11 REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS Chapter 1

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS2 OVERVIEW  Describe the function of directory services on a Microsoft Windows Server 2003 network.  Differentiate between the physical and logical components of the Active Directory directory service.  Understand the elements involved in planning an Active Directory implementation.  Determine the appropriate placement of global catalog servers.  Determine where universal group membership caching should be implemented.  Describe the function of directory services on a Microsoft Windows Server 2003 network.  Differentiate between the physical and logical components of the Active Directory directory service.  Understand the elements involved in planning an Active Directory implementation.  Determine the appropriate placement of global catalog servers.  Determine where universal group membership caching should be implemented.

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS3 UNDERSTANDING THE ROLE OF DIRECTORY SERVICES  Forms core of network  Stores information about computers, applications, services, and users  Builds upon the version of Active Directory in Windows 2000 Server, but the two cannot coexist in the same forest  Forms core of network  Stores information about computers, applications, services, and users  Builds upon the version of Active Directory in Windows 2000 Server, but the two cannot coexist in the same forest

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS4 UNDERSTANDING THE LOGICAL COMPONENTS OF ACTIVE DIRECTORY  Domains  Trees  Forests  Organizational units  Domains  Trees  Forests  Organizational units

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS5 DOMAINS  Primary mechanism of grouping users, computers, and services together  Provide an administrative boundary within Active Directory  Can comprise one or more physical locations  Primary mechanism of grouping users, computers, and services together  Provide an administrative boundary within Active Directory  Can comprise one or more physical locations

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS6 TREES

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS7 FORESTS

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS8 ORGANIZATIONAL UNITS

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS9 DOMAIN AND FOREST FUNCTIONAL LEVELS  Provide a way to enable certain features of Active Directory on a per-domain or forest- wide basis  Can be raised, provided all domain controllers in the domain or forest support the higher level  Provide a way to enable certain features of Active Directory on a per-domain or forest- wide basis  Can be raised, provided all domain controllers in the domain or forest support the higher level

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS10 DOMAIN FUNCTIONAL LEVELS  Windows 2000 Mixed (default)  Windows 2000 Native  Windows Server 2003 Interim  Windows Server 2003  Windows 2000 Mixed (default)  Windows 2000 Native  Windows Server 2003 Interim  Windows Server 2003

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS11 FOREST FUNCTIONAL LEVELS  Windows 2000 (default)  Windows Server 2003 Interim  Windows Server 2003  Windows 2000 (default)  Windows Server 2003 Interim  Windows Server 2003

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS12 UNDERSTANDING THE PHYSICAL COMPONENTS OF ACTIVE DIRECTORY  Sites  Domain controllers  Sites  Domain controllers

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS13 SITES  Collections of one or more well-connected IP subnets  Allow authentication and replication traffic to be managed  Collections of one or more well-connected IP subnets  Allow authentication and replication traffic to be managed

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS14 DOMAIN CONTROLLERS  Physical storage locations for Active Directory databases  Can be any systems running Windows 2000 Server or Window Server 2003  Use multimaster replication  Physical storage locations for Active Directory databases  Can be any systems running Windows 2000 Server or Window Server 2003  Use multimaster replication

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS15 INSTALLING ACTIVE DIRECTORY  Using the Active Directory Installation Wizard  Using an answer file to perform an unattended installation  Using the network or backup media  Using the Configure Your Server Wizard  Using the Active Directory Installation Wizard  Using an answer file to perform an unattended installation  Using the network or backup media  Using the Configure Your Server Wizard

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS16 INSTALLING ACTIVE DIRECTORY BY USING THE ACTIVE DIRECTORY INSTALLATION WIZARD

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS17 INSTALLING ACTIVE DIRECTORY BY USING AN ANSWER FILE

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS18 INSTALLING ACTIVE DIRECTORY BY USING THE NETWORK OR BACKUP MEDIA  Allows a member server to become a domain controller by the restore of Active Directory data  Useful in scenarios in which large amounts of replication traffic cannot be accommodated  Allows a member server to become a domain controller by the restore of Active Directory data  Useful in scenarios in which large amounts of replication traffic cannot be accommodated

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS19 INSTALLING ACTIVE DIRECTORY BY USING THE CONFIGURE YOUR SERVER WIZARD

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS20 DEPLOYING GLOBAL CATALOG SERVERS  The global catalog stores information about all Active Directory objects from all domains in a single forest.  Windows Server 2003 creates one global catalog server automatically when Active Directory is installed.  At least one additional global catalog server should be configured for fault tolerance.  Placement of global catalog servers requires careful planning.  The global catalog stores information about all Active Directory objects from all domains in a single forest.  Windows Server 2003 creates one global catalog server automatically when Active Directory is installed.  At least one additional global catalog server should be configured for fault tolerance.  Placement of global catalog servers requires careful planning.

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS21 CONFIGURING GLOBAL CATALOG SERVERS

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS22 UNDERSTANDING UNIVERSAL GROUP MEMBERSHIP CACHING  Helps to reduce the number of universal group membership queries that must be forwarded across a WAN link  Provides flexibility for the placement of global catalog servers  Implemented on a site-by-site basis  Helps to reduce the number of universal group membership queries that must be forwarded across a WAN link  Provides flexibility for the placement of global catalog servers  Implemented on a site-by-site basis

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS23 IMPLEMENTING UNIVERSAL GROUP MEMBERSHIP CACHING  Disabled by default  Once enabled, applies to the entire site  Configured by using Active Directory Sites and Services  Disabled by default  Once enabled, applies to the entire site  Configured by using Active Directory Sites and Services

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS24 SUMMARY  Logical components of Active Directory include domains, trees, forests, and organizational units.  A domain is a security and administrative boundary. Users on a Windows Server 2003 network authenticate at the domain level.  A tree is a group of one or more domains that share transitive trust relationships.  A forest is a group of one or more trees that share a single root domain, a schema, and a global catalog.  In Windows Server 2003, domains operate at one of four different functional levels.  Logical components of Active Directory include domains, trees, forests, and organizational units.  A domain is a security and administrative boundary. Users on a Windows Server 2003 network authenticate at the domain level.  A tree is a group of one or more domains that share transitive trust relationships.  A forest is a group of one or more trees that share a single root domain, a schema, and a global catalog.  In Windows Server 2003, domains operate at one of four different functional levels.

Chapter 1: REVIEWING MICROSOFT ACTIVE DIRECTORY CONCEPTS25 SUMMARY (CONTINUED)  Windows Server 2003 introduces the three forest functional levels.  Physical components of Active Directory include sites and domain controllers.  Domain controllers host a copy of the Active Directory database and can be used to authenticate logons.  The deployment of global catalog servers throughout an Active Directory site infrastructure requires careful planning.  Windows Server 2003 introduces a new feature known as universal group membership caching.  Windows Server 2003 introduces the three forest functional levels.  Physical components of Active Directory include sites and domain controllers.  Domain controllers host a copy of the Active Directory database and can be used to authenticate logons.  The deployment of global catalog servers throughout an Active Directory site infrastructure requires careful planning.  Windows Server 2003 introduces a new feature known as universal group membership caching.