Active Directory™:
Part One


Ben Christenbury
Technical Lead
Microsoft Platforms Support
Microsoft Corporation

What is Active Directory ??

What is Active Directory ??

	It Is Not:
		A locator service
		A file system
	It Is:
		A query-centric system
		Consists of objects with attributes
		Data replication for performance and availability
		Special purpose database, many, many reads, few updates

The Directory

The Objects

The Schema

		A template defining the objects and attributes that can be stored in the Active Directory
			A class is the list of attributes that the class must or may contain
		Defines required vs. optional attributes
			“First Name” is required for a user   account
			“Address” is optional
		Extensible: new objects and attributes can be added

The Active Directory Goals

	Address customer needs for a Directory Service
		Hierarchical namespace
		Partitioning for scalability
		Multimaster replication
		Dynamically extensible schema
		Online backup and restore
		Open and extensible directory synchronization interfaces
	LDAP as the core protocol for interoperability

The Active Directory Features

	Easy UI administration
	Scriptable
	Extensible
	Interoperable
	Integrated with security

Directory Management

	Microsoft® Management Console
		Richer UI (drag-and-drop, multiple select, persistence)
		Greater extensibility
		Can extend DS admin to add your object/property management behavior
	Scripting
		ADSI makes scripting easy
		Windows® Scripting Host (Wscript.exe)

Slide 10

Directory API

	ADSI—Active Directory Service Interface
		Directory objects, schema, rich query
		Directory independent
			NetWare 3/4, NT3/4, LDAP providers
		Language independent
			Use from Java, Visual Basic®, C/C++
		Scriptable
	LDAP API

Slide 12

Programmatic Access

User Interface
Easily Extensible

Active Directory
Support for Standard Protocols Means Interoperability

Active Directory
Integrated with Security

Windows 2000 Security Goals

	Integrated with Active Directory
		Single enterprise logon
	Delegated administration
	Comprehensive solution
		Efficient and standard Kerberos for the intranet
		Scales with Public Key technologies to the Internet and extranet

What Is A Domain?
Old (and Familiar)

	The domain concept is (in part) unchanged from Windows NT 4.0
		A unit of partitioning
		A unit of authentication
		A unit of domain-level policy
		Manifested by domain controllers

What Is A Domain?
New (and Exciting)

Active Directory
 Logical Organization

	Logical:  nested hierarchy
		Domain hierarchy:  domain tree
		Container hierarchy within a domain
	Physical: Sites

Active Directory
 Logical Organization

Domain Structures

	Definition:  Domain Tree
		One or more domains with contiguous names
		DESK.COM & HLP.DESK.COM
	Definition:  Forest
		One or more domain trees (DESK.COM & DEVELOP.COM)
		Each domain shares common:
			Schema
			Site and service configuration
			Global catalog

Domain Structures
Naming:  The Forest Root

	Start with one tree
	The first domain in the forest
		This domain is the forest root
		Use any DNS node for the name
		All domain names must match DNS nodes
	Cannot be renamed

Domain Structures

	Add subsequent domains as children
	Assign each domain a DNS name

Domain Trees Versus Forests

	A domain tree is one or more domains with:
		A common schema, configuration, and global catalog
		Transitive trust
		A contiguous namespace
	A forest is one or more domain trees with:
		A common schema, configuration, and global catalog
		Transitive trust
		A noncontiguous namespace

Domain Structures
Forest

	Create additional trees if you have business units with distinct  names
	All domains in a forest are connected by transitive trust

Trust Relationships

The Global Catalog

	A service and store that contains a replica of every object in the Active Directory throughout the forest
	Contains a subset of the object attributes, those that are most frequently used for searches
	Enables users to find objects of interest quickly, without knowing in which domain they are located
	Do not want every DC to be a global catalog server

Logical Structure

Active Directory
 Physical Organization

	Sites are limited to a single forest
	Not part of the namespace structure
	DCs for a given domain can be distributed across many sites
	A single site can hold many different DCs
	The physical organization provides fault tolerance and performance for the logical organization

Active Directory
 Physical Organization

	Sites are areas of good connectivity, e.g., LANs, ATM nets, etc.
	A Site is a collection of IP subnets
		Used do define areas of “good connectivity”
		Determines boundaries for replication topologies
		Clients discover their site based on the subnet mask received from DHCP (or hand configured)

Slide 32

Slide 33