1. Case for Multi-Domain/Forest Model
Advantages and Disadvantages

2. Why have multiple domains or forests
Isolation of data and service
Data and services must be protected
Autonomy of operation
Domains require different levels of security & services
Specialized operations
“Acquired” resources
According to M$ 30% of all AD deployments are multi-domain forest model(MDM). Three of the reasons according to Microsoft that multiple domains are employed are: Isolation (for security reason) Autonomy: (customized domains for special reasons) and “Acquired”: domains that were unauthorized or acquired through consolidation or merger .
Though M$ primarily focuses on business the reasons for MDM holds for the academic world.
Aims CC uses Isolation as part of a defense-in-depth model to separate admin from the academic . (guarding the chicken coop analogy) So when you are guarding the chicken coop from the fox
Next screen

3. NT NT Learning lab CED NT Student Life (academic) (academic) NT
Ft. Lupton
(academic
Admin) NT
Admin
(employee) NT
Student NT
CIS (academic)
The current domain structure resulted from the consolidation and upgrade of existing autonomous M$ Windows NT domains to M$ Active Directory. During AD design it was decided to maintain the isolation of Administration & Academic domains for security and to allow for some autonomous control of the academic domain by faculty & students.
Aims CC uses Isolation as part of a defense-in-depth model to separate admin from the academic . (guarding the chicken coop analogy) So when you are guarding the chicken coop from the fox
Next screen NT
Loveland
(academic
Admin) NT
Com/Hum/Bus
(academic)

4. 1 fence is good 2 would be even better!
Continue next slide

5. (use guarding the chicken coop analogy)
In addition to having only a valid logon and Access Control List (typical of single domain ) to control access to domain resources.
There will be additional credentials and ACL to access admin (staff/faculty)domain from academic domain…The Additional fence,
Next screen

6. One Way Trust Admin Academic One Way Trust Creative Learning Greeley
AD integrated App
AD authentication and security for Nursing Dept. video capture system.
Creative Learning
Greeley
Creative Learning
Ft Lupton
In the current Active Directory at Aims: all Staff/Faculty/Admin are members of the Admin.
A 1 way trust, DNS zones, and delegations were established to allow access Academic domain resources.
Additionally , an outside company Creative Learning Systems established labs at both the Greeley & Ft. Lupton campuses (The acquired domain). A one-way trust and DNS delegation was established with the Admin & Academic domains to allow greater utilization of the C.L.S. resources.
Next screen

7. Academic Admin Some of the disadvantages that need to be addressed:
Obvious: Duplication of physical resources, Servers, File sharing, Printing , Software/OS licensing, T.C.O.
The other disadvantages increased complexity of the security configurations and monitoring of the security. Integrations of DNS operations to assure that cross-domain access resources
Some solutions: Utilize server virtualization to reduce hardware and operating costs.
Centralized printing.
Delegated Active directory operations.. Spread the learning of AD operations to junior staff and to students

8. Problems to deal with.. Disadvantages
Admin
Academic
Integrations of DNS operations to assure that cross-domain access resources
The increased complexity of the security configurations. More access control lists to deal with but easier access .
More complex monitoring of the security.

9. Ways around the Disadvantages
Admin
Academic
Some solutions: Utilize server virtualization to reduce hardware and operating costs.
Centralized printing.
Delegated Active Directory operations.. Knowledge transfer of A.D. operations to junior staff and to students
The Future Projects for Active Directory
Print Management… RFP in progress
Microsoft Exchange…
Secure Wireless Access to Admin … using AD integrated PKI
Desktop Encryption … using AD integrated PKI
Some solutions: Utilize server virtualization to reduce hardware and operating costs.
Centralized printing.
Delegated Active Directory operations.. Knowledge transferof AD operations to junior staff and to students
The future
Print Management… RFP in progress
Microsoft Exchange…
Secure Wireless Access to Admin … using AD integrated PKI
Desktop Encryption … using AD integrated PKI

10. The end result was worth the work
YES!
The end result was worth the work

11. Questions?