Active Directory Essentials

Active Directory is Microsoft's proprietary directory service protocol for Windows 2000, 2003 and 2008 servers. Active Directory provides a database which can be queried to find hosts, servers, services and resources within one or more administrative domains that are part of a forest. Windows Active Directory is an X.400-based directory service which stores information about 'objects' within a 'domain'. User accounts, computers, servers and services are all objects within Active Directory. These base objects can also be collected into 'containers'. Active Directory allows objects, such as computers and users, to be grouped into Organizational Units. Organizational Units are 'containers' within Active Directory and can have access controls and security polices allowing a single policy to be applied to a group of objects in an easy manner. Objects are part of Containers, and Containers are part of a Domain. Domains are part of an Active Directory hierarchy or 'tree'.
Users > Organizational Units > Domains > Trees
Active Directory system was designed to 'integrate' with LDAP and Internet DNS. Each Active Directory 'tree' for a computer network forms a domain. The domains can be set up to communicate with each other via Microsoft's patented 'trust' relationships. Thus, an Active Directory tree in one network can communicate on a 'trusted' (not) basis with an Active Directory 'tree' from another network to form a 'forest'..
[ As if Microsoft hadn't confused things enough already with 'domains'... --InetDaemon ]

Active Directory Domain Controllers

Only Active Directory Domain Controllers provide Active Directory services. Active directory information is stored in the DNS server zone files using a special SVR record and a special naming convention used for services running on a particular host. This convention uses underscores. Underscores used in a DNS domain name are illegal (not part of the DNS specification) but Microsoft uses them anyway in the service and domain portions of the fully qualified name of a computer.
Active Directory can be configured three ways:

• OFF (Not running or integrated at all)
• Mixed Mode (Backwards compatible with Windows NT domains, and very limited Active Directory functionality)
• 'Native' Mode (Full Active Directory NO WINDOWS NT SERVERS PERMITTED!)

The first Windows domain created becomes the root of the first 'domain tree', and as the first tree, it becomes the 'parent' of all other domains/trees. The 'root domain' or 'parent tree' cannot be moved, deleted or changed. Therefore, in transitioning to Windows 2000, you must create the ROOT domain (parent DNS domain if that makes sense) first.
By default, when you configure a child domain to communicate with the parent, they default to a 'two-way transitive trust' relationship (Parent <-> Child1). This means that each domain fully trusts the other. When a third domain is added (Child2), it automatically trusts both domains (Parent and Child1), even though it is connected to only one of them (Child2<->Parent). Through the parent domain, Child2 has access to Child1. .
Forests are created when two root domains are configured to share a 'global catalog'.

Active Directory Essentials

The Active Directory database is stored in a single flat file named ntds.dit on Windows 2000 and Windows 2003 Active Directory servers. The file ntds.dit is a Microsoft Jet database file. The Extensible Storage Engine (ESE) is used to access and manage the contents of the ntds.dit file. The ntds.dit file is stored in the following folder:

%SystemRoot%\ntds

Note that %SystemRoot% is a Windows environment variable which contains the path to the Windows system root directory (usually C:\windows).

Active Directory Objects

Every object in the Active Directory database points to its one and only parent, therefore the total store of all objects in the database may be thought of as a hierarchy.

• Forest
  • Domains (a tree of domains)
    • Security Principals
      • Users
      • Groups
      • Computers
        • Workstations
        • Servers
        • Domain Controllers
    • Containers
    • Organizational Units
  • Group Policy Objects
    • Rights / Permissions
    • WMI Filters
  • Sites
• System Access Control Lists
• Discretionary Access Control List

Active Directory Tools

Microsoft installs several tools for managing Active Directory when a Windows server is promoted to a domain controller during installation or after using the dcpromo MS-DOS command.

1. Active Directory Users and Computers (dsa.msc)
2. Active Directory Domains and Trusts (domain.msc)
3. Active Directory Sites and Services (sites.msc)
4. Active Directory Schema Snap-in (added as a 'snap-in' to a generic instance of the mmc)
5. Group Policy Management Console (gpmc.msc)

NOTE: The Microsoft Management Console (MMC) is a generic window-control used for managing Windows services and controls. The MMC supports snap-ins allowing an administrator to pull together multiple controls into a single window.

Active Directory Users and Computers

This tool is used to manage the Directory Objects within the domain, to create, add and modify computers and users and to remove them from the domain.

Active Directory Domains and Trusts

The parent-child relationships, replication and level of trust between domains is managed with this tool.

Active Directory Sites and Services

This tool allows a Domain Administrator to create 'sites' and to force replication between sites.

Active Directory Schema

This tool is used to manage Active Directory database schema and base object types.

Group Policy Management console

From this console, a Windows Active Directory Administrator can link security policies to objects, organizational units, sites and domains within an Active Directory Forest.