Case for Multi-Domain/Forest Model Advantages and Disadvantages

Why have multiple domains or forests Isolation of data and service Data and services must be protected Autonomy of operation Domains require different levels of security & services Specialized operations “Acquired” resources According to M$ 30% of all AD deployments are multi-domain forest model(MDM). Three of the reasons according to Microsoft that multiple domains are employed are: Isolation (for security reason) Autonomy: (customized domains for special reasons) and “Acquired”: domains that were unauthorized or acquired through consolidation or merger . Though M$ primarily focuses on business the reasons for MDM holds for the academic world. Aims CC uses Isolation as part of a defense-in-depth model to separate admin from the academic . (guarding the chicken coop analogy) So when you are guarding the chicken coop from the fox Next screen

NT NT Learning lab CED NT Student Life (academic) (academic) NT Ft. Lupton (academic Admin) NT Admin (employee) NT Student NT CIS (academic) The current domain structure resulted from the consolidation and upgrade of existing autonomous M$ Windows NT domains to M$ Active Directory. During AD design it was decided to maintain the isolation of Administration & Academic domains for security and to allow for some autonomous control of the academic domain by faculty & students. Aims CC uses Isolation as part of a defense-in-depth model to separate admin from the academic . (guarding the chicken coop analogy) So when you are guarding the chicken coop from the fox Next screen NT Loveland (academic Admin) NT Com/Hum/Bus (academic)

1 fence is good 2 would be even better! Continue next slide

(use guarding the chicken coop analogy) In addition to having only a valid logon and Access Control List (typical of single domain ) to control access to domain resources. There will be additional credentials and ACL to access admin (staff/faculty)domain from academic domain…The Additional fence, Next screen

One Way Trust Admin Academic One Way Trust Creative Learning Greeley AD integrated App AD authentication and security for Nursing Dept. video capture system. Creative Learning Greeley Creative Learning Ft Lupton In the current Active Directory at Aims: all Staff/Faculty/Admin are members of the Admin. A 1 way trust, DNS zones, and delegations were established to allow access Academic domain resources. Additionally , an outside company Creative Learning Systems established labs at both the Greeley & Ft. Lupton campuses (The acquired domain). A one-way trust and DNS delegation was established with the Admin & Academic domains to allow greater utilization of the C.L.S. resources. Next screen

Academic Admin Some of the disadvantages that need to be addressed: Obvious: Duplication of physical resources, Servers, File sharing, Printing , Software/OS licensing, T.C.O. The other disadvantages increased complexity of the security configurations and monitoring of the security. Integrations of DNS operations to assure that cross-domain access resources Some solutions: Utilize server virtualization to reduce hardware and operating costs. Centralized printing. Delegated Active directory operations.. Spread the learning of AD operations to junior staff and to students

Problems to deal with.. Disadvantages Admin Academic Integrations of DNS operations to assure that cross-domain access resources The increased complexity of the security configurations. More access control lists to deal with but easier access . More complex monitoring of the security.

Ways around the Disadvantages Admin Academic Some solutions: Utilize server virtualization to reduce hardware and operating costs. Centralized printing. Delegated Active Directory operations.. Knowledge transfer of A.D. operations to junior staff and to students The Future Projects for Active Directory Print Management… RFP in progress Microsoft Exchange… Secure Wireless Access to Admin … using AD integrated PKI Desktop Encryption … using AD integrated PKI Some solutions: Utilize server virtualization to reduce hardware and operating costs. Centralized printing. Delegated Active Directory operations.. Knowledge transferof AD operations to junior staff and to students The future Print Management… RFP in progress Microsoft Exchange… Secure Wireless Access to Admin … using AD integrated PKI Desktop Encryption … using AD integrated PKI

The end result was worth the work YES! The end result was worth the work

Questions?