Active Directory Domain Services Overview

Installing Active Directory Domain Services

• Active Directory Domain Services (AD DS) provides centralized authentication and authorization to network resources
• AD DS is used in business environments to:
  • Simplify user management
  • Control access to data
  • Enforce company security policies
• Use Server Manager to install AD DS role

Active Directory is a Directory Service

• A network directory service stores information about a computer network and offers features for retrieving and managing that information
• You can use directory services to find resources, for example, a printer

Active Directory Features

• Hierarchical organization
• Centralized but distributed database
• Scalability
• Security
• Flexibility
• Policy-based administration

Active Directory Structure

• Physical Structure: Consists of sites and servers which are configured as domain controllers
• Logical Structure: The directory service’s look and feel after the organization in which it runs
• The schema attributes define what type of information is stored in each object
• The information stored in each attribute is called the attribute value

Active Directory Objects

• There are two types of objects in Active Directory:
  • Container objects - contain other objects
  • Leaf objects - do not contain other objects
• Leaf objects include:
  • Security accounts
  • Network resources
  • Group Policy Objects (GPO)

Active Directory Container Objects

• Container objects help organize and manage users and resources on the network
• Container objects can act as administrative and security boundaries
• Three container objects are found in AD:
  • Organizational Units (OUs)
  • Folder Objects
  • Domain Objects

Organizational Units

• An OU is a primary container object for organizing and managing resources in a domain
• OUs can organize multiple objects into logical administrative groups that can be configured with specific policies relevant to that group
• The authority of an OU can be delegated
• Nesting OUs can build a hierarchical Active Directory structure that mimics the corporate structure for easier object management

Folder Objects

• There are five folder objects in Active Directory:
  • Builtin
  • Computers
  • Foreign Security Principals
  • Managed Service Accounts
  • Users

Domain Objects

• The core logical structure in AD
• Domain objects include:
  • OUs
  • Folder container objects
  • Leaf objects
• Larger companies may use multiple domains to:
  • Separate administration
  • Define security boundaries
  • Define policy boundaries

Leaf Objects

• Leaft objects do not contain other objects
• Leaf objects represent one of the following:
  • Security account
  • Network resource
  • Group Policy Object (GPO)
• Security Account Objects include:
  • Users
  • Groups
  • Computers
• Network resource objects include:
  • Servers
  • Domain controllers
  • File shares
  • Printers

Other Leaf Objects

• Contact: A person associated with the company but not a network user
• Printer: Represents a shared printer in the domain
• Shared folder: Represents a shared folder on a computer in the network

User Accounts

• A user account object contains information such as:
  • Group memberships
  • Account restrictions
  • Profile path
  • Dial-in permissions
• Authentication confirms a user's identity and assigns permissions and rights
• There are two types of user accounts:
  • Local user account: authorized to access resources only on that computer
  • Domain user account: provides a single logon for users to access all resources in the domain
• Two built-in user accounts are created by default:
  • Administrator
  • Guest

Groups

• A group object represents a collection of users withcommon permissions or rights
• Permissions define which resources users can access and what level of access they have
• Rights specify what types of actions a user can perform on a computer or network
• Groups are used to assign members permissions and rights which is more efficient than assigning permissions and rights to each user separately

Computer Accounts

• A computer account object represents a computer that’s a domain controller or domain member
• Used to:
  • Identify
  • Authenticate
  • Manage computers in the domain

Choosing a Domain Structure

• Most small and medium businesses recommend a single domain for the following reasons:
  • Simplicity
  • Lower Administrative Costs
  • Easier Management
  • Easier Access to Resources
• A single domain structure is easier and less expensive than a multi-domain structure