COMP1321 Digital Infrastructure Richard Henson March 2016

Week 19: Active Directory and Enterprise Networks n Objectives:  Explain how Active Directory is used to control login and access to network resources  Explain how Active directory can provide trust across multiple domains

Microsoft approach to “Scalable” Networks n Domain = Unit of a Microsoft LAN  data store needed that will cover all network users and resources  replicated across domain controllers n Criticised for not being “scalable” beyond a local LAN

Extending the “domain” model n Traditional LAN approach…  Server holds resources »Backup server for continuity  Users gain access to network resources »by logging on at a client… »and then having permissions allocated according to which “groups” they belong to

Enterprise LANs n Larger organisations typically have multiple LANs in different locations  need to be able to connect together and “trust” each other  enterprise database needed to connect across trusted domains and allow “enterprise” logon n Introduced as “Active Directory”

What is Active Directory? n A object-oriented database (Internet- approved x500 standard)  hierarchy of data objects (& their properties) »domain controllers »computers »users & groups of users »network resources

More about Active Directory n Uses LDAP (Lightweight Directory Access Protocol) n Network-wide directory service  paths to files and services  available from Windows 2000 onwards  of limited use on networks with NT v4 clients

Backing up the Database n Goes without saying that the loss of Active Directory will be bad for the network  people won’t even be able to log on! n Should be backed up… regularly! n Best way to do this is on another computer…

Active Directory & Domain Controllers n All domain controllers contribute to, share, and are part of the Active Directory (AD) system  hold data on: »network resources »Services »users & groups of users  all stored in a single file »ntds.dit  tools available for AD system management »e.g. ntdsutil

Fault Tolerance n General engineering principle…  if it can go wrong… it will! n To maintain availability for users, the whole domain controller should be backed up!  Active Directory designed as a distributed database that backs up to a reserve domain controller  Backup domain controller software set up using same active directory wizard

Fault Tolerance (hardware fault) n E.g. Hard disks  can crash or become corrupt n System needed for a backup to take over “seamlessly”  i.e. without the user noticing… n Achieved by disk mirroring  exact copy available to take over at a moment’s notice

Domain Trust n This allows users on one domain to log onto resources on another domain n Trusts can be one or two-way Domain A Domain B

Enterprise Structure of Active Directory n A hierarchical system of organisational data objects  i.e. domains n A Tree can be »a single domain »group of domains

Domain Trees & Forests n Active Directory provides “trust” between the databases of domains that are linked in this way n A “Tree” is the domains and links between them n A “Forest” contains data needed to connect all objects in the tree:  domain objects in the tree are logically linked together in the forest and their users can “trust” each other

Active Directory and Users n Active directory allows set up and management of domain users n Can also define domain groups, and allow domain users to become part of domain groups  aids administration  policy file can be set up »interacts with user machines registry during login »controls user desktop

Organisations, Organisational Units, and Domains n An organisation may:  have several locations  have several functions in same location in same location n Alternative to multiple domains… multiple domains…  organisational units  group policy can be applied selectively

WINS (Windows Internet Names Service) n Used on earlier Windows TCP/IP networks to enable computer devices to communicate using IP  manages a dynamic database of IP addresses and local network (NetBIOS) names  clients request IP addresses for particular NetBIOS names  WINS server provides that information

Active Directory and DNS n In Active directory, each domain in the tree has a unique DNS identity  therefore a unique IP address…  can cause confusion when setting up domain structure!! n Also, each device within a domain can also made use of DNS, via its IP address…  no need for WINS…

Microsoft TCP/IP stack n Differs from UNIX TCP/IP (e.g. no FTP, SMTP or Telnet) n DNS is available as a network service n Application layer components:  Windows sockets - to interface with sockets-based applications  NetBT - to interface with NetBIOS applications n SNMP, TCP, UDP, IP as with Unix protocol stack

Configuring TCP/IP on Windows n Requires local administrator access!!  1. Find “Local Area Connection”… n Locate and double-click TCP/IP n If DHCP (dynamic host configuration protocol) is running, IP addressing is dealt with automatically by the DHCP server

TCP/IP Configuration (2) n Otherwise, three IP addresses need to be added:  Local static machine IP address  Subnet mask  Default gateway

TCP/IP Configuration (3) n Local machine IP address  DHCP protocol can automatically assign IP addresses from a Windows 2000 server machine running DHCP server  Alternatively, a static IP address can be keyed in manually n Subnet mask:  normally for small networks  x.0 for larger networks »x -> 0 as the network gets larger n Default gateway is the IP address of the LAN- Internet interface computer…

Windows TCP/IP utilities n Located in the system32 directory n Not available from the GUI n Only accessible via the NT prompt (Ping (packet internet groper):  FTP  Telnet  Finger (retrieval of system information from a computer running TCP/IP & finger  ARP (displays local IP addresses according to equivalent MAC or “physical” addresses)  ipconfig (displays local IP configuration)  tracert (checks route to a remote IP address)

Some Other Windows Network Services n Terminal Services n RIS (remote installation…) n DNS (Domain name/IP address look up) n Virtualisation (Hyper-V) n RAS (remote access) & Secure Remote Login n Internet Information Server (IIS)

Refinements to Active Directory n Started as a file mapping system n Grown to be a massive network resource n Each new Windows Server version adds new AD features:  W2003, W2008, W2012, now W2016  W2016 will be explored in the practical…