|
Active Directory (AD) is an implementation of LDAP directory services by Microsoft for use primarily in Windows environments. The main purpose of Active Directory is to provide central authentication and authorization services for Windows based computers. Active Directory also allows administrators to assign policies, deploy software, and apply critical updates to an entire organization. Active Directory stores information and settings relating to an organization in a central, organized, accessible database. Active Directory networks can vary from a small installation with a few hundred objects, to a large installation with millions of objects. Image File history File links ActiveDirectoryMMC.png Summary A screenshot of Active Directory management in Windows Server 2003. ...
Image File history File links ActiveDirectoryMMC.png Summary A screenshot of Active Directory management in Windows Server 2003. ...
MMC on Windows Server 2003, running Computer Management snap-in The Microsoft Management Console (MMC) is a component of modern Microsoft Windows operating systems that provides system administrators and advanced users with a flexible interface through which they may configure and monitor the system. ...
The Lightweight Directory Access Protocol, or LDAP (IPA: ), is an application protocol for querying and modifying directory services running over TCP/IP.[1] A directory is a set of information with similar attributes organized in a logical and hierarchical manner. ...
A directory service (DS) is a software application — or a set of applications — that stores and organizes information about a computer networks users and network resources, and that allows network administrators to manage users access to the resources. ...
Microsoft Corporation, (NASDAQ: MSFT, HKSE: 4338) is a multinational computer technology corporation with global annual revenue of US$44. ...
Windows redirects here. ...
Active Directory was previewed in 1996, released first with Windows 2000 Server edition, and revised to extend functionality and improve administration in Windows Server 2003. Windows 2000 (also referred to as Win2K) is a preemptive, interruptible, graphical and business-oriented operating system that was designed to work with either uniprocessor or symmetric multi-processor 32-bit Intel x86 computers. ...
Windows Server 2003 is a server operating system produced by Microsoft. ...
Active Directory was called NTDS (NT Directory Service) in older Microsoft documents. This name can still be seen in some AD binaries. Windows NT (New Technology) is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. ...
Structure
Objects Active Directory is a directory service used to store information about the network resources across a domain. A directory service (DS) is a software application — or a set of applications — that stores and organizes information about a computer networks users and network resources, and that allows network administrators to manage users access to the resources. ...
It has been suggested that this article or section be merged into Active Directory. ...
An Active Directory (AD) structure is a hierarchical framework of objects. The objects fall into three broad categories: resources (e.g. printers), services (e.g. e-mail) and users (user accounts and groups). The AD provides information on the objects, organizes the objects, controls access and sets security. An object is fundamental concept in object-oriented programming. ...
A computer printer, or more commonly a printer, produces a hard copy (permanent human-readable text and/or graphics) of documents stored in electronic form, usually on physical print media such as paper transparencies]]. Many printers are primarily used as computer peripherals, and are attached by a printer cable to...
Wikipedia does not yet have an article with this exact name. ...
Each object represents a single entity — whether a user, a computer, a printer, or a group — and its attributes. Certain objects can also be containers of other objects. An object is uniquely identified by its name and has a set of attributes — the characteristics and information that the object can contain — defined by a schema, which also determines the kind of objects that can be stored in the AD.
Each attribute object can be used in several different schema class objects. These schema objects exist to allow the schema to be extended or modified when necessary. However, because each schema object is integral to the definition of AD objects, deactivating or changing these objects can have serious consequences because it will fundamentally change the structure of AD itself. A schema object, when altered, will automatically propagate through Active Directory and once it is created it can only be deactivated — not deleted. Changing the schema usually requires a fair amount of planning.[1]
Forests, trees, and domains The framework that holds the objects is viewed at a number of levels. At the top of the structure is the Forest - the collection of every object, its attributes and rules (attribute syntax) in the AD. The forest holds one or more transitive, trust-linked Trees. A tree holds one or more Domain and domain trees, again linked in a transitive trust hierarchy. Domains are identified by their DNS name structure, the namespace. A domain has a single DNS name. In grammar, a verb is transitive if it takes an object. ...
In grammar, a verb is transitive if it takes an object. ...
It has been suggested that this article be split into multiple articles. ...
The objects held within a domain can be grouped into containers called Organizational Units (OUs). OUs give a domain a hierarchy, ease its administration, and can give a semblance of the structure of the AD's company in organizational or geographical terms. OUs can contain OUs - indeed, domains are containers in this sense - and can hold multiple nested OUs. Microsoft recommends as few domains as possible in AD and a reliance on OUs to produce structure and improve the implementation of policies and administration. The OU is the common level at which to apply group policies, which are AD objects themselves called Group Policy Objects (GPOs), although policies can also be applied to domains or sites (see below). The OU is the level at which administrative powers are commonly delegated, but granular delegation can be performed on individual objects or attributes as well. In computing, an Organizational Unit (OU) provides a way of classifying objects located in directories, or names in a digital certificate hierarchy, typically used either to differentiate between objects with the same name (John Doe in OU marketing versus John Doe in OU customer service), or to parcel out authority...
Group Policy is part of Microsofts IntelliMirror technology which aim to reduce the overall cost of supporting users of Windows. ...
AD also supports the creation of Sites, which are physical, rather than logical, groupings defined by one or more IP subnets. Sites distinguish between locations connected by low-speed (e.g. WAN, VPN) and high-speed (e.g. LAN) connections. Sites are independent of the domain and OU structure and are common across the entire forest. Sites are used to control network traffic generated by replication and also to refer clients to the nearest domain controllers. Exchange 2007 also uses the site topology for mail routing. Policies can also be applied at the site level. Wide Area Network (WAN) is a computer network that covers a broad area (i. ...
“VPN†redirects here. ...
“LAN†redirects here. ...
The actual division of the company's information infrastructure into a hierarchy of one or more domains and top-level OUs is a key decision. Common models are by business unit, by geographical location, by IT Service, or by object type. These models are also often used in combination. OUs should be structured primarily to facilitate administrative delegation, and secondarily, to facilitate group policy application. Although OUs form an administrative boundary, the only true security boundary is the forest itself and an administrator of any domain in the forest must be trusted across all domains in the forest.
Physical structure and replication Physically the AD information is held on one or more equal peer domain controllers (DCs), replacing the NT PDC/BDC format. Each DC has a copy of the AD; changes on one computer being synchronized (converged) between all the DC computers by multi-master replication. Servers joined in to AD, which are not domain controllers, are called Member Servers. The AD database is split into different stores or partitions. Microsoft often refers to these partitions as 'naming contexts'. The 'Schema' partition contains the definition of object classes and attributes within the Forest. The 'Configuration' partition, contains information on the physical structure and configuration of the forest (such as the site topology). The 'Domain' partition holds all objects created in that domain. The first two partitions replicate to all domain controllers in the Forest. The Domain partition replicates only to Domain Controllers within its domain. A subset of objects in the domain partition are also replicated to domain controllers that are configured as global catalogs. On Windows Server Systems, the domain controller (DC) is the server that responds to security authentication requests (logging in, checking permissions, etc. ...
Windows NT (New Technology) is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. ...
As the article stated this was A direct quote from . However, I believe this usage of MSs copyrighted material is not allowed according to copyright law. ...
Unlike earlier versions of Windows which used NetBIOS to communicate, Active Directory is fully integrated with DNS and TCP/IP — indeed DNS is required. To be fully functional, the DNS server must support SRV resource records or service records. NetBEUI redirects here. ...
The Internet protocol suite is the set of communications protocols that implement the protocol stack on which the Internet runs. ...
An SRV record or Service record is a category of data in the Internet Domain Name System specifying information on available services. ...
AD replication is 'pull' rather than 'push'. The Knowledge Consistency Checker (KCC) creates a replication topology of site links using the defined sites to manage traffic. Intrasite replication is frequent and automatic as a result of change notification, which triggers peers to begin a pull replication cycle. Intersite replication intervals are less frequent and do not use change notification by default, although this is configurable and can be made identical to intrasite replication. A different 'cost' can be given to each link (e.g. DS3, T1, ISDN etc.) and the site link topology will be altered accordingly by the KCC. Replication between domain controllers may occur transitively through several site links on same-protocol site link bridges, if the 'cost' is low, although KCC automatically costs a direct site-to-site link lower than transitive connections. Site-to-site replication can be configured to occur between a bridgehead server in each site, which then replicates the changes to other DCs within the site. In telecommunications, T-carrier is the generic designator for any of several digitally multiplexed telecommunications carrier systems originally developed by Bell Labs and used in North America and Japan. ...
For the guitar distortion pedal, see BOSS DS-1. ...
ISDN is also short for isosorbide dinitrate Integrated Services Digital Network (ISDN) is a type of circuit switched telephone network system, designed to allow digital (as opposed to analog) transmission of voice and data over ordinary telephone copper wires, resulting in better quality and higher speeds, than available with analog...
In a multi-domain forest the AD database becomes partitioned. That is, each domain maintains a list of only those objects that belong in that domain. So, for example, a user created in Domain A would be listed only in Domain A's domain controllers. Global catalog (GC) servers are used to provide a global listing of all objects in the Forest. The Global catalog is held on domain controllers configured as global catalog servers. Global Catalog servers replicate to themselves all objects from all domains and hence, provide a global listing of objects in the forest. However, in order to minimize replication traffic and to keep the GC's database small, only selected attributes of each object are replicated. This is called the partial attribute set (PAS). The PAS can be modified by modifying the schema and marking attributes for replication to the GC. There are very few or no other articles that link to this one. ...
Replication of Active Directory uses Remote Procedure Calls. Between Sites you can also choose to use SMTP for replication, but only for changes in the Schema or Configuration. SMTP cannot be used for replicating the Domain partition. In other words, if a domain exists on both sides of a WAN connection, you must use RPCs for replication. Remote procedure call (RPC) is a protocol that allows a computer program running on one computer to cause a subroutine on another computer to be executed without the programmer explicitly coding the details for this interaction. ...
Simple Mail Transfer Protocol (SMTP) is the de facto standard for email transmission across the Internet. ...
The AD database, the directory store, in Windows 2000 uses the JET Blue-based Extensible Storage Engine (ESE98), limited to 16 terabytes and 1 billion objects in each domain controller's database. Microsoft has created NTDS databases with more than 2 billion objects. (NT4's Security Account Manager could support no more than 40,000 objects). Called NTDS.DIT, it has two main tables: the data table and the link table. In Windows 2003 a third main table was added for security descriptor single instancing.[2] This article is about computing. ...
The Extensible Storage Engine (ESE), formerly known as JET Blue, is a multi-user database from Microsoft that supports full Data Manipulation Language (DML) and Data Definition Language (DDL). ...
Disambig: for the teachers term, refer to ESE (teaching). ...
The Security Account Manager (SAM) is a database stored as a registry file in Windows NT and Windows 2000. ...
Active Directory is a necessary component for many Windows services in an organization such as Exchange.
FSMO Roles Flexible Single Master Operations (FSMO) roles are also known as operations master roles. Although the AD domain controllers operate in a multi-master model, i.e. updates can occur in multiple places at once, there are several roles that are necessarily single instance: | Role Name | Scope | Description | | Schema Master | 1 per forest | Controls updates to the Schema | | Domain Naming Master | 1 per forest | Controls the addition and removal of domains from the forest | | PDC Emulator | 1 per domain | Provides backwards compatibility for NT4 clients for PDC operations (like password changes). The PDCe also runs domain specific processes such as the Security Descriptor Propagator (SDPROP), and is the master time server within the domain. | | RID Master | 1 per domain | Allocates pools of unique identifier to domain controllers for use when creating objects | | Infrastructure Master | 1 per domain | Synchronizes cross-domain group membership changes. The infrastructure master cannot run on a global catalog server (unless all DCs are also GCs.) |
Naming AD supports UNC (), URL (/), and LDAP URL names for object access. AD internally uses the LDAP version of the X.500 naming structure. A path is the general form of a file or directory name, giving a files name and its unique location in a file system. ...
“URL†redirects here. ...
The Lightweight Directory Access Protocol, or LDAP (IPA: ), is an application protocol for querying and modifying directory services running over TCP/IP.[1] A directory is a set of information with similar attributes organized in a logical and hierarchical manner. ...
X.500 is the set of ITU-T computer networking standards covering electronic directory services such as white pages, Knowbot and whois. ...
Every object has a Distinguished name (DN), so a printer object called HPLaser3 in the OU Marketing and the domain foo.org, would have the DN: CN=HPLaser3,OU=Marketing,DC=foo,DC=org where CN is common name and DC is domain object class, DNs can have many more than four parts. The object can also have a Canonical name, essentially the DN in reverse, without identifiers, and using slashes: foo.org/Marketing/HPLaser3. To identify the object within its container the Relative distinguished name (RDN) is used: CN=HPLaser3. Each object also has a Globally Unique Identifier (GUID), a unique and unchanging 128-bit string which is used by AD for search and replication. Certain objects also have a User principal name (UPN), an objectname@domain name form. A Globally Unique Identifier or GUID (IPA pronunciation: or ) is a pseudo-random number used in software applications. ...
Trust To allow users in one domain to access resources in another, AD uses trusts. Trusts inside a forest are automatically created when domains are created. The forest sets the default boundaries of trust, not the domain, and implicit, transitive trust is automatic for all domains within a forest. As well as two-way transitive trust, AD trusts can be shortcut (joins two domains in different trees, transitive, one- or two-way), forest (transitive, one- or two-way), realm (transitive or nontransitive, one- or two-way), or external (nontransitive, one- or two-way) in order to connect to other forests or non-AD domains. Trusts in Windows 2000 (native mode) - One way trust - When one domain allows access to users on another domain, but the other domain does not allow access to users on the first domain.
- Two way trust - When two domains allow access to users on the other domain.
- Trusting domain - The domain that allows access to users from a trusted domain.
- Trusted domain - The domain that is trusted; whose users have access to the trusting domain.
- Transitive trust - A trust that can extend beyond two domains to other trusted domains in the tree.
- Intransitive trust - A one way trust that does not extend beyond two domains.
- Explicit trust - A trust that an admin creates. It is not transitive and is one way only.
- Cross link trust - An explicit trust between domains in different trees or in the same tree when a descendant/ancestor (child/parent) relationship does not exist between the two domains.
Windows 2000 - supports the following types of trusts: - Two way transitive trusts.
- One way non transitive trusts.
Additional trusts can be created by administrators. These trusts can be: Windows 2003 offers a new trust type - the forest root trust. This type of trust can be used to connect Windows 2003 forests if they are operating at the 2003 forest functional level. Authentication across this type of trust is Kerberos based (as opposed to NTLM). Forest trusts are also transitive for all the domains in the forests that are trusted. Kerberos is the name of a computer network authentication protocol, which allows individuals communicating over an insecure network to prove their identity to one another in a secure manner. ...
NTLM (New Technology LAN Manager) is a Microsoft authentication protocol used with the SMB protocol. ...
ADAM Active Directory Application Mode (ADAM) is a light-weight implementation of Active Directory. ADAM is capable of running as a simple user service. Due to its small resource requirements, multiple ADAM instances are able to run on the same server. The API is identical to that of a full-blown Active Directory implementation, so developers do not need to learn new skills to utilize it. Active Directory and ADAM share the same code base, so performance of ADAM is nearly identical to Active Directory when comparing like operations.
Alternatives There is a common misconception that Active Directory provides software distribution. Software distribution is run by a separate service that uses additional proprietary schema attributes that work in conjunction with the LDAP protocol. Active Directory does not automate software distribution, but provides a mechanism in which other services can provide software distribution.
The Samba software project currently offers a Windows NT 4.0-compatible domain controller; support for "Active Directory logon protocols" is slated for version 4.[3] The free software Linbox Directory Server offers a Web-based user interface to manage the Samba domain controller and the LDAP directory service. Samba is a free software re-implementation of SMB/CIFS networking protocol, released under the GNU General Public License. ...
Windows NT 4. ...
On Windows Server Systems, the domain controller (DC) is the server that responds to security authentication requests (logging in, checking permissions, etc. ...
On Windows Server Systems, the domain controller (DC) is the server that responds to security authentication requests (logging in, checking permissions, etc. ...
The Lightweight Directory Access Protocol, or LDAP (IPA: ), is an application protocol for querying and modifying directory services running over TCP/IP.[1] A directory is a set of information with similar attributes organized in a logical and hierarchical manner. ...
A directory service (DS) is a software application — or a set of applications — that stores and organizes information about a computer networks users and network resources, and that allows network administrators to manage users access to the resources. ...
Alternative LDAP servers include the Oracle Internet Directory, OpenLDAP, Apache Directory Server, Sun Java ES Directory Server, IBM Tivoli Directory Server, Novell eDirectory server, and Fedora Directory Server. OpenDS is in development as an open source alternative to Active Directory and other LDAP servers. Apple Inc.'s Open Directory is another alternative to Active Directory which is primarily targeted towards Mac OS X servers. Oracle Internet directory (OID) is a directory service produced by Oracle Corporation and compatible with LDAP version 3. ...
OpenLDAP is a free, open source implementation of the Lightweight Directory Access Protocol (LDAP). ...
The Apache Directory Server is an open source project of the Apache Software Foundation. ...
The Sun Java System Directory Server is Sun Microsystems scalable LDAP directory server and a component of Java Enterprise System. ...
IBM Tivoli Directory Server (ITDS), formerly known as IBM Directory Server is an IBM implementation of the LDAP protocol. ...
Novell eDirectory (formerly called Novell Directory Services [NDS]) is an X.500 compatible directory service software product released in 1993 by Novell, Inc. ...
The Fedora Directory Server (FDS) is an LDAP (Lightweight Directory Access Protocol) server developed by Red Hat, as part of Red Hats community-supported Fedora Project. ...
OpenDS is an open source directory service platform. ...
Apple Inc. ...
Open Directory is the directory service and network authentication services architecture at the core of Mac OS X Server from Apple Computer. ...
Mac OS X (IPA: ) is a line of graphical operating systems developed, marketed, and sold by Apple Inc. ...
Integrating UNIX into Active Directory Many commercial vendors now offer Active Directory integration for UNIX platforms (including UNIX, Linux, Mac OS X, and a number of Java- and UNIX-based applications). Some of these vendors include Centrify (DirectControl), Quest Software (Vintela Authentication Services), and Centeris (Likewise). Microsoft is also in this market with their free Microsoft Windows Services for UNIX product. Recent versions of Linux and UNIX operating systems provide varying levels of interoperability with Active Directory but lack advanced Active Directory capabilities such as Group Policy and support for one-way trusts. Windows Services for UNIX Microsoft Windows Services for UNIX (SFU) is a software package produced by Microsoft which provides a Unix subsystem and other parts of a full Unix environment on Windows NT and its successors. ...
Local Group Policy Editor in Windows XP Media Center Edition Group policy is a feature of Microsoft Windows NT family of operating systems that provides centralized management and configuration of computers and remote users in an Active Directory environment. ...
Another alternate option is to use another directory service such as Fedora Directory Server which can perform a two-way synchronization with Active Directory and thus provide a "deflected" integration with Active Directory as Unix and Linux clients will authenticate to FDS and Windows Clients will authenticate to Active Directory The Fedora Directory Server (FDS) is an LDAP (Lightweight Directory Access Protocol) server developed by Red Hat, as part of Red Hats community-supported Fedora Project. ...
See also Active Directory Explorer is a viewer and editor for Active Directory databases, from Microsoft. ...
Flexible single master operation (FSMO, F is sometimes floating), or just single master operation or operations master, is a feature of Microsofts Active Directory (AD). ...
Directory Services Restore Mode (DSRM) is used on a Microsoft Windows Domain Controller to take the Active Directory on that machine offline. ...
The following is a list of software programs that can communicate with and/or host directory services via the Lightweight Directory Access Protocol. ...
Notes Year 2007 (MMVII) is the current year, a common year starting on Monday of the Gregorian calendar and the AD/CE era in the 21st Century. ...
is the 158th day of the year (159th in leap years) in the Gregorian calendar. ...
Year 2007 (MMVII) is the current year, a common year starting on Monday of the Gregorian calendar and the AD/CE era in the 21st Century. ...
is the 213th day of the year (214th in leap years) in the Gregorian calendar. ...
External links |
There are 1 more (non-authoritative) comments on this page
Feeds |
Contact