain ontroller (P) mulator omain Naming Master Schema Master PW PW onna Warren

9 FSM oles elative dentifier () Master ne per domain esponsible for assigning relative identifiers to domain controllers in the domain elative identifiers are variable length numbers assigned by a domain controller when a new object is created nfrastructure Master ne per domain esponsible for reference updates to other domains ssists in tracking which domains own which objects PW PW onna Warren

10 P mulator one per domain FSM oles Provides backward compatibility with Microsoft Windows N 4.0 domains and other down level clients Manages account lockouts Manages time synchronization for the domain Managers password changes and replicates immediately Managing edits to Group Policy bjects (GP) Schema Master ne per forest esponsible for managing changes to the ctive irectory schema PW PW onna Warren

11 FSM oles omain Naming Master ne per forest Has the authority to manage the creation and deletion of domains, domain trees, and application data partitions in the forest When any of these is created, the omain Naming Master ensures that the name assigned is unique to the forest PW PW onna Warren

12 MNGNG FSM LS ctive irectory Users nd omputers master nfrastructure master P emulator ctive irectory omains nd rusts domain naming master Microsoft Management onsole (MM) Schema snap in schema master epadmin NSUtil ll roles PW PW onna Warren

13 Managing FSM oles ole seizure Used only when you have experienced a failure of a domain controller that holds a FSM role and you forced an ungraceful transfer Use the ntdsutil command to access the fmso maintenance prompt and use the seize command ole transfer Used to move a FSM role gracefully from one domain controller to another PW PW onna Warren

14 ransferring Schema Master FSM ole pen the ctive irectory Schema snap in ight click ctive irectory Schema from the console tree and select hange perations Master emember that before you can access the ctive irectory Schema snap in, you need to register the schmmgmt.dll LL file using the following syntax regsvr32 schmmgmt.dll PW PW onna Warren

15 FLU Schema master can t change the schema but has no effect on users omain naming master can t add or delete domains P emulator users that logon through the P emulator will not be able to log on master can t move objects from one domain to another and if all the s are used up you can t create new objects nfrastructure master the active directory database can become corrupted PW PW onna Warren

16 Summary he global catalog server acts as a central repository forctive irectory by holding omplete copy of all objects within its local domain opy of all objects from other domains within the same forest he global catalog has three main functions o searches for objects in the forest esolve UPN names Provide universal group membership information PW PW onna Warren

17 Summary global catalog should be placed in each sitewhen possible. f not possible, universal group membership caching can be enabled for the site to facilitate logon requests Global catalog placement Speed and reliability of the WN link mount of traffic that will be generated by replication Size of the global catalog database PW PW onna Warren

18 Summary perations master roles are assigned to domaincontrollers to perform single master operations he Schema Master and omain Naming Master roles are forest wide. very forest must have one and only one of each of these roles he Master, P mulator, and nfrastructure Master roles are domain wide very domain must haveonly one of each of these roles PW PW onna Warren

19 Summary FSM roles can be managed in two ways: ole transfer ransfer a FSM role to other domain controllers in the domain or forest to balance the load among domain controllers accommodate domain controller maintenance and hardware upgrades ole seizure Seize a FSM role assignment when a server holding the role fails and you do not intend to restore it Seizing a FSM role is a drastic step that should ldbe considered d only if the current FSM role holder will never be available again PW PW onna Warren

20 Summary Use repadmin to check the status of the update sequence numbers (USNs) when seizing the FSM role from the current role holder Use ntdsutil to actually perform a seizure of the FSM role PW PW onna Warren

21 Lab 4 reate a Global atalog Failure nable Universal Group Membership aching ransfer FSM oles PW PW onna Warren