Tema 25 - Directorio Activo Microsoft, 2016 o superior.

• Topic focus is Microsoft Active Directory 2016 or later, Domains, Incorporating and Removing devices from a domain, PowerShell Scripting, and Group Policy Objects (GPO).

Introduction to Active Directory

• Active Directory, also called AD, is a directory service unique to Windows Server environments, designed for central resource management across a network
• It helps administer identifies and permissions of users, groups and devices
• The principal aim is a single place to manage identities and permissions for all users and resourced within a network
• Attributes can be viewed and modified via graphical tools or command line scripts
• Key benefits are:
• Facilitating user authetication and the ability to authorize actions on network resources
• Standardizing and centralizing credential administration, security policies, and configurations
• Streamlining the integration and management of devices and users while ensuring control and tractability

Active Directory History

• Ties into the sucessive versions of Windows Server
• Windows 2000 Server: The initial release of this directory service which was completely different from the old NT 4.0 domain system
• Introduces concepts such as forests, trees, domains and organization units
• Windows Server 2003: Enhanced security and scalability, with extra features like Volume Shadow Copy Service
• Windows Server 2008 and 2008 R2: Features include Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), with enhanced auditing and replication capabilities
• Server Core was introduced, which allowed the installation of an operating system with a reduced interface
• Windows Server 2012 and 2012 R2: Featured a modernized admin interface, integration with Server Manager, advanced virtualization features, and replication improvements.
• Windows Server 2016: Heavily based around security with features including Shielded VM, Just Enough Administration and improved remote management
• Windows Server 2019 and later: Enhanced security and cloud services integration and optimized performance, scalability, and usability
• Each version improved Active Directory to align with modern environments and facilitates the implementation of hybrid administration servies

Active Directory Architecture

• Domains: The foundation in AD, containing the objects, policies and directory, also a security and administration boundary defining users, groups and resources
• Trees: A series of domains forming a hierarchy with a main root domain relating to the secondary, child domains and sharing a contigiuous name space
• Forests: An organization that groups one or more domain trees sharing the AD scheme for configurations, and all domains within a forest trusting one another
• Represents the broadest security boundary in an Active Directory environment
• Organizational Unites (OUs): Conatiners in a domain for logically grouping objects, enables granular permission delegation and policy application
• Domain Controllers (DCs): servers with the Active Directory Domain Services (AD DS) role installed. They store and replicate copies of the Active Directory database, authenticates users and deals with directory requests
• Catalogs: Configured and store partial copies of all the objects of a forest, allowing for fast and efficient searching of items
• Replication: Active Directory uses a multi-master replication mechanism to propagate changes accross DCs while controling consistency and managing conflicts to optimize network traffic
• Active Directory Scheme: Defines the types of objects and associated attributes, acting as a template which can be changed for all domain controllers if the changes are done with care

Advantages of Active Directory Architecture

• Centralization: All identity data is kept in one central location, simplifying auditing, policy enforcement, as well as account and password management
• Administration delegation: Allows assigning limited admin rights with certain domains
• Scalability: Ability to start with one domain and add more as needed
• Multiplatform support: Complies with LDAP, Kerberos and DNS protocols allowing other devices like macOS etc to authenticate
• High availability: Multiple domain controllers and multimaster replications prevents one point of failure

Common active directory errors

• Overdimensioning or creating too many domains or OUs making the administration difficult
• Depending on a single DC without any contingency plans causing service interruptions
• Ignoring underlying network issues and depending strongly on DNS and network connectivity like DNS configurations
• Lack of scheme expertise leading to compatibility and implementation issues

Domain in Active Directory

• A logical container for managing objects including users, groups, computers, printers and more centrally
• Common database: Contains its own Active Directory database, replicating across all domain controllers
• Authentication and authorization: Authenticates users or devices for access within the domain, then authorizes them based on configured policies
• Security boundary: Allows administrators to set specific policies, roles, and permissions
• Domain Administrator: Privliges confined to the domain rather than across the forest or to Enterprise Admins in the root domain
• DNS relationship: Assocaited with a DNS name area
• Can be a single domain for small organizations or multiple for specific geographical and functional purposes

Configuring a New Domain

• Install AD DS (Active Directory Domain Services)
• Afterwards, follow the configuration of promotion
• Options include: creating a new forest if there isn't one, or add a new domain to a forrest if there already is one
• The root domain is selected
• A restoration mode password is made in case of a server recovery
• The assistant runs a DNS availability check and version match

Domain Initial Configuration

• Makes directories for database, SYSVOL for group polices, and sets DNS records for local domain controllers
• Logging into the server as an Admin verifies that server has properly been renamed, and that it belongs to the made domain
• Ensure replication is working

Design Considerations

• Structure the forest, and where to create a new domain is dependent on existing schemes
• Determine the functional levels of the domain e.g. Windows Server 2019, to use the most recent features
• Choose domain name that does not interfere with internet names (e.g. “.local” or “.corp”)

Administration of domains

• Daily operations focus on administration and maintenance, such as creating, modifying, and removing users, implementing group policies, and managing security
• Active Directory Users and Computers: a GUI based tool for managing objects within OUs
• Active Directory Administrative Center: Modern Console included from Windows Server 2008 R2, for a user friendly experience as well as access to the AD recycle bin
• Group Policy Management Console (GPMC): Used for managing and applying group policies to the domain
• Command line tools PowerShell: Utilizes commands and new functions including Active Directory like Get-ADUser to automate processes
• Daily tasks:
• Account creation: Assigning roles and email as needed
• Modifying passwords and attributes and info
• Account deactivation and deletion
• Group management to assign permissions

Good practices in administration:

• Keep an updated inventory
• Apply rule of least privlidge
• Apply clear audit and record management
• Maintain updated and patched controllers

Joining of devices to the domain

• In order to add a new device to a domain whether client or server, authentication, DNS, and group polices must be followed to verify their proper integration into the domain
• Network Configuration: needs to have an IP address and point to DNS
• DNS must resolve with an adequate admin role
• Name the device to something unique

Incorporating a domain

• Access the System Configuration and select "Domain"
• Put in valid credentials and domain

Verifying integration

• Login with a domain account to ensure successful authentication Check Active Directory Users and Computers to see object in active directory
• Apply Group polices

Retiring an device from a domain

• This can be removal, maintenance, or security reasons
• In order to perform it:
• Remove device from the domain
• Delete device object from Active Directory
• Double check for success

Precautions and considerations for devices

• Every device needs a password that is automatically generated, so make sure to properly remove every single one before replacement
• Conduct regular cleanups
• Reassign roles and licenses

Summary of practices to impact the management

• Maintaining registries and follow-ups
• Automatizing
• Assign team
• Policy of expiration
• Sync with management

Introduction to PowerShell

• Built as an automation scripting technology, it interacts in a uniform way with components of .NET and is useful in simplifying the configuration of Windows systems
• Key features of PowerShell include:
• Able to manage objects, and is extensible
• Consistent naming like, New-ADUser
• Automation with scripting
• Remoting

Versions and Compatibility

• Both versions are kept up, and Windows PowerShell is sufficient for Active Directory if the “Active Directory.” moduel is available

Active Directory Module

• This adds an advantage for AD, as they automatically add this module to domain controllers, allowing clients to add the RSAT module

Common PowerShell commands

• Get-ADUser to retrieve information of users
• New-ADUser to create a user in domain

Common parameters and filtering options

-Identity: Specify user, group, or computer being handled -Filter: Used for batch tasks

• SearchBase -SearchScope: Restrict searches
• PowerShell gives all users complete control over batch processing

Automation And Common Tasks

• Can automate integration by setting remote devices with the proper creds, oupath, and restarting
• Group and Permission Delegation:
• Assign users using commands, to specific groups

Auditing and Monitoring

• Can review event logs to export info to CSV or HTML and will notify send messages, to create alerts through mail

PowerShell best practices:

• Cautious admin account usage to avoid hardcoding passwords
• Testing of codes
• Regular management

Group Policy Obkects (GPO)

• Crucial for settings and politics
• Define structure and creaton
• Can help automate massive management

Structure

• GPO follows active direcotry in order of prevalence in case of conflicts that represent the application order
• Can also have computer configurations. with GPOs
• Easy to manage hundreds or thousands of devices and users in one swoop
• Standardization ensures better consistency
• Enhanced security

Command

• Group policy management to create , edit, and link
• Use GPMC to configure security
• WMI filtering will specify GPO by various device parameters

Important recommendations with PowerShell

• Before creating complex GPO with WMI filters, verify units
• Document in case

Normative relation and relation to Active directory

• ENS can be implemented, with Active directory providing several protection guidelines

Good implementation points

• Adopting an open approach that is updated
• Documenting processes

Concluding

• Active directory with automation and clear policies, means numerous benefits
• Simplification of management
• High security.
• All changes must be tested