...Active Directory Design Guide Thursday, 25 February 2010 Version 2.0.0.0 Baseline Prepared by Microsoft Prepared by Microsoft Copyright This document and/or software (“this Content”) has been created in partnership with the National Health Service (NHS) in England. Intellectual Property Rights to this Content are jointly owned by Microsoft and the NHS in England, although both Microsoft and the NHS are entitled to independently exercise their rights of ownership. Microsoft acknowledges the contribution of the NHS in England through their Common User Interface programme to this Content. Readers are referred to www.cui.nhs.uk for further information on the NHS CUI Programme. All trademarks are the property of their respective companies. Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. © Microsoft Corporation 2010. All rights reserved. Disclaimer At the time of writing this document, Web sites are referenced using active hyperlinks to the correct Web page. Due to the dynamic nature of Web sites, in time, these links may become invalid. Microsoft is not responsible for the content of external Internet sites. Page ii Active Directory – Design Guide Prepared by Microsoft, Version 2.0.0.0 Last modified on 26 February 2010 Prepared by Microsoft TABLE OF CONTENTS 1 2 Executive Summary ..............................................................................................
Words: 43732 - Pages: 175
...Windows Server 2003 Active Directory Judith Che Strayer University of Maryland Author Note Judith Che, Strayer University of Maryland. Any questions regarding this article should be address to Judith Che. Strayer University Maryland, White Marsh, MD 21085. Company’s today relay on good networking in order for their business to grow and succeed. A system engineer requires the ability, knowledge, and skill to plan and manage today’s networking which faces an ever-increasing variety of applications. We need to be skilled and informed to manage a network running Windows Server 2003 Active Directory. Present day networking administrators have difficulties ensuring that network resources are available to users when access is needed and securing the network in such a way that available resources are accessible to the proper user with the proper permission. We will have to solve networking problems including troubleshooting, configuration, installation, administration, and managing element. Starting from choosing the best Windows Server 2003 Edition that will meet the company’s needs in terms of price, performance and features; work group woes, name resolution nightmares and DNS name conflicts to server security. These problems can be solved with proper planning, managing, and designing a day-to-day administration of an Active Directory domain within their Windows Server 2003 network environment. We predict that implementing a Windows Server 2003 Active Directory will beat and exceed...
Words: 5782 - Pages: 24
...collection of users permission to access a network resource, such as a file system share or a printer, you can assign permissions to an organizational unit. | | Definition False | | | Term Subdomains in a tree inherit permissions and policies from their parent domains. | | Definition False | | | Term You can drag and drop leaf objects, such as users and computers, between OUs, but not between domains. | | Definition TRUE | | | Term Unlike organizational units, you cannot assign Group Policy settings to computer objects, nor can you delegate their administration. | | Definition TRUE | | | Term When you want to grant a collection of users permission to access a network resource, such as a file system share or a printer, you can assign permissions to an organizational unit. | | Definition FALSE | | | Term Active Directory is one of the easiest technologies to test because an isolated lab environment usually can emulate many of the factors that can affect the performance of a directory service. | | Definition FALSE | | | Term When you want to grant a collection of users permission to access a network resource, such as a file system share or a printer, you can assign permissions to an organizational unit. | | Definition FALSE | | | Term Active Directory is one of the easiest technologies to test because an isolated lab environment usually can emulate many of the factors that can affect the performance of a directory service....
Words: 1908 - Pages: 8
...Project- Windows 2012 Management 12/5/14 Active Directory is a directory service that Microsoft developed for Windows domain networks and is included in most Windows Server operating systems as a set of processes and services. An Active Directory domain controller authenticates and allows all users and computers in a Windows domain type network- assigning and enforcing security policies for all computers and installing or updating software. When a user logs into a computer that is part of a Windows domain, Active Directory checks the submitted password and determines whether the user is a system administrator or normal user. Active Directory makes use of Lightweight Directory Access Protocol (LDAP) versions 2 and 3, Microsoft's version of Kerberos, and DNS. Active Directory, like many information-technology efforts, originated out of a democratization of design using Request for Comments or RFCs. The Internet Engineering Task Force (IETF), which oversees the RFC process, has accepted numerous RFCs initiated by widespread participants. Active Directory incorporates decades of communication technologies into the overarching Active Directory concept then makes improvements upon them. Microsoft previewed Active Directory in 1999, it was first released with Windows 2000 Server edition, and revised it to extend functionality and improve administration in Windows Server 2003. Additional improvements came with Windows Server 2003 R2, Windows Server 2008, and Windows...
Words: 627 - Pages: 3
...Active Directory has both a logical side and a physical side, and each one plays a very important role. The physical side is made up of the domain controllers and physical locations where the domain controllers reside. When you promote a system to domain controller status, you will usually place that domain controller close to the user population that will use it for authentication and access. Domain controllers need to communicate with one another to share the information they have. The logical side is a little more nebulous; as well as containing the objects that define how the resources are organized and accessed, the logical side contains objects within Active Directory that define how the domain controllers will communicate with one another. Active Directory sites and site links define which domain controllers will replicate directly with each other and which ones will have to communicate indirectly through other domain controllers. Domains dictate the replication scope. When you create a domain, the domain partition is replicated only to domain controllers from the same domain. The domain partition is not copied to domain controllers outside of the domain. This allows you to partition your directory service and reduce the size of the database file that holds all of the forest’s objects. Organizational units are used to organize objects for easy administration and to manage those objects easily using group policies. To have efficient administration of resources,...
Words: 330 - Pages: 2
...Junior IT Admin: You can use Windows Server 2008 Group Policy to manage configurations for groups of computers and users, including options for registry-based policy settings, security settings, software deployment, scripts, folder redirection, and preferences. Group Policy preferences new in Windows Server 2008, are more than 20 Group Policy extensions that expand the range of configurable policy settings within a Group Policy Object (GPO). In contrast to Group Policy settings preferences are not enforced. Users can change preferences after initial deployment for information about Group Policy Preferences. By using Group Policy, you can significantly reduce an organization’s total cost of ownership. Various factors such as the large number of policy settings available, the interaction between multiple policies, and inheritance options can make Group Policy design complex. By carefully planning, designing, testing, and deploying a solution based on your organization’s business requirements, you can provide the standardized functionality, security, and management control that your organization needs. Overviewing Group Policy; it enables Active Directory–based change and configuration management of user and computer settings on computers running Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP. In addition to using Group Policy to define configurations for groups of users and computers, you can also use Group Policy to help manage server computers, by configuring...
Words: 377 - Pages: 2
...steps are required in the planning and design of this domain infrastructure? Determine the Number of Forests. This step involves determining whether one or multiple forests are required to meet the organization’s objectives. Determine the Number of Domains. This step involves determining the number of domains that are required to meet the organization’s objectives. Assign Domain Names. This step involves assigning names to each of the domains. Select the Forest Root Domain. This step involves selecting the forest root domain. Determine Domain Controller Placement. This step involves deciding where domain controller resources will be placed for each domain in each forest. Determine Operations Master Role Placement. This step involves deciding the placement of the operations master roles for the forest and each domain. Determine Domain Controller Configuration. This step involves determining the disk space, memory, processor, and the network requirements for each domain controller. How would you implement and configure the AD domain for these offices? When implementing AD for these offices I would configure first a forest or domain. Then I would configure trust, sites, and active directory replication. Then I would configure the global catalog and master operations. What would you implement to allow access between domains? Which type would you recommend and why? Selective authentication By creating Selective authentication, when a user authenticates across a trust with the...
Words: 918 - Pages: 4
...One of the benefits of moving an organization to an Active Directory environment is the use of trees and forests. Trees are groups of one or more domains who share resources. Each domain within the tree trusts the other domains in areas of security. A domain added to a tree becomes a child of that tree root domain. These trees can then become a part of a forest. A forest is a collection of numerous trees who share a common large-scale catalog, directory outline, logical structure, and directory arrangement. Forests permit organizations to group their divisions that may need to operate self-sufficiently and use different naming patterns, but still need to communicate with the entire organization through trustworthy sites and share some of the same resources. This allows the organization to reduce costs without added complication and have greater security. (1) Another benefit would be user management. Due to active directory’s forest design, users in one domain are known to the forest domain director. This provides for more flexibility and ease of access for users who must travel from one site to another. A user can travel from site 1 to site 2 and still be able to log in with their usual username and password and have access to all resources throughout the domain. (2) Another useful tool within active directory is group policy. Say you have an employee or group of employees who don’t necessarily follow your rules for computer use. They change their CPU’s desktop environment...
Words: 434 - Pages: 2
...but cannot function as an Active Directory domain controller, Windows Server 2008 Standard (Standard edition is also limited to computers with up to 4 GB of RAM (in the x86 version) and up to four processors, Windows Server 2008 Enterprise(The Enterprise edition includes the full set of Windows Server 2008 features, and supports computers with up to eight processors and up to 64 GB of RAM (in the x86 edition). Enterprise also supports up to four virtual images with Hyper-V (in the 64-bit version) and an unlimited number of network connections), Windows Server 2008 Datacenter (Designed for large and powerful servers with up to 64 processors and fault tolerance features such as hot add processor support. This edition is available only from original equipment manufacturers (OEMs), bundled with a server), and Server Core which is a completely stripped version of windows server, only having a command prompt and limited abilities. There are major advantages and disadvantages of both Windows Server and Linux based systems depending upon the needs of your system. The majority of Linux variants are available for free or at a much lower price than Microsoft Windows. The majority of Linux variants and versions are notoriously reliable and can often run for months and years without needing to be rebooted. Although the majority Linux variants have improved dramatically in ease of use, Windows is still much easier to use for new computer users. Microsoft has made several...
Words: 1301 - Pages: 6
...Marketing and Sales, Manufacturing, Product Research, and Business. Which of the following Active Directory container design plans might you use to best manage the user accounts and network access needs of each department? a. Create four trees. b. Create four parent domains in one site. c. Create four OUs in one domain. d. Create four trees and map them to four domains. 2. Using the example in Question 1, what Active Directory capability can you use to establish different account lockout policies for each of the four departments? a. fine-grained password policies b. lightweight group policies c. password distribution groups d. shadow password files 3. Your colleague is trying to create a universal security group for the three administrators of the single stand-alone server in his company. The problem is that he can’t find an option to create a universal security group. What is the problem? a. He must first create the administrators’ personal accounts before it is possible to create a universal group. b. He needs to put the account creation tool into the Advanced Features mode. c. He must create a universal distribution group first and then create the universal security group. d. He cannot create a universal security group on a stand-alone server and must instead create a local security group. 4. One of the DCs in your company reports that it has an Active Directory error. You need to fix it as quickly as possible to reduce downtime. Which of the following...
Words: 1179 - Pages: 5
...741 COMPARATIVE OPERATING SYSTEMS TERM PAPER SUMMER 2001 COMPARISON OF NETWORK OPERATING SYSTEMS BY MUKUNDAN SRIDHARAN COMPARISON OF NETWORK OPERATING SYSTEM S Abstract We are in a era of computing in which networking and distributed computing is the norm and not a exception. The ability of a operating system to support networking has become crucial for its survival in the market. In today’s picture there is no operating system, which doesn’t support networking. This paper tries to give a review of various network operating systems or the networking support of a operating system, in relevance to the modern operating systems. The emphasis is on basic design and architecture, not their specifications or services. The paper considers various operating systems like Novell Netware, the sun NFS, the Styx, CIFS/SMB and Microsoft Windows 2000 server. Again the concentration is on modern and evolving operating systems like the Novell Netware and Microsoft’s Windows 2000. The objective of the paper is to study and compare various operating systems and to bring out the inherent advantages and disadvantages in using them. 1.0 INTRODUCTION Individual computers are connected together to form computer networks. The operating system, protocols and services which help us in interconnecting the computers are collectively called Network Operating systems. The webopedia.com defines Network Operating Systems as follows: An operating system that...
Words: 12519 - Pages: 51
...Active Directory Design Scenario My first question: Is what type of business or industry the company represents? Who will be the executive sponsor, the project architect, project manager? Will this person also be in charge of the Active Directory? What is the budget, time-frame and schedule of this project? Does the other company have an IT Administrator or are they using a consultant? If so, it would be more cost effective to hire an IT Administrator. What are the business needs of the company we are merging with? Who is the WAN person responsible for the network? Have him/her provide a map of your current WAN network. What applications will be integrated in the AD/DS design? Will a variety of technologies, different levels of security and a global presence now or in the future be required? Where will all your data be stored? Will we be having geographically separate data rooms? Who are the Active Directory Service and Data Owners? (Service owners include the forest owner, the AD/DNS owner, and the site topology owner. The Data Owners will include organizational unit Owners. Will the other site have a Service Administrator or a Data Administrator? Because it is cost saving having Data Administrators. The Data Administrators are users within a Domain, who are responsible for both, maintaining data that is stored in the AD/DS i.e. user and group accounts and maintaining computers that are members of their domain. Service Administrators require...
Words: 293 - Pages: 2
...Lab #3 – Assessment Worksheet Identify & Classify Data for Access Control Requirements Course Name & Number: IS3230 ______________________________________________________________ Student Name: Heather Young ______________________________________________________________________ Instructor Name: MR. Gibbs _____________________________________________________________________ Lab Due Date: Jan. 2014 _______________________________________________________________________ Overview This lab provides the student with the opportunity to develop a data classification standard with procedures and guidelines to classify data access based on the job responsibilities – not an organizational position. In this lab, students aligned a data classification standard with the job function and roles that are required to access specific data. This alignment allows access controls policy definition to be properly implemented throughout the IT infrastructure to mitigate risk from unauthorized access. Lab Assessment Questions & Answers 1. What is the Data Classification Standard used in the U.S. Department of Defense (DoD)/Military?Google “Data Classification Standard + DoD”. Summarize the different data classifications. Top Secret- highest level of information sensitivity Secret- information that would cause serious damage, most common classification level Confidential- Is the lowest of sensitivity. This information may only be handled by personnel with a clearance, may...
Words: 993 - Pages: 4
...never if it fails rather when it fails. “Regardless of how bulletproof the design is, how fault-tolerant the system, or how well trained the operators and technicians, system failures are still possible.”(Witt, 2009) In the event the system does fail either by, disk failures, administrative errors, natural disasters, or unauthorized changes to data, a recovery plan must be in place to minimize downtime. In the scenario as described for Kudler Fine Foods, there would be a backup drive at each location, where daily backups of data will take place and those backups will be stored on a tape drive that way information is not lost at any time and stored offsite. The files would be stored off site in the event there is a natural disaster or fire or some other catastrophic event to take place that actually destroys the servers and hard drives, the tape drives being stored offsite preserves the data once a new server is in place. Data redundancy is a key aspect to recovering from such system failures. In the case of restoring Active Directory Directory Services in the event of data loss or system failure, there are several utilities within Active Directory that can assist with the recovery of system settings: * Windows includes the very basic NTBACKUP utility, which can be used to perform a system state backup of a DC. The system state of a domain controller includes its registry, SYSVOL, Active Directory DIT files, and critical system files. *...
Words: 486 - Pages: 2
...TRUE/FALSE 1. Network operating systems are essential if the network is going to allow multiple users to share resources. ANS: T 2. Users cannot interact directly with the operating system through a shell. ANS: F 3. In reality, a multitasking operating system runs only one program at a time. ANS: T 4. The resources that a network operating system must manage typically include one or more network servers. ANS: T 5. A network operating system does not perform network support functions. ANS: F 6. Microsoft Windows 7 is an example of a desktop operating system. ANS: T 7. NetWare 6 was the last version of Novell’s network operating system. ANS: T 8. A bindery contains the data that pertains only to the server it resides in. ANS: T 9. The design of a tree should ideally be similar to a pyramid. ANS: T 10. NetWare 5 dropped the NDS distributed database of network resources. ANS: F 11. Windows 2008 Server is a network operating system designed to run over a network of microcomputer workstations and provide file sharing and peripheral sharing. ANS: T 12. It is not possible to create a network with multiple domains. ANS: F 13. Unlike NetWare’s NDS, Active Directory creates a hierarchical structure of resources. ANS: F 14. Unix is most often found with a text-based interface, although graphical user interfaces are available. ANS: T 15. Shortly after its introduction, the Unix software...
Words: 3578 - Pages: 15
