Active Directory For Dummies E-Book

Steve Clines

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Seitenzahl: 415

Veröffentlichungsjahr: 2009

Beschreibung

Your guide to learning Active Directory the quick and easy way Whether you're new to Active Directory (AD) or a savvy system administrator looking to brush up on your skills,Active Directory for Dummies will steer you in the right direction. Since its original release, Microsoft's implementation of the lightweight directory access protocol (LDAP) for the Windows Server line of networking software has become one of the most popular directory service products in the world. If you're involved with the design and support of Microsoft directory services and/or solutions, you're in the right place. This comprehensive guide starts by showing you the basics of AD, so you can utilize its structures to simplify your life and secure your digital environment. From there, you'll discover how to exert fine-grained control over groups, assets, security, permissions, and policies on a Windows network and efficiently configure, manage, and update the network. With coverage of security improvements, significant user interface changes, and updates to the AD scripting engine, password policies, accidental object deletion protection, and more, this plain-English book has everything you need to know. You'll learn how to: * Navigate the functions and structures of AD * Understand business and technical requirements to determine goals * Become familiar with physical components like site links, network services, and site topology * Manage and monitor new features, AD replication, and schema management * Maintain AD databases * Avoid common AD mistakes that can undermine network security With chapters on the ten most important points about AD design, ten online resources, and ten troubleshooting tips,this user-friendly book really is your one-stop guide to setting up, working with, and making the most of Active Directory. Get your copy of Active Directory For Dummies and get to work.

Leseprobe

Active Directory For Dummies,®2nd Edition

Table of Contents

Introduction

This Book Is for You

How This Book Is Organized

Part I: Getting Started

Part II: Planning and Deploying with Active Directory Domain Services

Part III: New Active Directory Features

Part IV: Managing Active Directory

Part V: The Part of Tens

Part VI: Appendixes

Icons Used in This Book

Part I: Getting Started

Chapter 1: Understanding Active Directory

What Is Active Directory?

Active Directory is an umbrella

Active Directory is an information store

Active Directory has a structure (Or hierarchy)

Active Directory can be customized

Getting Hip to Active Directory Lingo

The building blocks of Active Directory

The Active Directory schema

Domain Controllers and the global catalog

The DNS namespace

Because It’s Good for You: The Benefits of Active Directory

Chapter 2: Analyzing Requirements for Active Directory

Why Gather Information?

Gathering Business Information

Surveying the business environment

Determining business goals

Gathering Technical Information

Surveying the technical environment

Determining technical goals

Best Practices

Chapter 3: Designing an Active Directory Implementation Plan

Why You Need an Implementation Plan

Building the Active Directory Planning Team

Creating Active Directory Planning Documents

Business and technical assessments

Vision Statement

Requirements/scope document

Gap analysis

Functional specification

Implementation standards

Risk assessment/contingency plan

Tracking Project Implementation

Creating the Active Directory Design

Best Practices

Part II: Planning and Deploying with Active Directory Domain Services

Chapter 4: Playing the Name Game

The Need for DNS

Essential DNS

Identifying resource records

Active Directory Requirements for DNS

Examining SRV records

/div>Exploring dynamic updates

Storing and replicating DNS information

The Active Directory Namespace

Defining the Active Directory namespace

Comparing an Active Directory namespace to a DNS namespace

Types of Active Directory Naming

Fully qualified domain name

Distinguished name

User principal name

NetBIOS name

Planning the Active Directory Namespace

Understanding domain naming

Understanding OU naming

Understanding computer naming

Understanding user naming

What’s New in Windows Server 2008 DNS?

Support for IPv6

Support for read-only domain controllers

Background loading of zone data

GlobalNames zone

Chapter 5: Creating a Logical Structure

Planting a Tree or a Forest?

Defining Domains: If One Isn’t Enough

Less is more!

Recognizing the divine order of things

The multiple forests model

Organizing with OUs: Containers for Your Trees

Creating a structure

Planning for delegating administration

Chapter 6: Getting Physical

The Physical Side of Active Directory

Active Directory Physical Components

Domain controllers and global catalog servers

Active Directory sites

Subnets

Site links

Designing a Site Topology

Placing domain controllers

Placing global catalog servers

Placing operations masters

Defining Active Directory sites

Creating Active Directory site links

Read-Only Domain Controllers

RODC prerequisites and limitations

Running DNS on an RODC

RODC administrative separation

RODC credential caching

Chapter 7: Ready to Deploy!

Installing Windows Server 2008

To Core or Not to Core

Deploying AD DS on a Full Server

Initial Configuration Tasks Wizard and the Server Manager console

Attended domain controller installation

Unattended domain controller installation

Deploying AD DS on a Core Server

After the install

Miscellaneous Issues

Installing AD DS from media

Deploying an RODC

Part III: New Active Directory Features

Chapter 8: AD LDS: Active Directory on a Diet

The Need for a Lighter AD

/div>AD LDS as a phone book

AD LDS as a consolidation store

AD LDS as a Web authentication service

Working with AD LDS

Security and Replication with AD LDS

Deploying AD LDS

Chapter 9: Federating Active Directory

Authentication Everywhere!

Identities, tokens, and claims

Security token services

Federations

Federation Scenarios

Web single sign-on scenario

Federated Web SSO scenario

Federated Web SSO with forest trust scenario

Deploying Active Directory Federation Services

Chapter 10: AD Certificate Services and Rights Management Services

Active Directory Certificate Services

What is public key infrastructure (PKI)?

Inside AD Certificate Services

Enterprise PKI console

Active Directory Rights Management Services

Managing information usage

Inside Active Directory Rights Management Services

Installing AD RMS

Part IV: Managing Active Directory

Chapter 11: Managing Users, Groups, and Other Objects

Managing Users and Groups

Creating user objects

Editing user objects

Understanding groups

Creating and editing groups

Viewing default users and groups

Managing Organizational Units

Delegating Administrative Control

Chapter 12: Managing Active Directory Replication

Understanding Replication

Intrasite replication

Intersite replication

Propagating updates

Implementing a Site Topology

Creating sites

Creating subnets

Creating site links

Creating a site link bridge

Chapter 13: Schema-ing!

Schema 101

Introducing object classes

Examining object attributes

Extending the Schema

Adding classes and attributes

Deactivating objects

Transferring the Schema Master

Reloading the Schema Cache

Chapter 14: Managing Security with Active Directory Domain Services

NTLM and Kerberos

NTLM authentication

Meet Kerberos, the guard dog

Implementing Group Policies

Using GPOs within Active Directory

GPO inheritance and blocking

Group policy management

Group policy reporting and modeling

Fine-Grained Password and Account Lockout Policies

Active Directory Auditing

Chapter 15: Maintaining Active Directory

Database Files

Specifying the location of the database files

How the database and log files work together

Defragmenting the Database

Online defragmentation

Offline defragmentation

Backing Up the Active Directory Database

Restoring Active Directory

Non-authoritative restore

Authoritative restore

Preventing accidental deletions

Restartable Active Directory

Other Tools for Maintaining AD

Event Viewer

Snapshots and the AD Database Mounting Tool

REPADMIN

Part V: The Part of Tens

Chapter 16: The Ten Most Important Active Directory Design Points

Plan, Plan, Plan!

Design AD for the Administrators

What’s Your Forest Scope?

Often a Single Domain Is Enough!

Active Directory Is Built on DNS

Your Logical Active Directory Structure Isn’t Based on Your Network Topology

Limit Active Directory Schema Modifications

Understand Your Identity Management Needs

Place Domain Controllers and Global Catalogs Near Users

Keep Improving Your Design

Chapter 17: Ten Cool Web Sites for Active Directory Info

Microsoft’s Windows Server 2008 Web Site

Windows Server 2008 TechCenter

TechNet Magazine

Directory Services Team Blog

Exchange Server Team Blog

Windows IT Pro Magazine

Windows Server Team Blog

Windows Server 2008 Most Recent Knowledge Base Articles Feed

Windows Server 2008 Most Popular Downloads

My Blog

Chapter 18: Ten Troubleshooting Tips for Active Directory

Domain Controller Promotion Issues

Network Issues

What Time Is It?

Can’t Log On to a Domain

Monitoring Active Directory Resources

Can’t Modify the Schema

Replication Issues

Working with Certificates

Group Policy Issues

Branch Office Users Logging In for the First Time

Part VI: Appendixes

Appendix A: Windows 2008 AD Command Line Tools

NTDSUTIL Activate Instance

NTDSUTIL Authoritative Restore

NTDSUTIL Files

NTDSUTIL IFM

NTDSUTIL Local Roles

NTDSUTIL Roles

NTDSUTIL Set DSRM Password

NTDSUTIL Snapshot

Appendix B: Glossary

Active Directory® For Dummies®, 2nd Edition

by Steve Clines and Marcia Loughry

Active Directory® For Dummies®, 2nd Edition

Published byWiley Publishing, Inc.111 River St.Hoboken, NJ 07030-5774www.wiley.com

Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana

Published simultaneously in Canada

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, [phone], fax [phone]. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.

Trademarks: Wiley, the Wiley Publishing logo, For Dummies, the Dummies Man logo, A Reference for the Rest of Us!, The Dummies Way, Dummies Daily, The Fun and Easy Way, Dummies.com, Making Everything Easier, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Website may provide or recommendations it may make. Further, readers should be aware that Internet Websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services, please contact our Customer Care Department within the U.S. at 800-762-2974, outside the U.S. at 317-572-3993, or fax [phone].

For technical support, please visit www.wiley.com/techsupport.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Library of Congress Control Number: 2008932078

ISBN: 9780470505274

Manufactured in the United States of America

10 9 8 7 6 5 4 3 2 1

About the Authors

Steve Clines, MCSE, MCT, has worked as an IT architect and engineer at EDS for over 18 years. He has worked on deployments of more than 100,000 seats for both Active Directory and Microsoft Exchange Server. Steve is the author of MCSE Designing a Windows 2000 Directory Services Infrastructure For Dummies, which is a study guide for the 70-219 MCP exam. He also maintains the Confessions of an IT Geek blog at http://itgeek.steveco.net.

Marcia Loughry, MCSE and MCP+I, is a Senior Infrastructure Specialist with a large IT firm in Dallas, Texas. She is president of the Plano, Texas BackOffice User Group (PBUG) and a member of Women in Technology International. Marcia received her MCSE in NT 3.51 in 1997 and completed requirements for the NT 4.0 track in 1998.

Marcia has extensive experience working with Windows NT 3.51 and 4.0 in enterprises of all sizes. She is assigned to some of her firm’s largest customers in designing NT solutions and integrating UNIX and NetWare environments with NT.

Dedication

Steve Clines: I am dedicating this book to two people who are no longer with us. First is my mom Glenda. She is the one who really taught me about writing and how to see a project to its completion. The second person is my nephew Boomer. You have reminded me of how precious life really is and how we are to live each day with the joy that you did.

You are both missed.

Marcia Loughry: This book is dedicated to my family — my son, Chris, my parents, my sister, Karen — just because I love ‘em all! Thanks for the love, laughter, and support.

Authors' Acknowledgments

Steve Clines: I have many people to thank for their support. Foremost is my wife, Tracie, who has been my constant support. I couldn’t have done this without you. Also, thank you to my family and friends who have been a great source of continual encouragement to me.

Thank you to Marcia Loughry for getting me started down this road and giving me a great starting point for doing this edition. Also, thanks to all the great folks at Wiley Publishing for giving me this opportunity and being really easy to work with.

Lastly, thanks to my Lord and Savior. I can’t do anything without you – Phil. 4:13.

Marcia Loughry: Special thanks to literary agent Lisa Swayne, of the Swayne Agency, for finding me, taking me on, and introducing me to the fun people at Wiley Publishing.

Many, many thanks to the fine folks at Wiley Publishing: Joyce Pepple, who get me excited about this project; Jodi Jensen, who suffered and planned with me and generally kept me in line; Bill Barton, who didn’t strangle me over my consistent use of passive voice; and the rest of the Wiley team who made the book and CD possible.

And finally, heartfelt thanks to Jackie, Mary, Sherri, Michelle, Anne, Clifton, Sam, Steve, Kent, Sylvana, Nate, Clay, and all the other friends who make every day so fun.

Publisher’s Acknowledgments

We’re proud of this book; please send us your comments through our online registration form located at www.dummies.com/register/.

Some of the people who helped bring this book to market include the following:

Acquisitions, Editorial, and Media Development

Sr. Project Editor: Christopher Morris

Acquisitions Editor: Kyle Looper

Copy Editor: Brian Walls

Technical Editor: John Mueller

Editorial Manager: Kevin Kirschner

Editorial Assistant: Amanda Foxworth

Sr. Editorial Assistant: Cherie Case

Cartoons: Rich Tennant (www.the5thwave.com)

Composition Services

Project Coordinator: Katherine Key

Layout and Graphics: Stacie Brooks, Reuben W. Davis, Laura Pence, Ronald Terry

Proofreaders: Caitie Kelly, Bonnie Mikkelson, Amanda Steiner

Indexer: Rebecca Salerno

Publishing and Editorial for Technology Dummies

Richard Swadley, Vice President and Executive Group Publisher

Andy Cummings, Vice President and Publisher

Mary Bednarek, Executive Acquisitions Director

Mary C. Corder, Editorial Director

Publishing for Consumer Dummies

Diane Graves Steele, Vice President and Publisher

Joyce Pepple, Acquisitions Director

Composition Services

Gerry Fahey, Vice President of Production Services

Debbie Stailey, Director of Composition Services

Introduction

Welcome to the wonderful world of Active Directory! Over the last eight years since Active Directory (AD) was released in Microsoft’s Windows 2000 Server product, AD has become one of the most (if not the most) popular directory service products in the world. It has also become one of the central technologies on top of which many other Microsoft products are built. If you are an Information Technology (IT) professional who designs and supports directory services or solutions created with Microsoft products, then you really need to have an understanding of what AD is and how it works. That’s where this book comes in.

My goal with this book is to take the anxiety and stress out of mastering this complex technology. I hope that you find the book a clear, straightforward resource for exploring Active Directory.

This Book Is for You

Whether you’ve purchased this book or are browsing through it in the bookstore, know that you’ve come to the right place. Maybe you are like me. When I’m looking through a book that I’m considering purchasing, I always look at the first sections to try to get an idea of who the book is written for and exactly what it’s going to cover. So let me just get this out of the way right now. This book is for you if you’re any of the following:

A savvy system administrator with previous NT experience who needs to find out about Active Directory

An administrator that has AD experience with previous releases in Windows 2000 Server and Windows Server 2003

Someone who wants to know more about Active Directory Domain Services in Windows Server 2008

Someone who wants to find out about the new components of Active Directory in Windows Server 2008, including Active Directory Lightweight Directory Services, Active Directory Federation Services, Active Directory Certificate Services, and Active Directory Rights Management Services

A newbie (to networking or to information technology) who wants to pick up information on Active Directory

A student preparing for AD certification exams

Someone who’s merely interested in intelligently discussing Active Directory

For the experienced Windows Server administrator or other IT professional, Active Directory For Dummies provides you with an unpretentious resource containing exactly what you need to know. It presents the fundamentals of the program and then moves right into planning, implementing, and managing Active Directory — what you’re most interested in knowing right now!

Welcome! And, thanks for making Active Directory For Dummies your first resource for figuring out one of Microsoft’s hottest technologies!

How This Book Is Organized

I’ve divided this book into six parts, organized by topic. The parts take you sequentially from Active Directory fundamentals through planning, deploying, and managing Active Directory. If you’re looking for information on a specific Active Directory topic, check the headings in the table of contents. By design, you find that you can use Active Directory For Dummies as a reference that you reach for again and again.

Part I: Getting Started

Part I contains the “getting to know you” chapters. These chapters contain the answers to your most fundamental questions:

What is Active Directory?

What are its benefits?

What are the buzzwords?

The information you find here helps you determine what you must do to prepare for Active Directory in your environment. Also, in this part, I provide you information that can help you gather information about the environment you’re deploying AD in and how to develop the requirements that will drive your Active Directory design.

Part II: Planning and Deploying with Active Directory Domain Services

Active Directory Domain Services contains both a logical and a physical structure that you must carefully design before deployment. The logical structure comes first and includes the following steps:

Planning the DNS namespace

Designing the forest/domain/organizational unit (OU) model

After you plan your logical structure, you move on to developing a plan for your physical structure. This part ends with you putting all this planning into action as you build your Active Directory forest by creating domain controllers.

Part III: New Active Directory Features

In Windows Server 2008, Microsoft has added a number of new components to Active Directory that expand the product beyond being simply a directory service. Many of these components can be used to develop an overall identity and access management solution. These components support interaction between external users — even other companies — and your internal AD environment. If you’re familiar with Active Directory from a previous Windows Server release and need to find out about the new parts of AD in Windows Server 2008, this is one part you want to check out!

Part IV: Managing Active Directory

Part IV covers the daily management of an Active Directory environment. Active Directory introduces the capability of delegating administrative authority and also introduces security concepts. The chapters in this part prepare you for managing security, users, and resources within the Active Directory tree.

Part IV also covers managing replication traffic. Optimized replication traffic is vitally important to the Active Directory environment. In these chapters, you discover how to propagate updates, schedule replication traffic, work with the Active Directory schema, and maintain the Active Directory database.

Part V: The Part of Tens

In true For Dummies style, this book includes a Part of Tens. These chapters introduce lists of ten items about a variety of informative topics. Here you find additional resources, hints, and tips, plus other nuggets of knowledge.

Part VI: Appendixes

In the appendixes, you find information that adds depth to your understanding and use of Active Directory. I provide a listing of command line utilities for managing Active Directory as well as a glossary of terminology.

Icons Used in This Book

To make using this book easier, I use various icons in the margins to indicate particular points of interest.

Sometimes I feel obligated to give you some technical information, although it doesn’t really affect how you use Active Directory. I mark that stuff with this geeky fellow so that you know it’s just background information.

Ouch! I mark important directions to keep you out of trouble with this icon. These paragraphs contain facts that can keep you from having nightmares.

Any time that I can give you a hint or a tip that makes a subject or task easier, I mark it with this little thingie for additional emphasis — just my way of showing you that I’m on your side.

This icon is a friendly reminder for something that you want to make sure that you cache in your memory for later use.

Part I

Getting Started

In this part . . .

For many things in life, you have to start at the beginning before you can move on to the rest. That start for Active Directory is here. The first chapter is an introduction to Active Directory and its terminology. Chapters 2 and 3 step back from the technology of Active Directory and instead discuss how to prepare for an Active Directory design and deployment by looking at what requirements you have and developing an implementation plan. Welcome to Active Directory!

Chapter 1

Understanding Active Directory

In This Chapter

Defining Active Directory

Examining the origins of Active Directory: X.500

Understanding Active Directory terms

Investigating the benefits of Active Directory: What’s in it for you?

Since the release of Active Directory in Windows 2000 Server, Active Directory has become a very integral part of many information technology (IT) environments. As such, Active Directory has become a very popular topic with the people that have to design and support it. Because of all the terms and technology surrounding Active Directory, you might already be a bit intimidated by the prospect of working with it yourself.