Windows Server Admin: Active Directory Overview

Windows Server Admin Fundamentals: Overview

• Covers the core concepts of Active Directory (AD) for Windows Server administration.
• Includes lessons on DNS, AD infrastructure, accounts and groups, organizational units (OUs), containers, and Group Policy.

Lesson 1: Active Directory Infrastructure

• Domains and forests:
  • Forest: A hierarchical structure of one or more domains.
  • Tree: A partial representation of a forest, with a single root domain.
  • Domain: A logical grouping of users, computers, and other resources.
• Domain Controllers:
  • Servers hosting the AD database (NTDS.DIT) and SYSVOL.
  • Perform authentication using Kerberos and Key Distribution Center services.
  • Best practices include using at least two domain controllers for availability and security measures like RODC or BitLocker Drive Encryption.
• Operations Master Roles (FSMOs):
  • Single-master operations in a multi-master replication model.
  • Examples include schema master, domain naming master, and infrastructure master.
• Functional Levels:
  • Determine the version compatibility and features of the AD domain and forest.
  • The functional level needs to match the highest OS version of the domain controllers.
• Trust Relationships:
  • Mechanisms for allowing users and computers in one domain to access resources in another domain.
  • Types include parent/child, tree root, external, shortcut, and forest.
• Sites:
  • Network locations that are defined for managing replication and service localization.
  • Used when domain controllers are separated by slow network connections.
• Active Directory Recycle Bin:
  • Enables restoring deleted AD objects without downtime.
  • Use the Active Directory module for Windows PowerShell or the Active Directory Administrative Center to recover objects within a specified lifetime.

Lesson 2: Accounts and Groups

• Account Types:
  • User Accounts: Allow users to sign in, access resources, and perform tasks.
  • Computer Accounts: Enable computers to authenticate and access resources.
• Group Types:
  • Distribution Groups: Used for email purposes only, not security-enabled.
  • Security Groups: Have security identifiers (SIDs), can be granted permissions, and can also be email enabled.
• Group Scopes:
  • Local Groups: Memberships can be users, computers, other group types, and permissions apply only to the local computer.
  • Domain Local Groups: Memberships are similar to local groups but permissions apply to resources anywhere in the domain.
  • Global Groups: Membership restrictions include only users and computers, and permissions can apply to resources within the domain and trusted domains.
  • Universal Groups: Can contain any type of object across the forest and permissions apply to resources throughout the forest.
• Group Nesting:
  • Implementing a group hierarchy, typically using IGDLA (Identities – Global – Domain Local – Access) structure.
• Group Managed Service Accounts (gMSAs):
  • Used to automate password and service principal name management for service accounts.
  • Can be used on multiple computers within the domain.
  • Require a Key Distribution Service root key for the domain.

Lesson 3: Organizational Units and Containers

• Organizational Units (OUs):
  • Container for grouping objects within a domain for management purposes.
  • Used for applying Group Policies and delegating administrative permissions.
  • Can't be applied with Group Policies directly.
• Default Containers:
  • Predefined containers in AD for specific object types, including the Users container, Domain Controllers OU, and Computers container.
• Delegation:
  • Granting administrative permissions to users and groups within an OU.
  • Can be based on object-specific or role-based permissions.
  • The Delegation of Control Wizard simplifies assigning common administrative tasks.

Lesson 4: Group Policy

• Group Policy Overview:
  • A powerful tool for managing user and computer settings across an AD domain.
  • Used for enforcing security settings, managing desktop applications, deploying software, and managing folder redirection.
• Group Policy Management:
  • Utilize the Group Policy Management Console (GPMC) for tasks like backing up, restoring, importing, and copying GPOs.
• Group Policy Processing:
  • Involves a defined order of processing Group Policies in a hierarchical structure.
  • Apply settings from the highest-level GPOs to the lowest-level GPOs.