Windows 2000 Active Directory, Second Edition [2 ed.] 9781928994602, 1-928994-60-1

Citation preview

1 YEAR UPGRADE BUYER PROTECTION PLAN

Windows 2000 Active Directory Second Edition Your Complete Guide to the Active Directory Architecture • Step-by-Step Instructions for an NT4 to Active Directory Migration • Hundreds of Configuring & Implementing, Designing & Planning Sidebars, Security Alerts, and FAQs • Complete Coverage of Network Resources, Services, and Users and Groups

Melissa C. Craft Thomas Llewellyn

Technical Editor

[email protected] With more than 1,500,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we continue to look for ways we can better serve the information needs of our readers. One way we do that is by listening. Readers like yourself have been telling us they want an Internet-based service that would extend and enhance the value of our books. Based on reader feedback and our own strategic plan, we have created a Web site that we hope will exceed your expectations. [email protected] is an interactive treasure trove of useful information focusing on our book topics and related technologies. The site offers the following features: ■ One-year warranty against content obsolescence due to vendor product upgrades. You can access online updates for any affected chapters. ■ “Ask the Author”™ customer query forms that enable you to post questions to our authors and editors. ■ Exclusive monthly mailings in which our experts provide answers to reader queries and clear explanations of complex material. ■ Regularly updated links to sites specially selected by our editors for readers desiring additional reliable information on key topics. Best of all, the book you’re now holding is your key to this amazing site. Just go to www.syngress.com/solutions, and keep this book handy when you register to verify your purchase. Thank you for giving us the opportunity to serve your needs. And be sure to let us know if there’s anything else we can do to help you get the maximum value from your investment. We’re listening.

www.syngress.com/solutions

1 YEAR UPGRADE BUYER PROTECTION PLAN

Windows 2000 Active Directory Second Edition

Melissa Craft Thomas D. Llewellyn Jr.

Technical Editor

Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable case, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, and “Career Advancement Through Skill Enhancement®,”are registered trademarks of Syngress Media, Inc. “Ask the Author™,”“Ask the Author UPDATE™,”“Mission Critical™,” “Hack Proofing™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY 001 002 003 004 005 006 007 008 009 010

SERIAL NUMBER UH7F9MKA5F Q3F3KMV9JX BV7KDFL4W9 MN9XVE5ALM CF59K5YPFG ALKEQ34TMG 28K7Y4NFNA EMRZP46MGH MS6DREHAWR XZEPA4TMBM

PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Windows 2000 Active Directory, Second Edition

Copyright © 2001 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-928994-60-1 Technical Editor:Thomas D. Llewellyn Jr. Freelance Editorial Manager: Maribeth Corona-Evans Technical Reviewer: Norris L. Johnson, Jr. Cover Designer: Michael Kavish Co-Publisher: Richard Kristof Page Layout and Art by: Shannon Tozier Acquisitions Editor: Catherine B. Nolan Copy Editors: Adrienne Rebello and Beth A. Roberts Developmental Editor: Jonathan Babcock Indexer: Jennifer Coker Distributed by Publishers Group West in the United States and Jaguar Book Group in Canada.

Acknowledgments We would like to acknowledge the following people for their kindness and support in making this book possible. Richard Kristof and Duncan Anderson of Global Knowledge, for their generous access to the IT industry’s best courses, instructors, and training facilities. Ralph Troupe, Rhonda St. John, and the team at Callisma for their invaluable insight into the challenges of designing, deploying and supporting world-class enterprise networks. Karen Cross, Lance Tilford, Meaghan Cunningham, Kim Wylie, Harry Kirchner, Kevin Votel, Kent Anderson, Eric Green, Dave Dahl, Elise Cannon, Chris Barnard, John Hofstetter, and Frida Yara of Publishers Group West for sharing their incredible marketing experience and expertise. In addition, a special thanks to Janis Carpenter and Kimberly Vanderheiden for help on recent projects. Mary Ging, Caroline Hird, Simon Beale, Caroline Wheeler,Victoria Fuller, Jonathan Bunkell, and Klaus Beran of Harcourt International for making certain that our vision remains worldwide in scope. Anneke Baeten and Annabel Dent of Harcourt Australia for all their help. David Buckland,Wendi Wong, Daniel Loh, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, and Joseph Chan of Transquest Publishers for the enthusiasm with which they receive our books. Kwon Sung June at Acorn Publishing for his support. Ethan Atkin at Cranbury International for his help in expanding the Syngress program. Rick Bizzozero and Carolyn Gifford at GIG Communications for their help with packaging. Joe Pisco, Helen Moyer, Paul Zanoli, Alan Steele, and the great folks at Graphic Services/InterCity Press for all their help. v

About the Author Melissa Craft (CCNA, MCNE, MCSE, Network+, CNE-3, CNE-4, CNE-GW, CNE-5, CCA) worked with computers during high school, developing computer programs and testing hardware solutions as a summer job. After graduating from the University of Michigan, Melissa designed business solutions for an insurance group using technology to automate processes and using business process reengineering techniques. This position grew into engineering a wide area network, which subsequently turned into a career move permanently into engineering. After making the jump to network engineering, Melissa threw herself at the task of truly understanding network engineering, gaining a myriad of technology certifications and, at the same time, deploying projects for clients. Over the years, she has successfully designed, implemented, and integrated networks ranging in size from a few nodes to over 100,000 nodes. Her consulting experience incorporated extensive project management, operational analysis, LAN and WAN design, deployment, and ongoing network management. In 1997, Melissa began writing magazine articles on networking and the technology industry. In 1998, Syngress hired Melissa to contribute to an MCSE certification guide. Since then, Melissa has continued to write about various technology and certification subjects. Currently, Melissa is a Principal Consultant for CompuCom Systems, Inc. As such, she develops enterprise-wide technology solutions and methodologies focused on client organizations.These technology solutions touch every part of a system’s lifecycle, from assessing the need, determining the return on investment, network design, testing, and implementation to operational management and strategic planning. CompuCom Systems, Inc. is a leading digital infrastructure solutions provider whose clients include Fortune 1000 enterprises, vertical industry leaders, major technology equipment providers, leading-edge systems integrators and wireless technology providers. CompuCom’s technology solutions help companies master complex technologies. CompuCom leverages people, process and technology to offer best in class solutions that enable, vi

optimize and operate the digital technology infrastructure. CompuCom is accessible via the Internet at www.compucom.com. Melissa holds a bachelor’s degree from the University of Michigan and is a member of the IEEE, the Society of Women Engineers, and American MENSA, Ltd. Melissa currently resides in Glendale, AZ with her family, Dan, Justine, and Taylor.

Technical Editor Thomas D. Llewellyn Jr. (MCSE, MCT, and A+) works as a Senior System Engineer/Project Manager for Integra Business Center headquartered in Allentown, PA. Integra is a Value Added Reseller that provides IT design, project management, and various Information Technology services for small- to medium-sized businesses.Tom has a degree in Computer Science and Technology with a concentration in Computer Programming; he brings over 10 years of real-world IT enterprise experience to Integra that spans the development, networking design, implementation, and ongoing management and support of Information Technology business solutions. He has a vast amount of experience with the Enterprise Deployment of Microsoft Systems Management Server and other Windows NT/2000 based Technologies.Tom has served as Technical Editor on other Syngress books and was previously employed as a Senior Consultant by CoreTech Consulting Group Inc. He lives in Gilbertsville, PA.

vii

Technical Reviewer Norris L. Johnson, Jr. (MCSE, MCT, CTT, A+, Network +) is a Technology Trainer and Owner of a consulting company in the SeattleTacoma area. His consultancies have included deployments and security planning for local firms and public agencies, as well as providing services to other local computer firms in need of problem solving and solutions for their clients. He specializes in Windows NT 4.0 and Windows 2000 issues, providing planning and implementation and integration services. In addition to consulting work, Norris trains extensively in the AATP program at Highline Community College’s Federal Way,WA campus, and has taught in the vocational education arena at Bates Technical College in Tacoma,WA. Norris holds a bachelor’s degree from Washington State University. He is deeply appreciative of the guidance and support offered by his parents and wife Cindy during the years of transition and education to make the career change that has been so wonderful to be involved in.

viii

Contents

Preface Understand What Is in a Directory Service

A directory is a place to store information. The type of information that is stored in a directory falls into three basic categories: ■

Resources

■

Services

■

Accounts

Part I: Getting Started Chapter 1 Introduction to Active Directory Introduction Introduction to Directory Services Directory Enabled Networks History of the Directory Service What Is in a Directory Service? The Directory Database Directory Service Domino Effect Introduction to Active Directory .NET Protocol Interoperability Single Point of Administration Active Directory Architecture Namespace Forests Scope Distinguished Name User Principle Name Partitions Global Catalog Object Container Domains Domain Trees

xxv

1 3 4 4 5 6 11 13 15 15 16 17 18 20 23 24 24 25 26 27 28 29 29 30 30 ix

x

Contents

Viewing Trust Relationships Viewing the Namespace Sites Architecture Data Model Schema Security Model Administration Model Summary Solutions Fast Track Frequently Asked Questions

Estimate Project Costs

■

Labor How many people will be required to work on the project?

■

Capital What server equipment will need to be purchased?

■

Real estate Will you require more space for servers?

■

Training Will your administrators need to be trained on the new system?

■

Ongoing costs What are the costs of a maintenance contract for the hardware?

Chapter 2 Assessing Your Environment Introduction Defining Your Business Objectives Matching Business Objectives to Technology Business Objectives That Active Directory Will Meet Costs and Benefits Project Costs Benefits Assessing Your Current Environment Network Infrastructure Servers Desktops Peripherals and Mobile Devices Locations Gathering Information for Your Active Directory Planning and Design Objects and OUs Organizational and Network Infrastructures That Impact Active Directory Planning and Design Planning for Your Implementation Project Timeline Setting Milestones Setting a Budget

30 31 32 33 33 33 34 35 36 37 39

41 42 43 45 47 50 50 51 52 55 56 57 57 58 59 59

59 61 61 63 63

Contents

Communications Gap Analysis of Business Objectives and Current Environment Risk Analysis Summary Solutions Fast Track Frequently Asked Questions

Learn about Domain and Domain Trees

domain.com

eng.domain.com

corp.domain.com

Chapter 3 Active Directory for Windows 2000 JumpStart Tutorial Introduction What Active Directory Is, and Why You Need to Know About It Demote a DC Policy-Based Administration Decentralized Administration Improved Security Important Features Scalability of Forests, Domains, Organizational Units, and Sites Extensibility of the Schema Multi-Master Domain Controllers Intellimirror Kerberos Trusts Use of Standard Protocols Accessibility of Resources Industries and Companies Affected by Windows 2000 Technology Vendors and Partners Competitors Customers And… Microsoft Itself Advantages and Disadvantages of Active Directory Advantages with Active Directory Problems with Active Directory

sales.corp.domain.com

xi

64 65 66 68 68 70

73 74 74 75 76 76 77 77 78 80 82 82 84 85 86 87 88 88 89 90 90 90 91

xii

Contents

Summary Solutions Fast Track Frequently Asked Questions

Answer Your Questions about DNS

Q: Can we use a DNS server other than Windows 2000 DNS?

A: Yes, but it must be able to support SRV RRs. Even if you have a Windows NT 4.0 DNS server, you will not be able to use it because it doesn’t support SRV RRs. However, a BIND 8.1.2.1 server can be used because it does support SRV RRs.

Q: Our company uses a DNS server that does not support SRV resource records (RRs). Can we use it when we implement Active Directory?

A: No. Active Directory relies on SRV RRs in order to locate domain controllers (DCs). All DNS servers for the namespaces that Active Directory encompasses must also support the SRV RRs.

93 93 95

Part II: Designing the Active Directory

97

Chapter 4 DNS and Naming Strategies Introduction What Is DNS? How DNS Zones Function Active Directory’s Integration with DNS How Active Directory Uses DNS Dynamic DNS Planning Active Directory and DNS Forest Plan Domain and DNS Strategy DNS Sizing Domain Divisions Requirements Root Domain About Domains DNS Servers Organizational Units Site Topology Naming Conventions Defining DNS Names Defining DNS Zones Naming Conventions for Active Directory Migrating an Existing Exchange Server Design Migrating an Existing Novell Directory Services Design Summary Solutions Fast Track Frequently Asked Questions

99 100 101 104 106 108 112 113 114 116 117 117 118 119 120 120 121 122 123 125 127 127 129 129 131 132 133

Contents

Design the Active Directory When you design an Active Directory, there are four elements that must be planned: ■

Forest Plan

■

Domain/DNS Strategy

■

Organizational Unit (OU) Structure

■

Site Topology

Understand the Components of the Active Directory Sites and Services Console Found in Administrative Tools

xiii

Chapter 5 Designing the Basic Structure Introduction Case Studies About Tekkietech.com About Insurance, Inc. Designing a Forest Tekkietech.com Insurance, Inc. Designing a Domain Tree Tekkietech.com Insurance, Inc. Designing an Organizational Unit Structure Tekkietech.com Insurance, Inc. Designing a Site Topology Tekkietech.com Insurance, Inc. Using OUs for Delegating Administration OU Objects in Active Directory Group Policy and OUs Delegating Administration Summary Solutions Fast Track Frequently Asked Questions

135 136 136 136 138 140 141 142 143 145 146 148 148 150 150 152 152 154 155 155 155 160 161 163

Chapter 6 Designing a Site Structure Introduction The Function of Sites in Active Directory Default-First-Site-Name Replicated Active Directory Components Domain Partitions Global Catalog Schema and Configuration Containers Site Replication Components Site Objects Knowledge Consistency Checker

165 166 167 170 171 171 171 173 174 174 174

xiv

Contents

Connection Objects Site Links Site Link Bridges Replication Protocols Replication in Active Directory Replication Topology Planning a Site Structure Placing Domain Controllers Where to Place Global Catalog Servers Summary Solutions Fast Track Frequently Asked Questions Learn the Goals of Placing Servers One of the essentials of site design is to place servers in the various locations. When placing servers, there are some simple goals: ■

Ensure that users can log on to and query Active Directory.

■

Ensure that servers can locate other domain controllers.

■

Manage traffic generated by Active Directory.

Chapter 7 Designing: A Case Study Introduction Case Study Overview Assessing a Corporate Network Determining the Business Objectives Kings Vineyard’s Business Objectives Current Environment Network Infrastructure Servers Desktops and End-Users Designing the Forests Determining Domain and Tree Structure Planning the OU Structure Administrative Structure Hidden OUs Group Policies Inheritance Establishing the Initial Sites Site Links Placing Servers Domain Controllers Global Catalog Servers DNS Servers

175 176 177 179 180 181 187 190 191 192 193 194

197 198 198 200 200 201 203 204 206 207 208 210 214 214 215 217 222 222 223 224 224 226 226

Contents

Summary Solutions Fast Track Frequently Asked Questions

Part III: Installing Active Directory

Decide Whether to Upgrade Servers or Clients First

This decision is in line with long-standing networking best practices when deploying new networks: 1. Establish the network infrastructure first. 2. Establish security and servers next. 3. Establish workstations last.

Chapter 8 Migrating from NT 3.51 or NT 4 to Active Directory Introduction Server Migration Strategies Primary Domain Controllers Changes Required When Upgrading a Domain Controller Backup Domain Controllers Member Servers Promoting Member Servers with Dcpromo Upgrading with the Windows 2000 Setup Wizard Installing Active Directory Services Interim Mixed Domains Mixed Mode Native Mode Migrating Components Using Organizational Units to Create a Hierarchical Structure User Accounts ClonePrincipal Active Directory Migration Tool Machine Accounts Nested Groups Global Groups Delegating Administrative Authority Insert into the Replication Topology Upgrading Clients to Windows 2000 Professional

xv

227 227 229

231 233 234 235 243 245 246 248 248 249 251 255 255 256 257 258 260 261 261 262 263 264 264 265 266

xvi

Contents

Learn the Three Basic Steps for the Windows 2000 Active Directory Domain Installation 1. Run the Windows 2000 Server installation command. (You have the option of running WINNT from a DOS prompt, booting directly into the installation from the CD-ROM, or running WINNT32 from a 32-bit Windows operating system.) 2. Configure DNS (Domain Name System) as a client to another DNS server or as a service on the Windows 2000 Server. 3. Run the Active Directory Installation Wizard.

Summary Solutions Fast Track Frequently Asked Questions

269 271 273

Chapter 9 Implementing a Domain Introduction Installing DNS Verifying Compatibility Windows 2000 DNS Installation Delegating a Subdomain Configuring DNS About Zones Service Resource Record Registration Installing Domains in Active Directory Active Directory Sizer Tool The First Domain Controller Active Directory Wizard Integrating DNS into Active Directory Active Directory Integrated Zones Managing Objects in Active Directory Creating Organizational Units Managing User Accounts Managing Groups Nesting Groups Managing Computers Common Object Management Role-Based Administration Microsoft Management Console Administrative Roles Summary Solutions Fast Track Frequently Asked Questions

275 276 277 277 279 279 281 282 284 284 285 285 289 298 299 300 300 301 303 305 306 308 308 308 309 311 312 314

Chapter 10 Building Trees and Forests Introduction Understanding the Characteristics of an Active Directory Forest

317 318 319

Contents

Learn the Five Major Command Line Programs ■

NETDOM BDC

■

NETDOM MASTER

■

NETDOM MEMBER

■

NETDOM QUERY

■

NETDOM RESOURCE

Find Complete Coverage of Replication Utilities ■

REPLMON is a Windows 2000 Resource Kit utility that you can use to monitor replication traffic.

■

REPADMIN is a command-line utility that you use to diagnose problems with replication.

■

Although DSASTAT is not geared specifically towards replication, it can help diagnose replication problems that are based in naming context issues.

Common Schema Common Configuration Global Catalog Contiguous Namespace Trust Relationships Transitive Bidirectional Trust Trusts That Cross Forests Trust Utilities Implementing the Forest Structure The Domain Tree Structure Adding a Child Domain Right-Sizing the Active Directory Storage Space Managing the Forest Summary Solutions Fast Track Frequently Asked Questions

Chapter 11 Implementing Sites Introduction Creating Site Components Creating Sites Creating Connection Objects Creating IP Subnets Creating Site Links Creating Site Link Bridges The Knowledge Consistency Checker Implementing a Site Structure in Active Directory Replication Utilities Replication Monitor Replication Administrator DSASTAT Understanding Time Synchronization Summary Solutions Fast Track Frequently Asked Questions

xvii

320 320 320 322 323 323 324 325 329 331 333 334 338 342 343 345

347 348 348 348 350 351 352 355 356 356 361 361 362 362 362 364 365 367

xviii

Contents

Case Study In this chapter, you will be provided with an exemplary organization’s Active Directory design, and then will walk through its implementation.

Chapter 12 Implementing Active Directory: A Case Study Introduction Case Study Overview Forest Plan DNS and Domain Plan Organizational Units Site Topology Plan Implementing DNS Implementing the First Domain Controller Migrating Upgrading Adding New Domains Creating an Explicit Trust Establishing the OUs Moving Upgraded Users Creating New Users Adding Computer Objects Setting Up Sites Summary Solutions Fast Track Frequently Asked Questions

369 370 370 370 370 373 373 375 377 377 378 379 381 382 382 383 383 384 386 386 388

Part IV: Migrating Active Directory

391

Chapter 13 Intellimirror Introduction What Are Group Policies? How Group Policies Are Applied Refresh Interval Blocking and Enforcing Group Policy Information Storage and Settings Administrative Templates Registry.pol Group Policy Settings Computer Configuration User Configuration Designing a Group Policy Strategy

393 394 394 397 397 398 400 400 402 402 403 403 405

Contents

Learn about the Four Containers to which Group Policies Might Be Applied ■

Local Group Policy

■

Site Group Policy

■

Domain Group Policy

■

Organizational Unit (OU) Group Policy

Group Policy in WAN Environments Implementing a Group Policy Strategy Configuring Group Policy Objects Link a Group Policy Object to a Container Adding Scripts Deploying Applications with Group Policies Folder Redirection Keeping Groups from Growing Over Time Troubleshooting Group Policies Policy that Does Not Execute A Policy that Executes in the Wrong Way Logging On Takes a Long Time Understanding Security Groups Domain Security Console Account Policies Local Policies Event Log Restricted Groups System Services Registry File System Public Key Policies IP Security Policies on Active Directory Security Templates Object Protection Access Control Lists Access Control Entries Security Descriptor Security Identifier Security Model Kerberos Public Key Infrastructure Smart Cards IP Security Secondary Logons

xix

406 408 409 412 413 416 420 423 424 424 425 426 426 427 429 430 434 434 434 435 435 435 436 436 436 436 436 437 438 439 439 440 440 441 441 441

xx

Contents

Summary Solutions Fast Track Frequently Asked Questions Four ADSI objects are capable of extending a directory service schema. They are called schema management ADSI objects:

■

Schema container Contains the target directory service schema.

■

Class container Defines object classes for the target directory service.

■

Property object Defines object attributes for the target directory service.

■

Syntax object Further defines the syntax used for a property object.

443 444 446

Chapter 14 Publishing Introduction Publishing Resources Sharing Folders Publishing a Folder in Active Directory Browsing and Querying for Shared Folders Overview of Dfs and EFS Dfs EFS Publishing a Printer in Active Directory Interfacing with Active Directory ADSI RPC Windows Sockets DCOM Exchange Server 5.5 Active Directory Connector Exchange Server 2000 Summary Solutions Fast Track Frequently Asked Questions

449 450 450 451 452 454 457 457 458 459 460 460 462 463 463

Chapter 15 Modifying the Schema Introduction About Objects and Attributes Planning Schema Modifications Why Modify the Schema? When to Modify the Schema Who Should Modify the Schema? Schema Management Console Flexible Single Master Operation How to Modify the Schema Class

473 474 474 475 475 476 476 478 479 481 481

463 465 469 469 471

Contents

Attributes System Checks after Schema Modification Schema Container The Cache Schema Utilities Querying Active Directory Display Specifiers Summary Solutions Fast Track Frequently Asked Questions NOTE You can reduce some administrative headaches by setting up a refresh for users’ profiles. If you delete the user profile cache, a user must authenticate to the network and load a new profile. Be selective when choosing users to refresh profiles on, however. Authenticating and downloading profiles may not be desired for remote users, especially if they have large profiles to load or are often traveling.

Chapter 16 Using Active Directory: A Case Study Introduction Case Study Overview Planning the Group Policy Solution Creating New OUs Deciding Group Policy Application Determining What Group Policies Are Needed Implementing the Group Policy Computer Node User Node Creating the Group Policy for an OU Creating Logon/Logoff Scripts Summary Solutions Fast Track Frequently Asked Questions

xxi

488 490 491 491 492 494 494 496 497 499

501 502 502 504 505 506 507 507 508 509 513 514 516 516 518

Part V: Integrating with Active Directory

521

Chapter 17 Plugging into Active Directory Introduction Microsoft’s Metadirectory MMS Architecture Obtaining MMS

523 524 524 528 529

xxii

Contents

Recovering a Failed Domain Controller When a DC fails, there is typically more to be restored than just files and folders. There are two issues involved: ■

Transactions might not have been written to disk, but were written to log files for Active Directory.

■

Data in the Active Directory databases on other DCs might have had additional changes since the failure.

Microsoft’s Active Directory Deployment Tools Mission Critical’s Active Directory Migration Tool Deploying Active Directory-Enabled Clients Best Practices Deploying DSClient Quest’s FastLane Technologies FastLane Reporter FastLane Administrator FastLane Migrator FastLane Developer FastLane Consolidator Cisco CNS/AD What CNS/AD Does Other Applications SAP Mobile Information Server SQL Server 2000 Summary Solutions Fast Track Frequently Asked Questions

529 530 530 530 531 532 533 534 535 537 537 537 538 540 541 542 542 543 544 545 547

Chapter 18 Disaster Recovery for Active Directory 549 Introduction 550 Modeling Sites with Disaster Recovery in Mind 550 Avoiding Disasters 554 Uninterruptible Power Source 554 RAID 555 Clustering 556 File Replication Service 557 Distributed File Service 558 The Active Directory Database File Structure 558 Backup 560 Creating an Emergency Repair Disk 562 Recovering a Failed Domain Controller 562

Contents

Non-Authoritative Restore versus Authoritative Restore Authoritative Restore of Deleted Objects Startup Options The Recovery Console Summary Solutions Fast Track Frequently Asked Questions

Appendix A Migrating from Novell NetWare Migrating from Novell Directory Services Other Utilities

A simple domain upgrade process is as follows: 1. Clean up the domain accounts and synchronize. 2. Take a BDC offline for use in case you need to restore the NT domain. 3. Upgrade the PDC first. 4. Upgrade BDCs next. 5. Once the DCs are all upgraded to Windows 2000, you may switch to native mode at any time, and upgrade member servers to Windows 2000 as needed.

xxiii

563 563 564 566 567 568 570

571 572 574

Appendix B Secrets 575 Lesser-Known Management Shortcuts 576 Upgrading DNS and Supporting DNS Dynamic Update Protocol 576 Creating a Custom Microsoft Management Console 576 PDC Emulation and Native Mode 577 How Active Directory Prevents Unnecessary Replication 578 Under-Documented Functions and Procedures 579 How an LDAP Query Accesses Active Directory 579 Software Installation 580 How to Create and Configure a Dfs Root 582 Informational Message 583 Renaming 583 Quick Application of an Updated Group Policy 583 DNS Migrations 584 DNS Best Practices 585 For Experienced Users 586 Add a Server to Two Different Sites Simultaneously 586

xxiv

Contents

Removing Phantom Objects Phantom Domains Transferring FSMO Roles Troubleshooting Tips Avoiding Errors When Migrating a Domain Remote Procedure Call Errors

Index

586 587 588 592 592 592

595

Preface

Active Directory is the directory service that comes with Windows 2000 Server and extends to be the directory service for other servers, such as Exchange Server 2000 and Mobile Information Server. Prior to the release of Windows 2000, many people speculated on how Active Directory could help them reduce costs or increase services to end-users.To some, Active Directory provided a competitive advantage stemming from its integration with Internet applications. But much of this speculation took place before Active Directory was available to the public. Now, many organizations are realizing the business objectives made possible by deploying Active Directory. Windows 2000 Active Directory, Second Edition has been carefully updated and expanded from the first edition taking into account over a year’s worth or enterprise-wide deployments of Windows 2000 and Active Directory. This book will provide you with detailed explanations and case studies that will answer the most challenging questions regarding Active Directory. How can you configure the inner-workings of this directory service to make the most of your IT investment? What is the best approach to a migration? How do you use the features, such as Group Policies, to simplify your administration? And what can you do to prepare for a disaster?

Managing the Enterprise Active Directory catalogs network resources, such as servers, applications, users, and groups. Since it stores this information in a single database and distributes this database across the network according to your configuration, you can manage an entire enterprise with Active Directory. In fact, an Active Directory domain can scale to ten million objects, which is enough to satisfy even the most complex enterprise. (Compare this to a Windows NT domain, which is limited to 40,000 objects!) Active xxv

xxvi

Preface

Directory’s enterprise management capabilities are enhanced through the use of the some of the latest versions of Internet protocols: ■

Lightweight Directory Access Protocol (LDAP)

■

Dynamic Domain Name System (DDNS)

■

Hypertext Transfer Protocol (HTTP)

■

X.500

Intellimirror replaces some legacy features of Windows NT, including System policies, roaming user profiles and My Briefcase. Using Intellimirror through configuration of Group Policies and profiles provides a host of management options that can scale to environments with thousands of users in locations all over the world: ■

Software deployment

■

Offline file storage

■

Desktop environment configuration

Another management feature of Active Directory is the ability to delegate administrative rights to users at a granular level.You no longer need to add ordinary users to the Administrators groups in order for those users to have control over certain administrative duties in your network. Now, you can run a Delegation of Administration wizard and grant those users the rights to control only certain aspects of other objects in Active Directory.This means you can create Password administrators, who only have the right to change passwords, or you can give users in Human Resources the ability to create new user objects when there is a newly hired associate but not have the right to delete them. There are other benefits that Windows 2000 Server has outside of Active Directory.Windows 2000 Server is far more reliable than any past Windows NT server product. Microsoft’s Web site cites Aberdeen’s study that scored a 99.95% reliability factor for Windows 2000 Server. In addition, there are disk quotas that you can set for end-users. Now, a user who tries to create 87 copies of a 152 MB file can be prevented from being a space hog through those wonderful disk quotas.

www.syngress.com

Preface

xxvii

What to Expect from this book The first edition, Managing Active Directory for Windows 2000 Server, was published at just about the same time as the gold code for Windows 2000 Server was released. It was timely for first-time explorers of the Windows 2000 Active Directory.This edition answers questions for both first-time Active Directory administrators as well as those who have been using Active Directory since it’s pre-release days. This book will cover Windows 2000 Server Active Directory, in detail. It will discuss the concepts necessary to design each aspect of the directory service. It will discuss the services that Active Directory depends on, such as the Domain Name Service (DNS). And it will walk through the design process for a case study. Designing an Active Directory is only the first part.You can’t begin to use it until you implement it in your own environment.The process of implementing a new Active Directory and the process of upgrading Windows NT domains to Active Directory domains, are both covered in this book. When you have your Active Directory up and running, then you can really tap into its power.The use of Group Policies and publishing of network resources can reduce the time and effort it takes to manage an entire network.These topics are fully covered in this book.

Learning More One of the best places to learn more about Windows 2000 Server and Active Directory is from your own experience. If you can set up a lab environment with two or more computers to act as your servers, you will be able to test out the exercises in this book and become comfortable with the system. You can find out the latest information about Windows 2000 and Active Directory directly on Microsoft’s Web site.The extreme technical subjects are discussed in the Technet section, and troubleshooting is addressed in the Knowledgebase. In fact, a simple search of www.microsoft.com for the words “Active Directory” can keep you reading for months at a time. Once you open one door, they say, it leads to another. If you are interested in learning more about Active Directory or even about some of the ancillary subjects listed in the “Not Covered” area, you should check out the following titles offered by Syngress (www.syngress.com).

www.syngress.com

xxviii

Preface

Configuring ISA Server 2000: Building Firewalls for Windows 2000, ISBN 1-928994-29-6 Configuring Exchange Server 2000, ISBN 1-928994-25-3 Configuring Citrix MetaFrame for Windows 2000 Terminal Services, ISBN 1-928994-18-0 Configuring Windows 2000 WITHOUT Active Directory, ISBN 1-928994-54-7 Designing SQL Server 2000 Databases for .NET Enterprise Servers, ISBN 1-928994-19-9

www.syngress.com

Part I

Getting Started

Chapter 1

Introduction to Active Directory

Solutions in this chapter: ■

Introduction to Directory Services

■

Introduction to Active Directory

■

Active Directory Architecture

 Summary  Solutions Fast Track  Frequently Asked Questions

3

4

Chapter 1 • Introduction to Active Directory

Introduction In November 1996, Microsoft delivered the first preview of Active Directory for developers at the Professional Developers Conference held in Long Beach, California. At the time, it was just the directory service that was shipped with Windows NT 5.0, and the preview included many of other Windows NT 5.0 features. A lot of changes have taken place since then. For one,Windows NT 5.0 was renamed Windows 2000, and then it was released to the public officially in February 2000, four years after its original preview to developers. The change of the name from Windows NT 5.0 to Windows 2000 was a surface change only.Windows 2000 inherits the NT technology legacy from previous versions. It has been established as the basic network operating system for Microsoft’s .NET platform. All .NET services run on Windows 2000 Server. Applications developed with the .NET framework also require servers to be running Windows 2000.The directory service used by .NET applications is Active Directory. The question remains, then, how can you take advantage of Active Directory and use its capabilities to reach your business objectives, not only for the present, but also in the future? That is the question that this book will answer.

Introduction to Directory Services It would be tough to claim that Active Directory is the first directory service ever created. In fact, directory services have been available in a variety of network operating systems (NOS). Directory services are used primarily for organizing, locating, and managing network information. People use directory services without even knowing they are doing so. Because it is used to translate server names to Internet Protocol (IP) addresses, the Domain Name System (DNS) is the most widely used directory service in the world. DNS is rather “usage-specific,” meaning that it organizes only a limited amount of information about network hosts. DNS stores data about servers, their IP addresses, and services that they offer to the network. Although this is pretty much the extent of DNS, other directory services do not have the same limitations. A directory service can organize all sorts of information about a network. Usually, this information falls into the following categories: ■

Network resources Servers, printers, and other devices on a network.

■

Network services Capabilities on the network such as file storage, printing, and e-mail.

www.syngress.com

Introduction to Active Directory • Chapter 1 ■

Network users and groups Identifiers for users on a network and for groups of users.

As you can see, a directory service organizes the pieces of a network, enabling a way to create relationships between the pieces.The relationships between these pieces are what make the directory service so powerful. For example, in DNS, a DNS client computer can query a DNS server to find out the IP address of a server that it wants to contact.The DNS server receives the host name and returns the IP address in short order. More complex relationships can be created in more complex directory services, such as providing access to network resources and services for users who logon.

Directory Enabled Networks The Distributed Management Task Force (DMTF) is developing a standard for Directory Enabled Networks (DEN).You can access the DMTF Web site at www.dmtf.org. Even though many network operating systems support one or more types of directory services, most of those directory services are vendor specific.This means that one server on a network might be able to access one particular directory, but another server on the same network will not be able to access that directory simply because it is running a different vendor’s network operating system. As a result of using multiple network operating systems, you might be using multiple directory services on a single internetwork.This poses problems for users who are faced with multiple logons and for network administrators who must manage information that is duplicated across multiple directory services. As vendors create DEN-compliant directories, multiple network operating systems will be able to participate in a single directory service.This will solve the challenges of managing the same information in multiple directory stores. It will also reduce the number of logons that a user must execute in order to access network resources. The standard directory service being developed for DEN will extend beyond the simple organization of addresses and host names that DNS provides. Instead, the directory service will organize all the services and resources participating in a network, depicted in Figure 1.1. Once the DEN standard is finalized, Microsoft intends to make Active Directory comply with that standard. DEN standards eventually will apply to all future directory services, and also to a variety of network resources and services. For example, a router can comply with the DEN standard and automatically integrate with the DEN-compliant directory service running on a network. An object would be created in the www.syngress.com

5

Chapter 1 • Introduction to Active Directory

directory service to represent that router. A variety of values for the router would be applied and the administrator could apply policies to the router and the traffic that flowed across it. In fact, because the DEN-compliant directory service included user objects, the traffic that was associated to a particular user could be managed with the router performing queries against the directory service. In practice, an executive might be granted more bandwidth usage and the router would provide that to traffic associated with that executive. All of this would be possible using queries against the directory service’s policies, without needing to know the IP addresses of the computers used or the location of the user. Figure 1.1 Directory Service Structure Application License Network Printer

File Server

Canc Next Can OK celel>

6

Cancel

Directory Service

User

• • • •

Organizes Manages Information Applies Security Settings Enables Access E-Mail Address

DHCP Address DNS Address/Hostname

History of the Directory Service In the not-too-distant past, networks were server-centric.. Each server had its own security system, which consisted of user accounts, group accounts, and network resources. It would associate those user accounts to the files, directories, printers, and other services or resources that it had to offer.These associations had a value to them, such that one person could have more access to one network resource than another person, simply due to the rights assigned to user and group accounts. In a way, this server-centric system was one of the first directory services, but one whose scope existed only on a single server. www.syngress.com

Introduction to Active Directory • Chapter 1

Networks first popped up in the military as a method to share data quickly across great distances.They offered a major advantage in times of war. Money was one of the main reasons that networking became prevalent in businesses. Hard drives were extremely expensive, as were printers. Many of the first corporate networks sprang up out of a need to share printers and precious hard-drive space among multiple computers. Soon, these servers’ hard drives would fill up.They would run out of printer ports. At some point in time, another server would be added to the network to allow further storage of shared files or to add new printers. Once an administrator established a server to share files and printers, the administrator was faced with an issue—how to protect sensitive files and printers from unauthorized users while allowing use of the remaining files and printers. In some cases, the administrator wanted to allow some users limited access to a file or a printer. Access rights were added to the system, and users given specific logon IDs.The server could then easily share files and printers to the correct users, depending on the administrator’s configuration. When a network contained more than one server, administration became difficult. If a user needed to access files or printers residing on two or more servers, that user needed to know how to access each specific server. In addition the user needed a separate logon ID and password for each server. Some administrators used naming conventions to ensure that a user did not need to have more than one unique logon ID. Sometimes, a network had multiple administrators with different naming conventions, providing users with two or more unique logon IDs. For administrators, it was difficult to keep passwords synchronized since each server might have a different timing mechanism to enforce password changes. For users, the end result in a multiserver environment was a convoluted and difficult process of remembering the location of resources, remembering the correct logon ID, and remembering the correct current password, all just to be able to access resources on the network. Network operating systems soon developed a variety of ways to use a single logon ID and password to access multiple servers. For example, Microsoft Windows NT uses a domain architecture. An NT domain is a group of Windows NT servers that participate in a single security system listing users, groups, and network resources. It consists of a primary domain controller (PDC), any number of backup domain controllers (BDCs), and any number of member servers and client computers.The PDC is the security manager of the domain. BDCs maintain a read-only copy of the security database, and the PDC remains the single point of change control. Member servers and client computers contact the www.syngress.com

7

Chapter 1 • Introduction to Active Directory

domain controller (DC) to access network resources. Because of their membership, a PDC or BDC in the domain can use the security database to authenticate users to access resources. A member server can use the security database by querying a PDC or BDC. A domain is logically established in the structure shown in Figure 1.2. Figure 1.2 The Components of a Single Domain Canc Next Can OK celel>

8

Cancel Next < >Back

Member Servers of Client Computers

Domain Controllers Windows NT Domain

Network Printers

Users

A domain is a security boundary, which means that if you need to separate one security set from another, you will need to have more than one domain. Using trust relationships, you could have multiple domains. A trust relationship is established between two domains. In order to enable users of domain A to access the resources such as the files and printers of domain B, domain B must trust domain A.When drawn out, this trust relationship is shown as an arrow pointing from the trusting domain to the trusted domain. Microsoft defines various models for a multiple domain structure: ■

Master Domain model All resource domains trust a single Master Domain that contains all user accounts.This is depicted in Figure 1.3.

■

Multiple Master Domain model All resource domains trust all Master Domains. Master Domains contain user accounts. Each Master Domain trusts all other Master Domains.

■

Single Domain model There is only a single domain that contains all users and resources.There is no trust relationship with other domains.

■

Complete Trust model All domains trust each other, regardless of whether they contain users, resources, or both.

www.syngress.com

Introduction to Active Directory • Chapter 1

Figure 1.3 Legacy Windows NT Master Domain Model Next Canc Can OK celel> Cancel Next < >Back

Domain Controllers Master

Network Printers

Member Servers of Client Computers

Users

Canc Next Can OK celel>

Canc Next Can OK celel> Cancel Next < >Back

Domain Controllers

Member Servers of Client Computers

Cancel Next < >Back

Domain Controllers Resource Domain

Resource Domain

Network Printers

Member Servers of Client Computers

Network Printers

Domains contain the rudimentary elements of a directory service.They enable multiple servers to look up information and use it for authenticating users and granting those users access to network resources. Although a domain is effective as a security model for a small or medium-sized organization, it does not have some of the features that a directory service can offer. An NT domain structure is flat rather than hierarchical like most directory services, which means that security cannot be applied at different levels. Since each domain is its own administrative area, the only way to implement distributed administration is to have multiple domains. Legacy NT domains require a significant amount of traffic between clients and the PDC or a BDC.These domains also require the security database to be copied from a PDC to the BDCs on a periodic basis.This traffic overhead is undesirable over wide area network (WAN) links that may have a limited amount of bandwidth available, or that are costly to transmit traffic across.To reduce this overhead, multiple domains can be created such that no domain spans a WAN link. Trust relationships between multiple domains become cumbersome as more domains are added. As a result, trade-offs may be made between WAN performance or administrative needs and domain structures. www.syngress.com

9

10

Chapter 1 • Introduction to Active Directory

Directory services were developed as a way to overcome single server and domain architecture limitations.They are usually organized in a hierarchical fashion, encompass multiple servers and resources, and offer fully distributed administration. Furthermore, directory services normally are established in an efficient database that is distributed throughout the network to prevent WAN overhead issues.

Designing & Planning… The X.500 Directory Standard Many directory services state that they are X.500 compliant. X.500 is a directory service standard ratified by the International Telecommunications Union (ITU-T) in 1988 and modified in 1993 and 1997. It was intended to provide a means to develop an easy-to-use electronic directory of people that would be available to all Internet users. The X.500 directory standard specifies a common root of a hierarchical tree. Contrary to its name, the root of the tree is depicted at the top level, and all other containers (which are used to create “branches”) are below it. There are several types of containers with a specific naming convention. In this naming convention, each portion of a name is specified by the abbreviation of the object type or container it represents. A user has a CN= before the username to represent its “Common Name,” a C= precedes a country, and an organization is heralded by an O=. When compared to IP domain names—for example, host.subdomain .domain—the X.500 version of CN=host/C=US/O=Org appears excessively complicated. Each X.500 local directory is considered a Directory System Agent (DSA). The DSA can represent either single or multiple organizations. Each DSA connects to the others through a Directory Information Tree (DIT), which is a hierarchical naming scheme that provides the naming context for objects within the directory. Although Active Directory is derived from the X.500 model, Active Directory does not implement all of the X.500 protocols because of the excess overhead involved or the lack of their general usage. These protocols include: Continued

www.syngress.com

Introduction to Active Directory • Chapter 1

■

Directory Access Protocol (DAP)

■

Directory Information Shadowing Protocol (DISP)

■

Directory Operational Binding Management Protocol (DOP)

■

Directory System Protocol (DSP)

Active Directory does implement the Lightweight Directory Access Protocol (LDAP), which affords an effective combination of DAP and DSP features without involving any excess overhead.

What Is in a Directory Service? A directory is a place to store information.The type of information that is stored in a directory falls into three basic categories: ■

Resources

■

Services

■

Accounts

Resources are the components attached to the network and made available to users. Examples of resources are: ■

A server’s hard drive

■

An IP address

■

A fax modem

■

A scanner

■

A printer

■

Any “thing” that can be used by a client workstation

Services run from a server and usually interface to the heart of the Network Operating System.They provide functions on the network, usually so that resources can be shared. Most services are simply network applications, such as a messaging service that allows users to send e-mail.These two categories typically are related. For most services, there is an analogous resource, and for most resources, there is an analogous service (see Table 1.1). Sometimes, however, a resource or a service stands alone.

www.syngress.com

11

12

Chapter 1 • Introduction to Active Directory

Table 1.1 Examples of Resources and Analogous Services Resource

Service that Supplies the Resource to Users

Server hard drive IP address Application Printer Messaging database Terminal Modem VPN Connection

File service Dynamic Host Control Protocol (DHCP) Application service Printing service Messaging service Terminal service such as Telnet FAX service Remote Access Service (RAS)

The final category in a directory is an account. An account is usually a logon ID and associated password used for access to the network. Groups work in a similar manner to user accounts. Directory services can contain a variety of other objects that are security principals, such as aliases. All objects that are used principally for logon or authentication to resources for a user fall in the account category. A security principal is an object that can be granted the right to use a service or a resource. Each resource, service, and account is stored as an object in the directory.The hierarchy within the directory service, along with some planning, offers a consistent way to name, organize, access, administer, and secure the network. A directory service, then, becomes the center of network operations for all servers providing services and resources, and for all client workstations and users requesting access to the services and resources.The information in the directory service manages how the services, resources, and accounts relate to each other. Each object in the directory service includes a set of properties, or attributes. For example, a user account property might be the city in which the user resides, or a DNS hostname would have the property for the IP address that host has been assigned. Each one of the attributes for a specific object in the directory can be given a value. For example, a user account property named “City” may have the value of “Paris” for the user account named “Joe.” Not all properties must be given values. Access Control Lists (ACLs) manage the security relationship between resources, services, and accounts. ACLs maintain a list containing the information about whether an account has been granted the privilege to access a given service or resource located in the directory. An ACL can even grant the privilege to access other accounts and their properties for administration purposes. www.syngress.com

Introduction to Active Directory • Chapter 1

A directory service may have one of three different structures: ■

A flat file, where all the elements are lumped together in a single group, and all rights and privileges must be granted explicitly

■

Multiple groups in a relationship with each other to provide a flowthrough path for rights and privileges

■

A hierarchical tree structure, where rights and privileges can be inherited through nested Organizational Units (OUs)

A well-planned organization of the directory service is critical to reducing administrative overhead. Administrative functions can benefit from a hierarchical structure, but only when it is organized to take advantage of the hierarchy. Even when a directory service has a hierarchical structure, if you don’t implement that hierarchy or don’t design it to reduce administrative functions, then the native structure does not offer any benefits.

The Directory Database A directory typically is implemented in the form of a database, or directory store. Databases have a specific organizational composition called a schema. A schema defines the types of objects and properties that can exist in the directory. The database store is distributed throughout an internetwork with partitions of it being placed on special servers known as domain controllers. Many times, these partitions are called replicas because there are copies of them on multiple servers for redundancy. A directory service that is distributed and copied across multiple servers enables the same information to be accessible to a person in Tokyo, Japan as it is to a person in London, England. Distributed directory services are highly effective, with replicas offering failover so that users can always log on or query the database from any network location. It would not be efficient if all people around the world were required to access a single server to find information.That situation would present serious bandwidth concerns, not to mention the fact that it presents a single point of failure if that one server went down. However, placing replicas on strategic servers throughout an enterprise network provides a method of access that does not overwhelm the network, as well as a method of fault tolerance. When there are multiple replicas of a database, they must be synchronized so that updates to the information are identical throughout the entire installed set. The process of synchronization of information between multiple hosts is usually

www.syngress.com

13

14

Chapter 1 • Introduction to Active Directory

called convergence.The more efficient a network is, the less time it takes for the network to be fully converged once a change has been made. Communication between the servers during convergence is handled best via a transaction-oriented database update protocol. A transaction-oriented database update protocol does not send entire copies of the directory across the network. Instead, as the name implies, it sends only the information changed due to some database transaction.This process is less time-consuming and bandwidth-intensive because only updates need to be changed throughout the replicas and not the entire database copied from server to server. Even when an object has a single property update, such as a change to a user account’s phone number, it is not necessary to copy the entire object with all its properties to each database replica. Instead, only the property value that changed needs to be updated along with enough information to locate the object for which the value has changed. For example, when a user is married, she may change her name.The Network Administrator would edit the Last Name property of the user account.The only information that must changed on the database replicas is that last-name property and the location of the user account object in the directory.This update-based replication will minimize the synchronization traffic on the network, as well as the processing burden on the servers running the directory service.There are two fundamental tactics when replicating databases: ■

Master-Slave All changes to the directory must first be made to a designated master server and then propagated to all slave servers. Although effective from a change management perspective since there is a single point of administration, this method provides a single point of failure in the event the master server were to fail.Windows NT domains used the Master-Slave tactic.

■

Multi-Master Any changes made to the directory can be made to any directory server, which then propagates that change to the remaining directory servers.This method provides fault tolerance and distributed administration. However, the Multi-Master method requires a way to handle conflicting changes in the directory.Windows 2000 Active Directory domains use the Multi-Master replication tactic to address this issue.

www.syngress.com

Introduction to Active Directory • Chapter 1

Directory Service Domino Effect When a directory service consists of a distributed database using Multi-Master replication and a hierarchical organization, it has a domino effect on the network’s management, dissolving administrative headaches suffered by networks that use Master-Slave replication and have a flat file structure.These benefits include: ■

Straightforward Administration It collapses the management for users, applications, and network devices into a single point, but can be administered from anywhere in the network.

■

Centralized Security It provides a single logon and consistent security mode throughout the network, reducing user administration.

■

Extensible and Interoperable It extends the capabilities of the network into the future. Not only is there a base of standards within the schema, but the schema can be extended to include new objects and properties. An extended schema may enable other systems, directory services, and applications to interoperate with the directory service.

As a result of the hierarchy and Multi-Master replication, more resources and services can take advantage of the directory service, making the entire network an open system.This model and its rewards are all representative of the Active Directory Service that is part of the Windows 2000 Server family.

Introduction to Active Directory Active Directory is the directory service provided with Windows 2000 Server products. Active Directory has the following characteristics: ■

It is a database that is distributed across multiple servers.

■

It uses a Multi-Master replication model to propagate updates throughout the network.

■

It has an extensible schema representing user accounts, group accounts, resources, and services as objects.

■

The database is organized in a hierarchical tree, which uses containers called Organizational Units (OUs) to enable rights and privileges to be inherited.

www.syngress.com

15

16

Chapter 1 • Introduction to Active Directory

Active Directory can provide a single directory and logon, its administration can be distributed, and the directory and its inherent security can be extended and scaled for small to large enterprises. Active Directory includes a few other features, too. Active Directory is an Extensible Storage Engine (ESE) database.This is the same type of database as that used by Microsoft Exchange Server. Exchange Server 2000 uses a newer ESE98 interface, whereas both Active Directory and Exchange Server 5.5 use the ESE97 interface. ESE allocates a database store of up to 17 terabytes and 10 million objects per domain. (One million objects is the recommended limit and approximate size of the largest tested number of objects per domain.) ESE efficiently utilizes only the disk space necessary to store the values for each object and its properties.When adding data to the data store, ESE uses the most rapid method possible; however, ESE gives up some database efficiency to do so.The data store can easily become fragmented. Active Directory does perform online defragmentation to rearrange data after it has been stored, plus it provides a utility NTDSUTIL to perform offline defragmentation. Offline defragmentation will not only rearrange the data, but it will also reclaim disk space from the directory store, which is a file called NTDS.DIT. ESE does not claim a full object’s space when the object’s values are not fully completed. If an object class has multiple attributes available for data, but an object of that class is created with values assigned to a couple of those attributes, then the ESE engine will acquire only the space necessary to store the values assigned. For example, if there is a user account object in which the phone number and address are not filled out, then no space is reserved in the data store for that information—only enough space to store what values have been assigned to the user object.

.NET Since many of the standards used with Active Directory are also Internet standards, Active Directory can be integrated into any Internet or intranet environment.The ability to extend the enterprise system into the Internet is one of the bases of Microsoft’s .NET strategy. .NET is based on Windows 2000 Server and extends to a host of services, as well as the .NET development framework. For developers, Microsoft provides a software development kit (SDK) for Windows 2000 and Active Directory that contains the Application Programming Interfaces (APIs) that a Web-based component can hook into.You can obtain SDKs and developer information for the .NET framework from the Microsoft Developer Network Web site at msdn.microsoft.com. Developers can use the .NET www.syngress.com

Introduction to Active Directory • Chapter 1

framework for integrating Active Directory into a Web solution. A program can use the native Active Directory APIs to hook a Web site into the Windows 2000 Active Directory. Since Web browsers are available on nearly every platform, this means that the Active Directory service can be universally accessible via the Web.

Protocol Interoperability Active Directory uses a naming convention that is similar to X.500, an Internet standard for directory service namespaces. Although not exactly an X.500 directory, Active Directory uses Lightweight Directory Access Protocol (LDAP), which was developed for use with X.500 directories and reduces the traffic overhead that is associated with the X.500 system. Being able to use LDAP and to support the X.500 naming model enables Active Directory to manage other, applicationspecific directories.To take advantage of this capability, you must integrate the directories via some protocol or API, and usually this means LDAP because LDAP commonly is used by many directory services.The future of Active Directory may eventually bring about a single logon and password that can be synchronized throughout various directories in an enterprise network, even though those directories might otherwise be incompatible. All of this is possible through the use of standard protocols for communications. One thing that you must be prepared for is using IP for all communications involving the directory service.This may be an issue for a network that primarily depends on another protocol stack. However, with today’s proliferation of Internet-capable systems, using IP natively across an enterprise network is not usually an issue.The reason that you must use IP is that Active Directory is dependent upon the IP protocol stack. In particular, it is entirely dependent upon DNS to help both servers and workstations locate Active Directory servers called domain controllers. The IP protocol stack, also called TCP/IP, consists of multiple protocols; the main two are the Internet Protocol (IP) and Transmission Control Protocol (TCP).The IP protocol assigns a logical address to each station on the network, so that they can be found.The 32-bit IP address is usually illustrated in dotteddecimal notation, a format of four numbers, each ranging from 0 to 255 and separated by dots. Each of the four numbers commonly is referred to as an octet. For example, 10.155.3.253 is an IP address.This format, though easier to remember than a string of 32 ones and zeroes, is not all that easy for humans to remember. Mnemonic systems usually associate a word to a visual, auditory, or tactile sensation in order to stimulate memory. Numbers are difficult to associate that way, and remembering multiple strings of numbers is difficult for an average Internet www.syngress.com

17

18

Chapter 1 • Introduction to Active Directory

user.To make it easier for people to remember which server is which, host names were given to the server.To make certain that the user could access the host using a host name, a file named “hosts” was placed on each computer, associating the host name of a computer to its IP address.This way, the user could access the host using a host name rather than having to remember the 32-bit numerical address. If a user needed to access a new computer, the user or the administrator had to update the host file with the new host name and IP address, or the user still was forced to use the IP address. After some time, it became obvious that managing multiple host files was time-consuming and tedious.Thus, DNS was born. DNS was developed to provide a central, hierarchical directory for IP addresses that reduced the host name-to-IP address management by reducing the number of machines that needed to be managed. Assuming network clients are utilizing DNS, a user simply can enter a host name and the computer queries its DNS server for the IP address. If the host that the user is trying to access is not listed on that server, the DNS server can pass the DNS query up to other DNS servers within the DNS hierarchy to a server that does have that listing for Name resolution. It takes only a short time for DNS to respond because of its well-organized hierarchy. In fact, the system is so transparent that most users are unaware that this host name-to-IP address translation is taking place each time they type in a new Universal Resource Locator (URL) into their Web browser. Active Directory depends on DNS to locate domain controllers on the network through a special type of DNS record that maps a service to an IP address.This type of record is called a Service Location Resource Record, or SRV RR for short.

Single Point of Administration Being able to manage the network from a single location reduces time and effort for administrators. Instead of logging off one server and then logging onto another, or even moving physically from one management station to another, all Active Directory servers, resources, and accounts are stored in a single location. An administrator can create custom Microsoft Management Consoles (MMCs) to provide quick access to the information that the administrator uses most, or the administrator can use the standard consoles provided with Windows 2000 Server. The reason that administrators no longer need to log off one server and onto another is partially due to Multi-Master replication, in addition to the MMC. Active Directory domains no longer use a PDC or BDCs because they have changed to a Multi-Master architecture in which all copies of the Active Directory database are maintained on DCs that are peers of each other.This www.syngress.com

Introduction to Active Directory • Chapter 1

means that a single Active Directory database is the repository for multiple published resources and can be administered from the same application using any replica of the Active Directory database through Multi-Master replication. Therefore, when an administrator logs onto a DC in a particular domain, it doesn’t matter which DC, because all the data will be converged at the time specified for synchronization. Active Directory brings about the concept of published resources. Published resources reduce time and effort for end-users. A published resource can be a file, network device, access sessions to mainframe and minicomputers, databases,Web services, and any other resource or service that is installed into Active Directory and secured for user access. Publishing a resource means that a user can execute a simple query to locate the resource anywhere on the network. In the case of printers, this capability is very powerful—printers can be published with information about their features. For example, a user can look for a printer in a particular building with the ability to print in color and duplex. If such a printer is published, the user’s query is returned with any information. Administrators can customize printer location with maps, if such are required. The NOS Windows 2000 Server is the network operating system (NOS) that is seamlessly integrated with Active Directory.Windows 2000 Server is scalable at the server level, with three products—Windows 2000 Server,Windows 2000 Advanced Server, and Windows 2000 DataCenter Server—that support different sizes of server equipment, as shown in Table 1.2. Active Directory takes the scalability of the Windows 2000 Server family of products and raises it to the network level, since multiple Windows 2000 servers of varying types (whether Advanced, DataCenter, or standard Server) can all participate in a single Active Directory. Table 1.2 Scalability of Windows 2000 Component Number of processors RAM (Intel servers) Network load balancing Clustering

Windows 2000 Server

Windows 2000 Advanced Server

Windows 2000 DataCenter Server

4

8

32

4GB

8GB using Physical Address Extensions Up to 32 nodes supported Up to 2 nodes in a failover group

64GB using Physical Address Extensions Up to 32 nodes supported Up to 4 nodes in a failover group

Not supported Not supported

www.syngress.com

19

20

Chapter 1 • Introduction to Active Directory

Active Directory Architecture Active Directory is not automatically part of the Windows 2000 Server installation process, although the capability is available should you need it.When a Windows 2000 Server (any version) is installed as a new install, by default it becomes a member server of a workgroup or domain. (Upgrades are handled differently if a Windows NT PDC or BDC is being upgraded to Windows 2000. In the case of upgrades of an NT PDC or BDC, the installer is prompted to upgrade the domain to Active Directory. If that did not occur, all information from the former domain would be lost.) Member servers use a security architecture identical to the Windows 2000 Professional client workstations, in which they have a flat file local database with a set of local users and groups.This does not allow other servers or workstations to share in that security database. In fact, it hearkens back to the days of a servercentric network.The flat file database allows local users and groups, as well as shared local files and printers, in a server-centric model. Only when a member server or client workstation joins an Active Directory domain can it participate in Active Directory.When a client workstation or member server joins a domain, that server-centric local database remains. However, if a member server is upgraded to a Domain Controller, the local database is removed. When a Windows 2000 Server joins an Active Directory domain as a member server, it can communicate with any DC for Active Directory security information. Domains are configured as top-level containers in a tree structure that is created through trust relationships and uses DNS naming. Domains sharing a contiguous DNS namespace are organized into domain trees. A contiguous namespace means that the domains are linked via the DNS names. For example, a domain named root.com and its subdomain named trunk.root.com are both part of the same contiguous namespace. However, a domain named trunk.com is not part of that contiguous namespace, and in fact, forms the basis for another domain tree.There can be multiple domains in Active Directory either with or without contiguous namespaces. Multiple domains with different namespaces that participate in a single Active Directory commonly are considered a forest of multiple domain trees, as depicted in Figure 1.4. However, it is important to note that a domain on its own can be its own forest. Internal to each domain, Active Directory provides OUs to create a tree structure.The OU tree is unique to each domain, and completely configurable by an administrator.Within the OU containers, Active Directory enables the administrator to create objects that represent user accounts, network services, and www.syngress.com

Introduction to Active Directory • Chapter 1

resources such as users, groups, workstations, and printers.The result is a logical structure that can be scaled to any enterprise of any size and organizational formation. Figure 1.4 Active Directory as a Forest of Trees Two-Way Transparent Trust

Domain A

Domain B

Forest Subdomain A

SubSubdomain A

Designing & Planning… Multi-Master Replication Multi-Master replication occurs when a change is made to any object within a replica of the Active Directory database on any DC is updated automatically on all the others. In an Active Directory domain, each DC is a peer to all the other DCs. Furthermore, replication of forest-wide information, such as the schema and configuration, occurs between all DCs in the forest. And Global Catalog replication occurs between all Global Catalog servers in the forest. This replication does not happen by all servers talking to all the other servers at once. In fact, Multi-Master replication is a controlled Continued

www.syngress.com

21

22

Chapter 1 • Introduction to Active Directory

process. Changes are replicated across a replication topology created within a designated physical location called a site, but can also be replicated to other sites through what is best described as bridgehead servers. A bridgehead server is a server in the network that is designated to send and receive replication traffic from other domain sites so that there is a management method to the traffic direction on the network. Using bridgehead servers enables the network designer to direct how replication traffic traverses the internetwork. Active Directory can use two transports for this replication traffic: ■

RPC Synchronous replication of any Active Directory updates via Remote Procedure Calls (RPCs) over Transport Control Protocol/Internet Protocol (TCP/IP).

■

SMTP Asynchronous replication of only forestwide information (schema, configuration, and Global Catalog) via the Collaborative Data Objects (CDOv2) interface to Simple Mail Transfer Protocol (SMTP).

Note that SMTP is used only for forestwide information. That means that you cannot use SMTP between two sites that are spanned by a domain. Keep in mind when designing your bridgehead servers that RPC communication is appropriate for most LAN and WAN connections between sites. However, SMTP communication is most effective for lowspeed WAN connections, such as remote access connections over modems between sites. Because of this, you should rarely come across a need to use SMTP between sites, and should avoid it if possible, since it will restrict your ability to place domain controllers.

Security is of great concern to companies who connect their private networks to the Internet.The hierarchical structure in Active Directory is a perfect basis for a flexible security service. Active Directory can secure objects using services such as Public Key Infrastructure (PKI) and can even extend to Smart Card technologies.The security protocol named after the dog that guards the gates to Hades in Greek mythology, Kerberos, is used for trust relationships and is the default authentication protocol in Active Directory. LDAP can be used over Secure Sockets Layer (SSL), which extends Active Directory security into the Internet. Some of these types of services integrate as objects, such as PKI certificates, in the authentication process using Smart Card technologies, and in extended properties of account objects so that they can support extra security requirements. In addition, you can find extensive security administration www.syngress.com

Introduction to Active Directory • Chapter 1

capabilities in Group Policies implemented within Active Directory.The Active Directory architecture enables it to become the central authority for authentication and access control to the entire network and even the Internet.

Namespace A namespace is any dataset in which a name can be looked up and resolved.This broad definition includes all directory services, from DNS to Active Directory. And since Active Directory depends on DNS, the namespace used is based on DNS at the domain level. Internal to a domain, names are located using X.500 type conventions. Name resolution is the process of looking up a name and finding its properties.You can have reverse resolution in which you look up an object’s properties and find a name. In DNS, a name of a computer, called a host name, is resolved to the computer’s IP address. In Active Directory, the name of any object (whether it is a user account, resource, or service) is resolved to that object itself. Once a user or even an application resolves the name to the object, the user or application can browse the object’s property values, if permitted to do so. If that user or application has security access, it can even manipulate the values of those objects. As mentioned before, the Active Directory namespace is directly related to DNS. Each domain is granted a DNS domain name.

SECURITY ALERT! Whenever defining a namespace in Active Directory for an internal, private network, do not use the same namespace that is used on the Internet. This will avoid name resolution problems when users are connected to both the private network and the public Internet network. It will also avoid some security issues. For example: If your namespace on the Internet is company.com, then the namespace on the private network could be either mycompany.com or corp.company.com to satisfy this design requirement. You can, of course, design your network to use the same namespace on the private and public networks, but it is not recommended due to the possible security breaches and problems you might encounter.

www.syngress.com

23

24

Chapter 1 • Introduction to Active Directory

Forests As mentioned earlier, a forest is a set of domain trees that share a common schema, configuration, and Global Catalog (GC).The forest usually is referred to by the name of its root domain. It exists as a set of domain trees that trust each other via transitive and hierarchical trust relationships using the default Kerberos security trust model automatically implemented by Active Directory. Figure 1.5 depicts a forest. Figure 1.5 Multiple Namespaces in a Forest Tw Trans o-Way itive T rust

root.com

mica.com

tree.root.com

my.mica.com

branch.tree.root.com

Namespace for MICA.COM

Namespace for ROOT.COM

Forest known as ROOT.COM

Scope The scope of an Active Directory is the portion of the internetwork that it covers. The scope defines the limits of a single Active Directory forest.The scope includes: ■

All the internetwork components that participate in Active Directory

■

All the LAN and WAN connections

■

All domains that participate in the Active Directory forest

www.syngress.com

Introduction to Active Directory • Chapter 1 ■

All accounts created in the various domain trees

■

All resource and services provided by servers in the domains

■

All computers that have joined any domain

In a lab environment, for example, an Active Directory scope is typically small, encompassing a few Windows 2000 servers and workstations and hardly any representative user and resource objects. It would not typically include any WAN connections. But Active Directory is scalable to a large enterprise internetwork that includes thousands of servers, millions of users and resource objects, and multiple WAN connections.

Distinguished Name Each object has a name that represents it in the Active Directory tree.The name for a server would be its DNS name, such as server.company.com.The name for a user account would be the simple logon name. For example, in a company with a naming convention for users that specifies the first letter of the first name concatenated with the first five letters of the last name, the name of a user object representing Benjamin Johnson would be BJOHNS.This type of name should be unique within any single domain. In accordance with the X.500 model, each Active Directory object possesses a distinguished name (DN).The DN identifies the object by its name, and includes the trace of all of the containers above it with their respective names, until the top of the tree is reached. Each DN is unique within a forest, even if multiple objects have the same name in different domains. For example, Benjamin Johnson with the name BJOHNS can exist in the Panther domain, while Beverly Johnston, also with the name BJOHNS, can exist in the Cheetah domain, as shown in Figure 1.6.They may appear to have identical names, but in Active Directory their DNs are different because they include the domain name as part of the DN: /O=MicroAge/DC=Cheetah/CN=Users/CN=BJOHNS /O=MicroAge/DC=Panther/CN=Users/CN=BJOHNS The relative distinguished name (RDN) of any object is the part of the DN that represents the object. In the example for Beverly Johnston in the Cheetah domain, her DN is /O=MicroAge/DC=Cheetah/CN=Users/CN=BJOHNS, and her RDN is CN=BJOHNS.The RDN is typically the simple name of the object. www.syngress.com

25

26

Chapter 1 • Introduction to Active Directory

Figure 1.6 Tracing DNs through the Active Directory Tree

O=MicroAge Active Directory MicroAge Forest

DC=Panther Panther Domain

CN=Users Users Container

CN=BJOHNS BJOHNS Benjamin Johnson

DC=Cheetah Cheetah Domain

CN=Users Users Container

CN=BJOHNS BJOHNS Beverly Johnston

User Principle Name The user principle name (UPN) is a naming format that uses a domain name as part of the username. Essentially a UPN provides a single logon for a user, using the e-mail address format for that user. Since DNS is provided in Active Directory as the locator service, incorporating the domain name as part of the www.syngress.com

Introduction to Active Directory • Chapter 1

username means that user objects are easily located and authenticated.This can facilitate the logon process for users who roam from site to site. Additionally, the UPN format—[email protected]—can be identical to the e-mail address for that user, making it easier for that user to remember. The use of UPNs for logon is optional.The traditional logon format where the user logon name, password, and domain must be entered in separate textboxes is still available in Windows 2000. UPN usage requires that each user account name is unique within Active Directory. If both Beverly Johnston and Benjamin Johnson had user account names of BJOHNS because of the naming convention, they would have a name conflict with the UPN format, because they both would be known as [email protected]. If you are using Active Directory with Internet Information Services, you can use UPNs to log on to the Web site.This takes a little bit to set up if your Web site uses the Basic Authentication method: 1. Click Start | Programs | Administrative Tools | Internet Services Manager. 2. Click on the Plus (+) to expand your Web site(s). 3. Right-click the Web site where you want to enable UPNs and click Properties in the pop-up menu. 4. Click on the Directory Security tab. 5. In the Anonymous Access and Authentication Control area, click on Edit. 6. Check the box to enable Basic Authentication and disable the other forms of authentication. 7. Click on Edit next to Basic Authentication. 8. Under the Domain Name section, insert the backslash symbol ( \ ). 9. Click OK, until you’ve exited the properties dialog.

Partitions A naming context is also known as a partition because it is the part of the Active Directory database that is replicated.There are three types of naming contexts: ■

Schema The schema is the description of the types of objects and properties that are available throughout the Active Directory database.

www.syngress.com

27

28

Chapter 1 • Introduction to Active Directory

The schema must be identical on all DCs so that objects and their properties can be recognized from any point in the internetwork. ■

Configuration The configuration of Active Directory is principally the method of replication and any Active Directory database descriptor information.The method of replication must be known throughout the internetwork so that DCs know where to send updates within domains, and when to send updates outside of the domains. Descriptor information includes information about the shape of the Active Directory itself, such as which domains are connected to which other domains through what bridgehead servers.

■

Subtree Subtree information is a contiguous set of database objects. Subtrees typically are separated at the domain level.This information must be replicated in order for authentication and access control to function properly.

Global Catalog The Global Catalog (GC) is a listing, or index, of the objects within Active Directory. As an index, the Global Catalog does not contain every value for every property of an object. It contains only enough information to find the object and perhaps a few oft-queried property values. For example, if all the users in a network query the Active Directory to find peoples’ telephone extensions, the value of the phone extension property can be placed in the Global Catalog to enable quick access to that information.When a property value is not in the Global Catalog, then there is enough information about the object to locate a replica of the Active Directory partition, which contains the object without the querying user or application needing to know the location of that object within the Active Directory hierarchy. Of course, the user or application will need to know one or more attributes of the desired object to perform the query. Because the Global Catalog is so essential to queries, it is a good idea to plan their placement and their contents carefully.The more information that is placed in the Global Catalog, the slower the performance of replication and authentication (when concerning group memberships). However, if not enough information is placed in the Global Catalog, the performance for user queries is slower. Likewise, if there are too many Global Catalog servers, then replication traffic increases, and if there are too few Global Catalog servers, then user queries, logons, and authentication suffer. Good planning and a little testing can determine the right balance for your network. www.syngress.com

Introduction to Active Directory • Chapter 1

Object An object is a representation of a user, resource, or service within the Active Directory database. Each object is described by a set of properties, or attributes. Each property has a corresponding value. An object typically appears as an icon in a management console, and when you right-click on it, you can look at the values of its properties. Some objects do not appear in the various management consoles, because they are not intended to be managed.Table 1.3 lists examples of various objects and their analogous properties and values. Table 1.3 Relationship between an Object, Its Properties, and Values Object

Property

Value

User User Server Server Printer

E-mail address First name Name DNS name Type

[email protected] George SERVER01 Server01.mycompany.com HP Laserjet 5si

Container A container is an object in the directory that simply contains other objects. Containers are similar to folders in a file system. Container objects can contain other containers in the same way that a file system folder can contain other folders. A container does not represent any user, service, or resource, but it does have its own attributes and values. Instead, a container is what shapes Active Directory into a tree structure. Both domains and OUs are examples of containers. In Active Directory, containers are not security principals.You cannot apply rights to the containers and have those rights flow through to the objects contained within them. Users of Novell Directory Services consider this a limitation to Active Directory, since Novell Directory Services can be configured this way. If you wish to have the same functionality, you can mirror the OUs with groups, placing all OU objects within those groups and nesting the groups. It takes some considered planning, especially to ensure that your rights inheritance mirrors your OUs. However, the same result can be obtained.

www.syngress.com

29

30

Chapter 1 • Introduction to Active Directory

Domains The domain is a group of Windows 2000 computers that participate in the same security subtree. Active Directory consists of one or more domains. Each domain can span both LAN and WAN links, depending on the network design and subsequent domain implementation. Multiple domains can exist on the same LAN. When there are multiple domains using different namespaces in Active Directory, it is considered to be a forest of domain trees.This forest must enclose domains that share a common schema and configuration.They produce a GC of users, services, and resources.

Domain Trees A tree is a hierarchical organization of containers and objects.The tree is similar to the entire file system on a computer’s hard drive.The tree has multiple branches created with nested containers. Nested containers are similar to folders in the file system.The ends of each branch are objects that represent users, services, and resources.These objects are analogous to the files inside containers. The domain tree is a group of contiguous domains that share a common schema and configuration, and are united by trust relationships to create a single namespace. Active Directory can contain one or more trees, which can be depicted via their trust relationships or via their namespace.

Viewing Trust Relationships Trust relationships are the connecting points in a domain tree.To show this relationship, a logical structure of each domain with arrows shows the explicit trust relationships between domains, and any implicit trust relationships that result from them. Active Directory uses the Kerberos security protocol to establish trust relationships between domains.The Kerberos trusts are transitive and hierarchical. The hierarchical trust relationship in Kerberos is such that domains using the same namespace as others automatically are trusted by their subdomains. Transitive trusts are those that flow between multiple domains where A trusts B, B trusts C, and it is implied that A trusts C. A sample trust relationship set is shown in Figure 1.7.

www.syngress.com

Introduction to Active Directory • Chapter 1

Figure 1.7 Viewing Implicit and Explicit Trust Relationships Calico st t Tru

Implic

Expl icit T r

ust

lici Exp

it Trus

t

Tabby

Persian

NOTE Transitive trusts are new to Windows 2000. The legacy Windows NT trust relationships were nontransitive. In the legacy Windows NT domain architecture, for example, the Tabby domain can trust the Calico domain and the Calico domain can trust the Persian domain, but the Tabby domain does not automatically trust the Persian domain. However, in the Windows 2000 architecture, trust relationships are transitive. In this architecture, and using the Tabby -> Calico->Persian trust relationships, there is a new transitive trust relationship in which the Tabby domain trusts the Persian domain.

Viewing the Namespace The namespace is a logical representation of the domain tree using its domain name hierarchy.This method is related to DNS, which is deeply infused in Active Directory as a locator service.The namespace method traces the domain names in a contiguous hierarchy. Figure 1.8 shows how a namespace can be depicted.

www.syngress.com

31

32

Chapter 1 • Introduction to Active Directory

Figure 1.8 Viewing the Namespace

domain.com sub.domain.com

sub.sub.domain.com

Sites Think of a site as a geographically based location for servers.The official definition for a site is one or more IP subnets that share a fast and reliable connection. It is recommended that a site consist of links with greater than 512 Kbps of available bandwidth. Available bandwidth is the amount of bandwidth that is not being used by other network traffic. If a link exists for a T-1 line of 1.44 Mbps, it would appear that it has more than enough bandwidth to meet this recommendation. However, if that T-1 line was saturated with network traffic, it would not be sufficient. You can configure sites any way that you wish. If you add IP subnets to a site, and then decide to move them to their own site, that is fine.The nice thing about sites is that they grow and change to match your physical network. Site definition is vague enough to allow a site to encompass WAN links; however, a site is best configured as one that contains only LAN connections that are less likely to become saturated with network traffic.The servers that are placed in a single site are configured automatically for replication to each other. If those servers are connected only with high-speed reliable links, then the replication traffic can take advantage of the physical network. Authentication traffic also takes advantage of site configuration.When a user logs on to the Active Directory, the workstation will try to locate servers in the same site as the user first, then try other servers in other sites next.The local site is determined by the IP subnet in which the workstation exists. It looks up a server that is in a site that contains that IP subnet in order to log on.Taking advantage of a physically close server, and a fast connection, makes the user perceive a higher performance from the network. www.syngress.com

Introduction to Active Directory • Chapter 1

Architecture Architecture implies structure and building of something. So how do you construct an Active Directory? The way answer to that question is any way that will fit your organization.The way that Microsoft developed Active Directory provides a flexible model that can incorporate any type of physical internetwork and any type of logical organization.The network impacts the Active Directory Service design in four ways: ■

Data model

■

Schema

■

Security Model

■

Administration Model

Data Model The data model for Active Directory is derived from X.500, but is not identical to it.When X.500 was first implemented, it was discovered to have some significant overhead issues in its use of OSI protocols encapsulated in TCP/IP. Later, LDAP was developed to access an X.500 directory and avoid the overhead, which is why its name begins with the word “lightweight.” Active Directory uses a similar data model and the LDAP protocol to gain the best of the X.500 directory standard and avoid the worst. The Active Directory data model provides for a hierarchical directory that uses objects to represent services, resources, and users. It further enables attributes to describe the objects.This hierarchy, however, can be created for any type of enterprise, and can be developed to encompass both a physical structure and a logical organization of the users and groups within the enterprise.

Schema The schema defines what types of objects can be stored in a specific Active Directory. For example, an extremely simple schema might define three object classes as a server, an OU, and a user. Each of these object classes would have attributes such as the server IP address, the OU name, and the user e-mail address.When an actual server, OU, and user object are created, those attributes are given values.The value for the server IP address attribute might be 10.10.10.5, the value for the OU name attribute might be HQ, and the value for the user

www.syngress.com

33

34

Chapter 1 • Introduction to Active Directory

e-mail address attribute might be [email protected] is summarized in Table 1.4. Table 1.4 Schema Objects, Attributes, and Values Object Class

Object

Attribute

Value

Server Organizational unit User

Server.domain.com CN=HQ

IP address Name

10.10.10.5 HQ

USER

E-mail address

[email protected]

The Active Directory schema can be extended to include additional objects. For example, a backup program that is written to take advantage of Active Directory could add an object class for the backup service and add an attribute to the server object class to enable it as a backup service provider or a backup service requester.The schema must be updated across all the DCs that contain a replica of Active Directory in order for those objects and properties to be recognized and administered from any point in the internetwork. The Active Directory schema is stored within the directory itself.This reduces the overhead involved with users or applications that run queries on the Active Directory. It also allows the schema to be extended dynamically, with immediate access to the new object classes and attributes.The ability to perform schema extensions is protected by ACLs so that only authorized users can extend the schema.

WARNING When an application that extends the schema is installed on the network, the application will require the name and password of a user that has the capability of extending the schema. Otherwise, the installation will fail.

Security Model When a Windows 2000 server joins a domain or becomes a DC, it automatically begins participating in the Active Directory. Active Directory uses the Kerberos security model. Active Directory uses Kerberos version 5.0, an authentication www.syngress.com

Introduction to Active Directory • Chapter 1

protocol that was developed by MIT and is published by the IETF in RFCs 1510 and 1964. Using Kerberos, Active Directory can verify the identity of any user, service, or resource on a network that without this verification would otherwise be unprotected from public use. Kerberos does not rely on the NOS to authenticate and does not trust specific IP addresses, which are both common security methods in use today. Instead, Kerberos uses credentials to verify identities. Once an identity is authorized to access the directory, the security within Active Directory takes over. In the Active Directory itself, ACLs are defined by the administrator to allow any user, resource, or service to access any other user, resource, or service.The ACLs are flexible enough to enable access to use a service or resource, or even to change the values of their attributes.

Administration Model Active Directory allows an administrator to delegate authority to segments of a domain. In the legacy domain model for Windows NT, the administrator delegation level was set for an entire domain, regardless of the groups and organizations that participated in the domain. Now, with the ability to segment a domain into a hierarchical tree structure using nested OUs, the administration model can be set to whichever level best suits the enterprise.The result is that an administrator is granted an appropriate area of control.

www.syngress.com

35

36

Chapter 1 • Introduction to Active Directory

Summary There are all sorts of directory services available on networks.These range from vendor-specific directories to directory service standards, and can include flat files and hierarchical tree structures. A directory service, however, is simply a repository that is available for network participants to obtain information about users, services, and resources, or to obtain client configuration information from various servers on the network. Exchange Server, Novell Directory Services, Domain Name System, and Banyan Vines are all examples of different types of directory services. The Active Directory Service (Active Directory) was developed by Microsoft to provide a best-in-class directory service solution to the new Windows 2000 Server family. Active Directory is implemented as a distributed database using Multi-Master replication. It provides a hierarchical tree structure that supports delegated administration and can scale from small networks to enterprise internetworks. Active Directory consists of many components. A namespace is the DNS name structure of subdomain.domain.com, whose root domain name can be shared by domains through subdivision by subdomains.This namespace is used by domains, which are each a logically organized set of computers and users and other resources that participate in a single domain namespace, schema, configuration, and Global Catalog (GC). A root namespace can develop into a domain tree.This domain tree is an ordered group of domains that share the same root domain namespace, but differ by the use of subdomains, and have the same schema, configuration, and GC. A forest is a set of multiple domains that have multiple namespaces among them, but share the same schema, configuration, and GC. Each domain has its own hierarchy, which is developed by organizational units (OUs). An OU is a container for objects within a domain that can be nested into a tree structure. OUs can contain objects. An object can be a user account, service, or resource that is represented within Active Directory. Objects have attributes that are assigned values to describe each one specifically.The types of objects that you find in an Active Directory are described by the schema, which is the set of objects and their attributes that can possibly exist within a single Active Directory forest.To manage replication, Active Directory provides for sites. Each site is a set of IP subnets that define a physical location for servers. The Active Directory Service encompasses both the physical structure of the internetwork and the logical structure of the enterprise organization. In order to

www.syngress.com

Introduction to Active Directory • Chapter 1

prepare for an Active Directory implementation, both of these areas must be fully documented and understood. Once this information has been gathered, it should then be reviewed for the impact it may have on the Active Directory design. In this way, the optimal design for Active Directory can begin to take shape. See Chapter 4, “DNS and Naming Strategies,” for more on design.

Solutions Fast Track Introduction to Directory Services  Directory services have been used in networking for a variety of

purposes, such as name resolution or user account location.  A directory service is used primarily for organizing, locating, and

managing network information.  Directory services enabled networks to move from server-centric

management to an enterprise-wide view.  The Internet uses the Domain Name System (DNS) for name resolu-

tion. DNS is a directory service developed specifically to translate Internet Protocol (IP) addresses to computer host names.  Directory services consist of a database that is distributed to multiple

servers.The database contents are controlled by a schema, which describes the type of objects contained in the directory service.

Introduction to Active Directory  Active Directory is the name for the directory service included with

Windows 2000 Server products.  Active Directory is based on Internet standards, such as Kerberos and

Lightweight Directory Access Protocol (LDAP), which makes it easy to integrate with the Internet.  Windows 2000 Server is the basis of Microsoft’s .NET strategy, and

Active Directory is the directory service incorporated into that strategy.

www.syngress.com

37

38

Chapter 1 • Introduction to Active Directory

 An Active Directory forest is made up of one or more domains. All

domains within a forest share a common schema, configuration, and global catalog.  The schema describes the objects that can exist within Active Directory.

The configuration describes its physical organization, and the Global Catalog provides an index of the objects existing within each domain.

Active Directory Architecture  Active Directory uses Multi-Master replication, in which all domain

controllers are considered peers, and updates to objects are synchronized across them.  Each domain creates a separate namespace and partition.This partition is

replicated on each domain controller within a single domain.  A domain controller can hold only one copy of the domain partition.  Kerberos is used for authentication to the Active Directory. It is also used

for bidirectional, transitive trust relationships between Active Directory domains.  Using organizational units, an administrator can delegate administrative

capabilities at a granular level to other users.

www.syngress.com

Introduction to Active Directory • Chapter 1

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: What is the difference between the legacy NT PDC and BDC and the Windows 2000 DC?

A: The legacy PDC is a single master of the domain database.The legacy BDC is a slave to the master in its own domain. All changes must be made at the PDC, which makes it a single point of failure. If the PDC goes down, any BDCs on the network are available with a read-only copy of the security database. If changes must be made to the security database, one of those BDCs must be promoted to the PDC, or the PDC must be brought back online. In Windows 2000, each domain controller (DC) holds a read-write copy of the Active Directory.The architecture uses Multi-Master replication between all DCs. Changes can be made to any DC and then replicated throughout the internetwork.

Q: I have a test network and a production network. I want to make sure that users do not see my test lab users when they query the Global Catalog (GC). Should I put my lab servers in the same forest as the production servers?

A: Not if you want them to have a different GC. Since a forest shares the same schema, configuration, and GC, the test network should not be part of the same forest as the production network. If testing a new application that extends the schema, using a different forest will prevent extra objects and attributes from being added to the production schema.The configuration can be changed for the test forest without impact on the production network by using separate forests. Finally, a separate test forest will prevent test users from showing up in the GC.

www.syngress.com

39

40

Chapter 1 • Introduction to Active Directory

Q: Our company has an Internet site called company.com, and we are planning to add an intranet site.We want the intranet to use Active Directory security mechanisms. Can we use the same namespace for the intranet?

A: It is not recommended to use the same namespace for internal resources (the intranet) as for external resources (the Internet site). It can cause problems with Active Directory since it uses DNS for its locator service.There are two options: either use a subdomain (sub.company.com), or use a different namespace altogether (mycompany.com).

www.syngress.com

Chapter 2

Assessing Your Environment

Solutions in this chapter: ■

Defining Your Business Objectives

■

Assessing Your Current Environment

■

Gathering Information for Your Active Directory Planning and Design

■

Planning for Your Implementation

 Summary  Solutions Fast Track  Frequently Asked Questions

41

42

Chapter 2 • Assessing Your Environment

Introduction Planning is fundamental to implementing Active Directory.To create a viable plan, you must first assess the environment into which you will be placing an Active Directory structure, and have a clear idea of what you intend to accomplish once your design is complete.To use a cliché, you need to know exactly where you are today, and where you want to be tomorrow.Then all you do is write down the steps that it will take to get from today to tomorrow. Perhaps it isn’t as simplistic as that sounds. The best place to start is to envision the future state of your network. For some, this is easy. For others, a consultant can be a great help.The future state of the network should reflect the future state of the marketplace and business objectives that your company will have at that time. For a stable marketplace and for a company with a well-defined product and/or service set, the future is not too much different from what the company does today—the future state would most likely be easier, faster, better, or executed with lower costs. But for a fast-paced marketplace, or for a company with a constantly changing and growing product and service set, the future state is a moving target. Defining what the future will be like and meeting that future with Active Directory can take a lot of creative thinking! That future state of the network is almost like writing your technology dreams on paper. Imagine what the company would be like if: ■

You fixed all the problems that are currently being experienced.

■

You increased productivity.

■

You gave a certain business unit a functionality that they’ve wanted for years.

■

You finally dumped that ancient piece of equipment and those tired processes for a different way of doing business.

Visualizing the future state of your network may seem a lot like daydreaming, but it is actually referred to as envisioning. Consultants are sometimes brought in to perform this process for IT projects because it does involve some knowledge of what technology could provide, as well as some knowledge of what you need to accomplish, along with a creative imagination. Of course, when a consultant is brought in to perform envisioning, they have to learn about your business first to do an effective job. Once a vision is stated, you can define the individual business objectives that will guide the project, assess your current environment, and plan

www.syngress.com

Assessing Your Environment • Chapter 2

the steps that will take your network from its current state to the future with Active Directory and Windows 2000.

Defining Your Business Objectives The business objectives for your Active Directory should be the guiding force behind every decision that you make in the planning and execution of the project. If you are adept in managing the project to meet your company’s business objectives, then your project will be considered successful.This is an excellent reason to define your business objectives before you get to work on your project. But consider what would happen if you did not define and document your business objectives before you began the project. Likely at some point during the project’s execution, someone assumed that there was a different business objective for the project than the one you envisioned.The likelihood of reaching that other person’s business objective is very small, and as a result your project may be considered a failure. If several different people have several different perceptions of the project’s business purpose, then this failure compounds. Documenting your business objectives is a must to be successful. Most IT projects are a lot like target-practice—you need to know where the target is in order to hit it. There is nearly always an early, strategic vision that someone had in suggesting a Windows 2000/Active Directory project. Perhaps that person thought the new technology in Active Directory would give the company a competitive advantage. Perhaps that person urged the company to consider Active Directory because of its support for encryption, which would secure sensitive data. Perhaps that person wanted to reduce the complexity of the network and reduce administrative overhead with the larger sized domains that Active Directory will support (up to 10 million objects) compared to Windows NT domains (up to 40,000 objects). Perhaps the person simply imagined that all users would have a single sign-on, and without knowing whether Active Directory could fulfill this vision, Active Directory was suggested as a project that could achieve it.Whatever reason was suggested originally, you should document it as your initial vision statement along with your own envisioning results.Then, you follow a three-step analysis: 1. Interviews and data collection 2. Analysis and Prioritization 3. Selection

www.syngress.com

43

44

Chapter 2 • Assessing Your Environment

When you start defining the business objectives, look at every aspect of the business that Active Directory will touch and then interview all the people who handle those aspects.The Active Directory, as a directory service, generally will incorporate users from throughout the company; therefore, you should discuss the project with each business unit leader, and possibly a few key persons in each of those business units. In order to collect a consistent set of data, write down a set of questions to ask each person you interview.You may use individual interviews, group interviews, facilitated conferences, surveys, and questionnaires to gather this data. Ask for the following types of information: ■

What does the interviewee consider to be the motivation for the project?

■

What resources will this business unit inject into the project?

■

How will the project affect the vision or mission of the company/ business unit?

■

What is the perception of the strengths, weaknesses, threats, and opportunities brought about by the project?

■

What are key performance measures for the project? What are key financial measures for the project?

■

What technology or process is being used that may be affected by the Active Directory project?

■

Will the project affect core competencies of the company/business unit? How?

■

What affect does the business unit expect the project to have on its intellectual property, assets, and human resources?

■

Are there any existing Active Directory projects, plans, or rogue domains for this business unit?

■

Does this business unit have any objectives already established for Active Directory?

Not all of these questions will result in an individual business objective.You may ask ten questions and receive not one answer that suggests a possible business objective. Or you may ask ten questions and receive ten answers each suggesting several possible business objectives. Don’t be discouraged by any single interview, or by inconsistent answers.That’s why there are several different types of questions, to prompt different types of answers. After you’ve finished interviewing,

www.syngress.com

Assessing Your Environment • Chapter 2

you should have several sets of raw interview data. Interviews are not the end of this process, however.You must also collect data about the existing network environment.Things you should collect include: ■

A list of the stakeholders in the Active Directory project

■

Organization charts

■

Services that currently are being provided by servers on the network

■

Service levels that end-users expect from network administrators and from the technology itself

■

Reporting requirements

■

The company’s mission statement

The next step in the process is to analyze the raw data you’ve collected. It is best to start with the company’s mission and vision, then look for business objectives that appear to support that vision.You should also review the initial strategy for the project. In your analysis of the interview data, pull out the responses that are alike for multiple business units and extrapolate business objectives from those. Don’t expect the business objective to jump out at you—you may need to be a little creative in your review.These should be prioritized according to universal need and impact to the business. Any responses that are unique to a business unit may still be considered business objectives, but they are not primary business objectives and should be granted a lower priority. The final step is to select the core business objectives that are going to drive your project. Some business objectives may be met by your project, but you may not want to place them as primary targets for a variety of reasons—they are not going to impact the business, they might not be met within the time limitations you have set for the project, or they will affect only a small number of users in the company.You should base your selections on impartial criteria (i.e., return on investment) and subjective considerations (e.g., consistency with other systems currently in use).

Matching Business Objectives to Technology If people installed technology merely because it was new and they had nothing better to do, then there would be a lot of hardware and software sitting around useless.Why? Because people must have a reason to use the technology before they actually will put it into practice.That is why a business objective drives a

www.syngress.com

45

46

Chapter 2 • Assessing Your Environment

successful project. But the technology must meet the business objective in order for the project to be totally successful. Mismatching this last statement, we see that it must bear out. For example, if you are given a business objective to increase security because the company has endured a series of data thefts, and you decide to implement wireless devices to the sales force, you will not meet the business objective.The project’s stakeholders (the manager, director, vice president, or whoever has sponsored the project and provided the funds from their budgets), who expect that security will be increased, will consider the entire project a massive failure because now the company is exposed to a new security threat via the wireless access to the network and none of the existing security leaks have been plugged. Not every technology provides the answer to a specific business objective.You must be able to look at your business objectives and then review the technology for the objectives that it definitely will meet and those that it definitely will not meet. Remove the objectives that will not be met. After that, you can reprioritize the remaining objectives, placing any objectives that definitely will be met above any of which you are unsure. Once you have defined the business objectives and matched them up to objectives that the technology will support, validate them with the project’s stakeholders.This will ensure that the stakeholders are aware of the project’s direction in advance.You will have a chance to explain why some business objectives cannot be met, if asked. Best of all, you are preparing the project for future success by ensuring that the stakeholders do not have misunderstandings about the project.

Designing & Planning… Types of Business Objectives Not all business objectives will be applicable to the same sets of people. Some business objectives will be internally focused. Others will be externally focused. When you look through your business objectives, you may want to prioritize the business objectives based on their focus. You can recognize an internally focused business objective because it will have an impact on reducing costs and increasing sales for people and processes that exist entirely within the company. For example, you Continued

www.syngress.com

Assessing Your Environment • Chapter 2

may be implementing Active Directory to reduce costs for Help Desk password changes. This will come about because Active Directory will reduce the number of logons that users will need to make. This is an internally focused business objective. You can recognize an externally focused business objective because its impact will be applicable to reducing costs or increasing sales for people and processes that may not exist within your company at all. For example, you may be implementing Active Directory to reduce costs involved with an Active Directory integrated application for inventory management when transferring inventory from your company to a client business. Your business may not reduce any of its own costs, or only partially reduce them, and the other business may receive the bulk of the benefits. However, your company will gain from the competitive advantage of retaining that client through the added value of the application.

Business Objectives that Active Directory Will Meet You can look at press releases and case studies on technology vendors’Web sites and easily discover the business objectives used for a particular technology. Many of these business objectives seem vague. It will not be obvious exactly how those objectives were met by the technology. For example, the technology might be implemented to maximize shareholder value through sustainable competitive advantage. Now, that statement may be fine for a press release, but it would probably be challenged in a project document by someone saying, “Really? Prove it!” So, you need to back up your business objectives with the technology capabilities that support them. Active Directory and Windows 2000 are intertwined.Your business objectives can be supported by either the Active Directory or the Windows 2000 operating system.You may find any of the following in your own project’s business objectives list: ■

The company has increased its Internet Web servers to hundreds of servers in the past few years.The support for these servers requires 20 full-time employees. Using Windows 2000 Advanced Server’s support for cluster services, the company can reduce the number of Web servers, as well as the number of full-time employees supporting those servers, resulting in reduced costs.

www.syngress.com

47

48

Chapter 2 • Assessing Your Environment ■

The company currently has several domains, each with thousands of users and several domain controllers. Using Active Directory, the company can reduce the number of domains and the number of domain controllers, resulting in reduced support costs.

■

The number of mobile users has increased remote access usage. Using the native Terminal Server and Virtual Private Network (VPN) support using Layer 2 Tunneling Protocol (L2TP) and Internet Protocol Security (IPSec) in Windows 2000, the company can reduce telephone costs and support for remote nodes on the network, while enhancing productivity for the mobile workforce.

■

Through multiple acquisitions and mergers, the company has grown on a worldwide scale with multiple directory services of users.To maintain a single directory service so that users can easily query for information about other users and network resources, the company will implement Active Directory to encompass the entire company’s users and resources.

■

Instant access to data will increase users’ productivity. Using the Distributed File System in conjunction with Active Directory, data can be made instantly available to those users in a single searchable tree even though that data is located on multiple servers located throughout the network.

■

With sales associates moving from office to office, supporting the printing environment has been increasingly difficult. Associates cannot find the printers they need in new offices without spending a significant amount of time asking and searching for them, then installing the printer drivers and finally printing.To reduce these hassles and increase mobile user productivity, the company will implement Active Directory and publish printers in it to enable users to query for printers with capabilities and location information.

■

The company has decided to implement a new application that will significantly increase sales via Web services, and increase its competitive advantage.This application is integrated with Windows 2000 Active Directory, driving the introduction of this technology on the company’s network.

■

A managed desktop environment reduces the introduction of unauthorized software and increases the stability of desktop systems.The company will implement Active Directory with Group Policies and

www.syngress.com

Assessing Your Environment • Chapter 2

Intellimirror to manage the desktop environment and give users access only to applications for which they have been trained, thereby reducing support calls and reducing software licensing management problems. ■

Using Remote Installation Services (RIS), the company will implement server-based client image control. Images will include applications, settings, and configuration specifics and will be downloaded automatically to workstations remotely.This, in turn, will reduce the amount of time it takes to install new workstations and ultimately standardize configuration management.

These examples may not exactly match the business objectives that you have for your networks.You may want to start at a more general level and work your way to specifics. Some other business objectives you may consider include: ■

The business value of being able to combine multiple services on one server.Windows 2000 can natively provide Remote Access Services, file services, print services,Virtual Private Networking,Web services, and both Internet and security protocols.

■

Growth of the Active Directory to incorporate up to ten million users per domain, scaling up even when network growth happens in leaps due to mergers and acquisitions.

■

Increasing server uptime by taking advantage of the outstanding reliability of the Windows 2000 Operating System.

■

Consistent and centralized management of the Active Directory and Windows 2000 Servers through the Microsoft Management Console (MMC) and Terminal Services for remote control of servers.This reduces the number of touches, or the significant amount of time, that it takes to physically work on a server and manage it.

■

Increasing the availability of services by implementing clusters or Network Load Balancing with Windows 2000 Advanced Server or Windows 2000 DataCenter Server.

■

Advancing competitive advantage through support for new technologies and the Internet.

www.syngress.com

49

50

Chapter 2 • Assessing Your Environment

Costs and Benefits In today’s economy, businesses are demanding that IT expenditures are justified. In the past, a list of business objectives might have been enough reason to justify the expenditure for an IT project. Now, a determination of the return that the company may receive on its investment often is required before the project is implemented. And this requires some translation of business objectives into the dollars that benefit the company, or the costs that will be reduced as a result of the project. It also requires that you document all the costs of the project so that you can compare the costs to the benefits and determine whether the project is worthwhile.The following will help you determine your costs and benefits.

Project Costs The costs for a project are any costs that you expect to pay and any costs that you could accrue as a result of the project.You may find it easier to divide them into two categories—finite and ongoing—so that you can use the finite costs in your budget estimations. ■

Labor How many people will be required to work on the project? What are their salaries or costs per hour? This must include all phases of the project, from planning, to design, to testing, to pilot and implementation. If you need to reduce labor costs, sometimes you can combine two projects and reduce the labor costs for assessment, planning, and any high-touch services at the desktop or server.

■

Capital What server equipment will need to be purchased? What hardware components will be required? What software and utilities will you need to purchase? Capital costs are usually the first ones that are looked at for reductions. However, if you have selected a high performance server and then decide to reduce to a mid-performance server with less redundancy, you may end up trading a small cost today for a higher cost tomorrow. If performance is poor, additional servers may be added at a later date. If redundancy is lacking and a failure occurs, the resulting productivity losses can be nearly disastrous.

■

Real estate Will you require more space for servers? Will you require physical security to be put in place once the servers are installed? Will you need to have cabling or power brought into the building to supply your new servers? Real estate costs are many times forgotten during the

www.syngress.com

Assessing Your Environment • Chapter 2

project planning and cost/benefit analysis. However, making certain that you have a physical location for your new technology is a must. If you forget to do so, your project may have delays while you put the space together. ■

Training Will your administrators need to be trained on the new system? Will end-users require a class? Will an online training method be used? Or will you print out a short memo about the changes and leave training at that? What costs are associated with the training—teacher, setup,Web hosting, classroom setup, software, hardware, materials?

■

Ongoing costs What are the costs of a maintenance contract for the hardware? Are there software maintenance costs? What additional administrators (only new hires) are going to be required to manage the system? Will there be any additional costs for infrastructure, such as connectivity costs?

Benefits The project’s benefits may be difficult to estimate. If you are considering time savings as a cost reduction, you will need to find the weighted average of any employee’s salary, reduce that to per minute or per hour rates, and then multiply that value by the amount of minutes or hours saved. Be as specific as you can when estimating benefits, because you may be called upon to explain them later. ■

Productivity By how many dollars/month will productivity increase? If you have figured out what the current productivity is per user per hour, and you have determined that users will reduce their “hassle time” by a certain number of hours per month, then you can increase productivity by the percentage of time increased.This is artificial, however, since you are assuming that each minute of productivity is going to be matched by an equivalent revenue. However, you cannot evaluate the benefits without a dollar value, so artificial is better than none.

■

Expense reductions How much money is saved per month after the project has been implemented? Will you pay less for emergency travel to remote sites because you can now manage servers using Terminal Services? Look at every expense for which you currently budget and see if your project can reduce those expenses.

www.syngress.com

51

52

Chapter 2 • Assessing Your Environment ■

Revenue How much more revenue will your project bring to the company? If you have extended your Active Directory to the Internet and enabled users to input orders online, how much more in sales will that mean? If you have enabled your sales associates to use mobile devices and smart card technologies to perform sales at any time, how many more sales do you expect to see from these changes?

■

Decreased ongoing costs How much less will you pay for developing your company’s products or services due to the project? How much less will you pay for maintenance contracts? How much less will you pay for hardware or software licensing? How can you save on administrative costs (salaries) or emergency calls to outside service firms? Will you reduce Help Desk calls? And since you pay a few dollars per minute on Help Desk calls, are your Help Desk expenses reduced? Will you reduce the monthly charges for connectivity? Most IT projects target decreases in ongoing costs as a major benefit of the project. Ongoing labor cost reductions should be included only if an employee or contractor is removed from payroll completely, or placed in a different position elsewhere in the company.

Assessing Your Current Environment The current network will have a huge impact on your project.The way it is designed and managed, and all of the processes that users use with it, will transform the way that you design, manage, and develop new processes for the future state. In the target practice analogy, this is the place you are standing and aiming from. An overview of the entire process, from defining your business objectives through assessing your environment, is provided in Figure 2.1. Today’s network is not simply a list of workstation and server hardware, although that is something you should have in your documentation. It is also an understanding of the administrative processes, usage, and connectivity between workstations, servers, and peripherals. A network that heavily utilizes multimedia equipment to gather research data will have far different usage patterns from a network that primarily is used to store financial data. And those usage patterns will drive different decisions for the future technology decisions, even if both networks are based on the identical network operating system.You should gather the following information about your existing network:

www.syngress.com

Assessing Your Environment • Chapter 2 ■

Building locations

■

Floor plans

■

Organizational charts

■

Workflow or information flowcharts

■

Mission statement

■

Network protocols

■

Internet connectivity and Web system design

■

Wide Area Network (WAN) infrastructure

■

Local Area Network (LAN) infrastructure

■

Cabling and media types

■

Hubs, routers, Multistation Access Units (MAUs), and switches or other infrastructure equipment

■

Servers, including locations, roles, and network operating systems used

■

Workstation operating systems

■

Processes for Help Desk, desk-side support, and maintenance calls

■

IT administrative structure, whether distributed or centralized, and escalation procedures

■

Working hours and downtime schedules

■

User satisfaction index or rating, if available

■

Peripherals and mobile device usage

■

Remote access services and design

■

Domain Name System (DNS) design DNS server operating systems, and DNS software versions

■

Dynamic Host Configuration Protocol (DHCP) design and DHCP server operating systems

■

Mission critical systems

■

Master list of applications

www.syngress.com

53

54

Chapter 2 • Assessing Your Environment

Figure 2.1 Preplanning Processes Start

Define business

Stakeholder's OK objectives

objectives

Document the refined set of business objectives

Match objectives to technology

Further refine and document business objectives

Review asset inventory

Gather existing documents

Review network infrastructure

No Document network infrastructure

Plan your project

Document your plan

Next up...Active Directory

When listing the systems in the network, make certain to identify all the systems or applications that will be impacted by your project.You will need to take into account that a business may need continual availability for a system that your project might impact, even in a roundabout manner. If so, you should consider plans to avoid risks to those systems going down. For example, a hospital requires patient monitoring systems to run continually. If your project will impact the network infrastructure that these systems plug into, you should have a risk avoidance plan ready for that portion of the project. Disaster recovery plans and procedures will be impacted by new network operating systems.The data that has been saved in the past may not be able to be

www.syngress.com

Assessing Your Environment • Chapter 2

restored onto a new platform.This should be considered and reviewed during the assessment of your environment.

Network Infrastructure If you already have current network infrastructure documentation, then you can simply use that as part of your collected data. Most networks, however, grow and change over time; it is a good idea to update your network documentation with the latest changes, or to create a new picture of the network. When you look at your current network infrastructure, you are actually looking for the way that data travels across the network.This will be indicated by all the WAN links, the locations of servers, and the roles that those servers play. It will also be indicated by the location of any Internet connections, how users use the Internet, and the flow of data between users on the network. When you look at your network infrastructure, pinpoint any areas of weakness or overload so that you can fix them or adjust your project around them. You may need to use a protocol analyzer to review traffic patterns, or review logs on routers and other infrastructure equipment. What you will create is a picture of your current infrastructure.You may need to create several pictures at various levels. One picture could represent your WAN links; others could represent individual LANs.Yet another could depict your Internet connections. In addition to the pictures, you should document the locations where traffic creates a bottleneck. Before purchasing a new tool or utility to help assess your network infrastructure, servers, and other assets, identify what systems are already in place to handle asset management. If you have a current asset management system, you can apply it to your project. If not, consider purchasing a tool to help identify the systems existing on your network.You can look into vendors such as these: ■

Peregrine

■

Fluke

■

NetIQ

■

Quest

■

NetIQ

■

Tivoli

www.syngress.com

55

56

Chapter 2 • Assessing Your Environment

NOTE Don’t assume that your network infrastructure won’t be affected by a new technology. Even if you are deploying an application that doesn’t appear to utilize a lot of bandwidth, you may find that users change the way that they use their workstation as a result. Even with Active Directory, some users may begin using queries in a different way, and that may lead to other usage changes. Or, you may begin integrating Active Directory with Lightweight Directory Access Protocol (LDAP)-compatible applications. When you start your project, find out what is being utilized, and then plan for any expected growth. As users increase their usage of network resources, your bandwidth utilization may amplify.

Servers Servers will have two different impacts on your project. One set of servers will be upgraded, migrated, consolidated, or in some way changed as part of the project. The other set of servers will not be changed, but still may need to interact with the new Active Directory.You may decide to document only the first set.You may find that having documentation on all the servers will help you later on, especially if there is some workflow that involves servers from both sets.The information you should gather about servers includes: ■

Server hardware, manufacturer, and model

■

Server components, especially available disk space, CPU, and amount of RAM

■

Beginning Input/Output System (BIOS) versions

■

Server host name and Internet Protocol (IP) address

■

Role the server plays in the network, such as member server or Primary Domain Controller (PDC)

■

Services the server provides the network, such as file and print,Web, DHCP, or DNS

■

Applications installed on the server

■

Users that primarily access this server

■

Network Operating System (NOS) including service packs

www.syngress.com

Assessing Your Environment • Chapter 2

Desktops In a project that primarily is deploying Windows 2000 with Active Directory, you might not consider the impact the project will have on applications.This is not the case. Active Directory is the basis of authentication and queries for end users. Windows 9x desktops need to have an additional client installed to be able to query the Active Directory.Therefore, you should have a list of all the desktops and their operating systems so that you can plan accordingly. Your administrative processes may change due to your project. If you are using Windows 9x clients and plan to implement Active Directory in Native Mode, you will need to change your desktop image to include the Active Directory client.This image will replace any images that you have stored in-house, or that are delivered to your office through a vendor or original equipment manufacturer (OEM).

NOTE When gathering information about hundreds or even thousands of workstations, it is impossible to visit each one and fill out a worksheet with the data you are gathering without throwing your project costs way out of whack. Many organizations use asset management applications that are capable of taking a snapshot of the current network hardware. There are many applications capable of performing a quick asset inventory, from companies such as Peregrine, Tally Systems, and Computer Associates. Microsoft’s own Systems Management Server (SMS) is used for asset management functions, too.

Peripherals and Mobile Devices You should round out your assets lists with an inventory of peripherals and mobile devices. In a majority of cases, most of these devices will not interact with the Windows 2000 servers or the Active Directory. However, some printers may be shared from servers, and business units may request that their peripherals be integrated in some manner. Having this list will keep you prepared.

www.syngress.com

57

58

Chapter 2 • Assessing Your Environment

Locations Organizations are increasingly mobilized. Some are global, with locations around the world. Some have developed multiple satellite offices to increase their presence with customers. Others have workforces telecommuting. Many have combinations of all these elements. When you deploy a project that includes a directory service and affects servers, you will affect most, if not all, locations in some way. Eyeballing those locations through site surveys is invaluable to gathering the data that you will need for effective planning of your project. However, the number of locations can prohibit the ability to conduct those site surveys in a reasonable time frame, or within a reasonable travel expense account.Therefore, you should determine which sites absolutely must be surveyed, and which sites do not need to be included in your list. Sites can be categorized as major, remote, or other. Major sites are those where the majority of business for a company occurs, or where there are several hundred or more end-users along with their own network administrators and servers. In general, you should visit most or all of the major sites, or require detailed information from the administrators of those sites. Remote sites are locations such as branch offices or warehouses, in which there are few users and few, if any, servers.They are connected to a major site and use that link for all their data transactions. Remote sites usually have no formal administrators.You do not need to visit most of your remote sites, although you may wish to visit one or two, randomly, to see if there are any surprises that pop up. Other sites are those that are mobile offices of less than 10 users, or telecommuters.These locations likely are connected via dial-up or virtual private network (VPN) connections. Most of these users maintain all of their data on their workstations and use peripherals that are not shared.You probably do not need to visit any of these sites, although a random visit to one or two exemplary sites may help you with your preparations. Site walkthroughs will help you determine the best fit for existing hardware within your Windows 2000 network.You should pay attention to the flow of information and processes in action.When you execute your plans, something you see during a site walkthrough may prompt you to include additional tasks or change a task to fit a certain type of site.

www.syngress.com

Assessing Your Environment • Chapter 2

Gathering Information for Your Active Directory Planning and Design When you have your information gathered, next consider the technology that you are planning to implement—in this case, Active Directory and Windows 2000.When you are planning, look at the technology’s capabilities and constraints so that you can fit it into the organization.The Active Directory architecture consists of three main logical organizing concepts: ■

Forest A set of namespaces representing multiple domain trees.

■

Domain tree A set of domains that are hierarchically named to participate in a single namespace.

■

Organizational unit A container within a single domain that organizes the domains users, resources, and services.

A forest is global, which means that it can include any or all users, resources, domains, and physical LAN and WAN connections on the internetwork.The domain is based on the DNS domain name.The OU is a logical container that can organize the resources, services, and users within a domain in a nested hierarchical tree structure.

Objects and OUs Objects are the items that are organized in Active Directory.The objects can be anything that the schema allows, such as users, groups, printers, servers, and so on. The objects are stored in OUs, which then become an administrative tool for grouping objects in a hierarchical system similar to a file system on a hard drive. The interesting concept about OUs is that they are themselves a type of object. A user can be granted access rights to an OU for administration purposes, whereas another user would not have administrative access to that OU even though that other user has administrative rights elsewhere within the same domain.

Organizational and Network Infrastructures That Impact Active Directory Planning and Design An Active Directory should be designed to take advantage of the network infrastructure and work seamlessly with the enterprise organization.When designing an Active Directory, keep in mind the following issues:

www.syngress.com

59

60

Chapter 2 • Assessing Your Environment ■

A forest can be anywhere and everywhere. It does not matter what the network infrastructure is like, or what the logical organization of the enterprise is. A single forest consists of multiple namespaces representing domain trees that trust each other and share a common schema, configuration name context, and GC.There can be multiple forests in a single internetwork. Multiple forests do not need to be created for administrative or security purposes, but may be desirable to separate test network information from production network information.

■

Domains do not have the same characteristics traffic-wise as they did in the legacy Windows NT system. Domains have more replication, query, and authentication traffic within their confines than they do between them. As a result, domains may be designed to encompass high-speed and reliable LAN and WAN connections, but should probably not encompass low-speed and unreliable WAN connections.

■

Sites can be used to manage the traffic that transmits across low-speed WAN links. Sites are a representation of the physical network. An administrator can configure the traffic that passes from one site to another so that it occurs on a scheduled basis, or uses one path preferentially over another.

■

OUs can be designed to match the administrative delegation within the enterprise. If an existing Windows NT domain structure had two domains in order to separate the administrative duties, now they can be combined into a single domain with two OUs to provide the same administrative delegation. Nesting an OU within another OU is also appropriate to further delegate administrative duties.

■

Nesting OUs has an impact on authentication traffic over the network. Group policies can be applied to each OU in a nested system. As each group policy is processed down nested OUs in the tree, the authentication traffic increases. However, this is not an issue if there are no group policies, which are inherited by their contained objects, applied to those OUs.

Microsoft has created a flexible, scalable, and hierarchical architecture for Active Directory. It can function on any internetwork, and meet the security and administrative requirements of any enterprise organization.

www.syngress.com

Assessing Your Environment • Chapter 2

Planning for Your Implementation The skill of planning applies to any type of project, whether that is erecting a bridge, rotating a crop, or installing a new technology. As different as these projects appear, they all include the same basic requirements: ■

Cost control

■

Timeline development

■

Communications

■

Resource procurement

■

Risk management

■

Satisfying stakeholders’ needs and expectations

By sharing all these elements, using the same processes that generate successful results can reduce the time, effort, risks, and costs involved with a project.

Project Timeline One of the initial responsibilities in planning is the development of the timeline. But this can become a trap. Many project timelines are developed by a committee, or by a project manager who collects the tasks from a variety of people who will work on the project. Each person adds his or her tasks to a long to-do list. As the tasks expand in length and complexity, so also do the scope and budget for the project. For example, some people can walk up to a project and say, “Hmmm…I’ve done this Active Directory thing before, this is the list of tasks.” And then they list out the standard: 1. Design the Active Directory domains, forests, sites, and Organizational Units. 2. Upgrade or install the domain controllers. 3. Upgrade or install the member servers. 4. Install the Active Directory client. And then, someone on the project team speaks up and asks, “Well, as long as we are going to upgrade the member servers, why don’t we buy new larger servers and consolidate two or three old, smaller ones into the new large one?” And another person speaks up and asks, “Why shouldn’t we upgrade all the www.syngress.com

61

62

Chapter 2 • Assessing Your Environment

desktops to Windows XP rather than install the Active Directory client?” And the tasks grow, and the budget expands, and the original goals and objectives for this project are lost in a ton of muck. After experiencing the creeping scope and budget, it’s no surprise to learn that many projects fail due to poor front-end planning. And it isn’t as though the business had not performed front-end planning. It was just performed in a way that did not result in meeting the objectives set for the project. So how do you get around this problem? You can avoid this creeping scope and budget by looking at the project from a strategic perspective.This may mean that you will need to reject a lot of tasks that are suggested during project team meetings, and that can be tough. But if you set the expectations up front, and tell each person that they must provide the proof that their task will meet one of the documented and stakeholder-approved business objectives for the project, it becomes much easier to reject tasks that will take the project off course. The strategic perspective method is simple.Taking the business objectives that you have defined, look at the measurable results that the project should achieve. Then, working backwards from the results to what you currently have on the network, determine the tasks that will lead up to each of those results. For example, let’s assume that a company named Dan’s Pans & Cans, a manufacturer of kitchen equipment, has decided to implement Active Directory in their business. Dan, the owner, has a business objective of mobilizing the sales force, equipping sales associates with mobile devices that they can use to log on to the network, input data, and print to the nearest printer. To achieve this business objective, you need to publish printers in Active Directory and purchase Windows CE devices that integrate with a Terminal Server.These can be broken down further into smaller task sets: 1. To publish printers in Active Directory, design and install an Active Directory and its domain controllers, then install and share printers, and then publish them.Test querying, locating, and printing to those published printers. 2. To allow sales associates to log on and use network applications, add their names to the new Active Directory and apply the correct rights to those users. 3. To use mobile devices, select them, purchase them, configure them design the Active Directory for mobil, and test them before deploying them to the sales force. www.syngress.com

Assessing Your Environment • Chapter 2

4. To integrate with a Terminal Server, design a Terminal Services solution, install servers, install shared applications, test the applications, test the applications with the mobile devices, and test printing with the mobile devices to the published printers. A set of tasks based strategically on the project’s intended goals will ensure that business objectives will be achieved. If at all possible, try to redefine some or all of your business objectives in a measurable sense. For example, if one of the business objectives is to “Enhance Help Desk service,” you cannot measure that. No one will disagree that it is a good business objective, even if it is mush.What you can do, however, is find out the number of Help Desk calls that are being taken or the length of time the average Help Desk call takes and state: “Reduce Help Desk calls by 10 percent and reduce the time per call by 1 minute.”This is a measurable business objective.Then, when the project is complete, you can measure your results to see if you met the objectives.

Setting Milestones There is one more thing that you will want to do: Establish milestones. Milestones are markers placed in your project that will let you know whether you are on track or not. From the Dan’s Pans & Cans timeline, you might want to place a milestone when all the Active Directory Domain Controllers have been installed.You would also want to place a milestone after successful tests, and so on. Milestones may also be set when you achieve measurable results. If your project is partially complete, but you have put the technology in place that should meet part or all of a measurable business objective, then you can place a milestone at the point when there has been improvement. Given that you had a business objective of reducing server downtime by 10 percent, once the servers have been installed and running you can measure to see if you have reduced downtime.You may set a milestone at a 5 percent reduction in server downtime, and the final milestone at 10 percent reduction. (Of course, with Windows 2000’s enhanced reliability, you may end up meeting both milestones at once!)

Setting a Budget If you are lucky enough to define your own budget, then this part of the process is easy. Simply total all the costs from your costs/benefits analysis, add 10 percent for a cost overrun, and you are done. However, if you are given a budget limit,

www.syngress.com

63

64

Chapter 2 • Assessing Your Environment

you will need to determine what can and can’t be done within that budget, and how that will affect your business objectives. Sometimes, a budget is unrealistic. It is so low that none of the business objectives can be achieved. If you are faced with a low-budget challenge, you must face the folks guarding the overall IT budget and ask for an increase.The best way of doing this is to describe the objectives of the project and show them that the budget cannot meet one, more, or all of the objectives in an acceptable manner.You then must demonstrate the costs that you will expect in order to meet the objectives and request the increase.The results of the meeting may be that you are asked to adjust the business objectives, or that you are given an increase—or even a little of both. At the point when a change to the project is made that will substantially change its outcome, you simply inform the stakeholders to set their expectations.

Communications There are several communications that you should incorporate into your plan. All of these communications are intended to inform people of status, as well as help overcome any problems that occur during the project: 1. Hold periodic project team meetings to make sure everyone is on the same page.This is a standard status meeting that should occur at least weekly. 2. Hold stakeholder meetings periodically to update the project’s status. This type of meeting is less urgent, and may be required only monthly or at milestones. 3. Send out status notifications to end-users who will be affected by the project.These notifications generally need to be sent prior to any point when an end-user may be involved in the project, such as during testing or pilots.You may also need to send out support communications at the time of the rollout. 4. Plan for the Help Desk support and training of administrators.This is usually a combination of communications and formal training classes. Finally, communications play an important role in change control and management. As changes occur, they are less likely to have a negative impact if the people who detect these changes are forewarned of the change.

www.syngress.com

Assessing Your Environment • Chapter 2

Another role for communications is to establish a clear escalation plan. Escalation is managing a problem that does not get solved on first touch. For example, if a user calls the Help Desk, and the Help Desk cannot support the user, the Help Desk can escalate the call to a project team member. If the project team member cannot support the user, the call can be escalated to the project manager, and so on.With a documented escalation process, problems are resolved faster.

Gap Analysis of Business Objectives and Current Environment At this point in your project initialization, you have defined: ■

The project concept

■

Its mission

■

The scope

■

Budget

■

Timeline (also known as a work breakdown schedule)

■

Milestones

■

Communications and escalation

One of the methods that you may need to employ during the planning stage is a gap analysis.This is a process by which you identify the missing elements required to reach the goals.You will also determine whether the resources you have are adequate to complete the implementation of the project. Gap analysis is tedious to perform, but not all that difficult. One approach to it is this: 1. Document all the prerequisites that you need to have in place in order to execute the project. 2. Document all the assumptions that are in place, but not backed up by fact. 3. Research whether the prerequisites are in place. 4. Research the assumptions to see if they are backed up by fact. 5. Write down any prerequisite that is not in place. 6. Write down any assumption that is false.

www.syngress.com

65

66

Chapter 2 • Assessing Your Environment

7. Describe all the tasks that are required to put the prerequisite or assumption in place. 8. Describe the financial and operational impact that this has on your project. For example, in the project plan for an implementation of Active Directory, you have assumed that the DNS services are adequate to install Active Directory. However, upon executing the gap analysis, you discover that the DNS service does not support Service Resource Records (SRV RRs) and that you must either upgrade it or replace it with a different service before you implement Active Directory.This gap, once discovered, can be filled in. But if you do not perform a gap analysis, and discover this problem during the project’s execution, you will run into a problem that points to poor planning—which it really wasn’t, it was just an assumption unchecked. So, save yourself some heartache and perform a gap analysis before you begin to prepare for the unexpected.

Risk Analysis Risk analysis involves cost overruns and problem management in advance.The areas of risks that you should consider include: ■

The business objective cannot be met due to a systems or support failure.

■

Stakeholder expectations cannot be met due to a systems or support failure.

■

Policies or standards cannot be met due to technology requirements.

■

Costs are increased because a system is intolerant to a configuration.

■

Assumptions surrounding application compatibility are found to be false, delaying the project and increasing costs.

In effect, performing a risk analysis is playing the devil’s advocate. Imagine any disaster that might befall the project, and then assign a likelihood of such an event taking place. If you install the Windows 2000 network operating system on a server, you run the risk that the installation fails. If you are installing Windows 2000 on a server that is listed on the Microsoft Hardware Compatibility List (HCL), then you have a much lower likelihood that this will be a problem for you than if you are installing on a generic server consisting of parts assembled from a variety of different places—none of which are listed on the HCL. www.syngress.com

Assessing Your Environment • Chapter 2

Furthermore, this server installation failure will cost you time and effort to troubleshoot, and possibly produce some hardware replacement costs and escalation support service costs. Some tasks will have higher risk likelihood, and others will have higher associated costs. In most cases, you simply can document the risks, the likelihoods, the costs, and the methods you think should be undertaken to prevent the risk from taking place as well as the methods you can take if the risk occurs. If you want to add a risk line-item to your budget, you can calculate the likelihoods as percentages, apply them to the costs, and add the total to give yourself something to rely on budget-wise, should a risk occur.

www.syngress.com

67

68

Chapter 2 • Assessing Your Environment

Summary Preparing for Windows 2000 Server and Active Directory requires in-depth knowledge of your environment.To develop the correct strategy for any technology implementation, you need to know two things: your business objectives and your existing network. Business objectives can then be matched to the capabilities offered by the technology you are implementing. From this data, you can determine your costs or budget needs, as well as estimate the benefits that you will obtain from the project. Gathering information about your current environment will indicate the starting point for your Active Directory project.You will need to have a clear understanding of your network infrastructure, servers, desktops, and peripherals. If you conduct site surveys, the sites should be selected carefully by their size; larger sites will have a greater impact on your project than those with only a few users. With business objectives and the network assessment completed, you can begin planning the Active Directory project.The project plan is composed of a project timeline with milestones, a budget, ongoing communications with users, a gap analysis, and risk analysis. Each of these elements will assist you in ensuring that your Active Directory project is successful.

Solutions Fast Track Defining Your Business Objectives  Business objectives guide an Active Directory project to a successful

conclusion.  When developing your business objectives, look at all aspects of the

business and conduct interviews with key persons in each affected business unit.  Matching business objectives to the technology you are implementing is

a critical process to ensuring that your project meets with stakeholder’s expectations.

www.syngress.com

Assessing Your Environment • Chapter 2

Assessing Your Current Environment  Your current environment is not only a list of hardware and software, it

is also administrative processes, workflow, and bandwidth utilization.  When assessing your network, you will gather documents such as orga-

nizational charts, building plans, network layouts, asset inventories, even the organization’s mission and vision statements.  If your organization has multiple locations, conduct site surveys of the

ones that will impact your project.

Gathering Information for Your Active Directory Planning and Design  Make certain to review both the capabilities and constraints of Active

Directory before you develop your project plan.  Active Directory consists of three main logical organizing components—

the forest, the domain, and the organizational unit.  Sites, which represent the physical network, can be configured by an

administrator so that traffic between sites is scheduled.

Planning for Your Implementation  A project timeline will include all the tasks that need to be completed in

order to reach each business objective.  Using the costs developed in the definition of the business objectives,

you can set a budget for the Active Directory project.  Periodic team meetings will keep the project on track and help resolve

issues before they become problems.

www.syngress.com

69

70

Chapter 2 • Assessing Your Environment

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: What is one benefit of migrating from a Windows NT domain model to Active Directory?

A: The Active Directory domain can hold up to ten million objects, as opposed to Windows NT domain’s being able to contain 40,000. Because of this limitation being removed, an enterprise can reduce the number of domains that they have, even consolidating servers in the process.With less complexity and fewer domains to manage, the total cost of ownership is reduced.

Q: If our business objective is to reduce the number of desk-side support calls by 10 percent, how can we meet that objective using Active Directory?

A: One way that can help you meet that goal is by implementing Group Policies so that applications are installed to machines automatically if those machines belong to a certain Organizational Unit.This can reduce the calls to the deskside that require application installations.That may, or may not, meet your 10 percent objective, however. It depends on your existing desk-side support call volume and their purposes. It also depends on what other methods you might consider employing to reduce your desk-side support calls.

Q: Is there a place where I can learn about project management? A: Yes.You can visit www.pmi.org for information on project management best practices. If you are interested in Windows 2000 deployment assistance, you can check Microsoft’s Deployment Guide online at www.microsoft.com/ technet/win2000/dguide/home.asp.

Q: We have an asset inventory that is six months old. Our network has only a couple hundred users. Do we really need to look at every single machine another time?

www.syngress.com

Assessing Your Environment • Chapter 2

A: Given that you have a fairly small environment, you probably can name every installation, move, add, or change that has taken place since your last inventory.Therefore, you can feel fairly confident in the data with your own or your network administrator’s input. If you don’t feel confident in the asset inventory, go ahead and take another snapshot of your network.

Q: Should I include the cost of a salary for a new network administrator who is up to speed on Active Directory into my budget for the project?

A: No. Even though you wouldn’t have hired the network administrator without the project taking place, that is an ongoing cost.You should estimate that cost for your cost/benefits analysis, but it rightly belongs in the budget for the administrative department.

www.syngress.com

71

Chapter 3

Active Directory for Windows 2000 JumpStart Tutorial

Solutions in this chapter: ■

What Active Directory Is, and Why You Need to Know About It

■

Important Features

■

Industries and Companies Affected by Windows 2000

■

Advantages and Disadvantages of Active Directory

 Summary  Solutions Fast Track  Frequently Asked Questions

73

74

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Introduction This chapter provides you with a tutorial on the Active Directory for Windows 2000, and can be used to quickly brush up on Active Directory concepts. In addition, this chapter will point you in the direction of chapters that hold more information about the various concepts mentioned here. In other words, this chapter gets you on your way to understanding Active Directory today.

What Active Directory Is, and Why You Need to Know About It Basically, Active Directory is a Multi-Master database, or directory service, of user accounts and network resources available to all participating Windows 2000 Servers. It stores information about network users and resources into an Extensible Storage Engine (ESE) database.The power of Active Directory is derived from its ability to tie user accounts to resources in a relationship that is governed by group policies and access rights. Directory services can have several types of capabilities: ■

Enable single sign-on

■

Enable a single point of administration

■

Provide a means to query network information

■

Store data about accounts and resources

■

Manage relationships between accounts and resources

■

Provide an enterprise-wide viewpoint of a network

The fact is, directory services can deliver some or all of these features.When you have a homogenous environment, such as a network with a limited number of types of systems, you will be more likely to implement fully all the features of a directory service.Those systems must be enabled for the directory service in order to access it and use its capabilities. Problems arise when there are multiple directory services or when there are so many different types of systems that interoperability is limited to what is allowed by a network protocol.The challenge with using a protocol, such as Lightweight Directory Access Protocol (LDAP) or Active Directory Services Interface (ADSI), is that the connectivity must be facilitated through a script or program.These types of scripts must indicate the location of the objects within the directory www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

service in order to access them. If all you want is to write a quick, simple script, this means that the name of the directory service and the names and locations of the objects that are being accessed must each be placed in the script and known prior to the script being written. If you need to access a different object, then you usually need to rewrite the script or develop a much more complex program to integrate the directory services. Even so, compare scripting to native access with queries and interactive responses, and the value of a homogenous network with a single directory service is revealed. In a homogenous network, there is no need to logically connect two directory services with a script.This greatly reduces the time and effort involved in administering the network. Homogenous networks are unusual at best.With multiple types of network operating systems, desktop operating systems, and infrastructure operating systems available today, it is likely that there will be multiple systems around. It follows that they all must be managed in different ways. Microsoft has answered the directory service challenge by creating Active Directory as a standards-based system, accessible via the ADSI Application Programming Interface (API) and Internet standard protocols such as LDAP. Native integration with Active Directory is available with Windows 2000 and XP clients, with an additional Active Directory client available for Windows 9x clients. Metadirectory services can be used to bring about a near-native integration between Active Directory and other directory services. Windows 2000 is packed with new and important features. Active Directory itself offers features that are new to the way a Microsoft network works: ■

Ability to promote and demote domain controllers (DCs) without re-installing the Windows 2000 Server operating system

■

Granular, policy-based administration built into the directory service

■

Organizational unit (OU) hierarchy with decentralized administration or centralized administration capability

■

Improved security via Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol (L2TP), Kerberos authentication, and Smart Card technology, among others

Demote a DC One of the less touted but most useful features of an Active Directory DC is the ability to demote a DC to a standard server as a standalone server or member server of a domain.Then, if desired, that same server can be promoted into other www.syngress.com

75

76

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

domains or even back to the same domain as a new domain controller. Domain restructuring is a powerful and flexible tool for enterprises that experience high growth and change.The same command used to install Active Directory, Dcpromo.exe, is the one used to remove it. Legacy Windows NT was inflexible in its approach to installing primary domain controllers (PDCs) and backup domain controllers (BDCs). Before installing a Windows NT server, you had to know exactly what role that server would play—whether a PDC, BDC, or member server—and then you were required to keep that server in that role. If you had installed a member server in a remote location, and then wanted to turn that server into a BDC to improve the logon response, you would be forced to reinstall that server fully. Not only does the reinstallation take an excessive amount of time, but managing the data and applications on that server during the reinstallation process only compounds the length of the process.

Policy-Based Administration Active Directory also offers policy-based administration using group policies. Group policies, although similar to legacy Windows 9x and NT 4 System policies, can be applied to the native hierarchy of Organizational Units (OUs) within the domain, as well as to an entire domain or an entire site. The hierarchical organization of resources within Active Directory makes this an exceptionally useful tool. Policies enable desktop management, security, and even application installation and other abilities that can flow down the tree to be applied to objects at a granular level. Policy-based administration is part of the Intellimirror feature of Windows 2000 Server, in which group policies are used to establish a user’s or a computer’s environment when it authenticates to Active Directory.

Decentralized Administration Decentralized administration is common in large organizations with multiple sites. Sometimes, decentralized administration is established specifically to enhance end-users’ service experience. Other times, it grows out of necessity with new administrators authorized at a site to manage new servers. Active Directory scales to a decentralized administrative structure through its OUs. Since a person requires some level of administrative capability, he or she can be delegated the type of administrative access needed only for the OU containing the users and resources that this new administrator should be managing. In prior versions of NT, decentralized administration caused a problem. People who needed access to a few administrative capabilities were simply added www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

to the Administrators or Domain Admins groups. Alternatively, they were granted an entirely new domain.The result was an extensive list of domains and bloated administrative groups. By enabling administrative delegation to the attribute level on OUs in the Windows 2000 Active Directory, these previously fractured domains can be restructured into one domain and the bloated administrative groups can be reduced.

Improved Security Active Directory uses Kerberos for a secure method of trusting domains within a forest. Kerberos is a security protocol that was developed as an Internet standard. The name Kerberos is derived from the name of the hound that guarded the gates of Hades. Kerberos is known for its strong authentication capabilities. Kerberos incorporates the ability to create trusts. In the standard definition, there are realms of computers. In the Active Directory implementation of Kerberos, realms are roughly equivalent to domains.The Kerberos trusts between the Active Directory domains are bidirectional and transitive.They are created automatically where they are needed within a forest, which subsequently reduces administrative overhead when compared to legacy Windows NT. A Windows NT trust must be created manually at a domain controller in each domain for each direction of the trust.These legacy trust relationships were unidirectional and nontransitive. Such trusts can still be created between Active Directory domains, if those domains trust other domains outside their own forest, or trust legacy Windows NT domains. Active Directory can be integrated with Certificate Authority (CA) services so that encryption can be used transparently on the network.These features are available within Windows 2000 if they need to be implemented.

Important Features Several essential features of Windows 2000 are enhanced by Active Directory, and make Active Directory capable of being an enterprise-wide directory service: ■

Scalability of forests, domains, OUs, and sites

■

Extensibility of the schema

■

Multi-Master replication

■

Intellimirror

■

Kerberos trusts www.syngress.com

77

78

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial ■

Use of standard protocols

■

Accessibility to resources

Scalability of Forests, Domains, Organizational Units, and Sites The components of Active Directory enable it to scale from a small-sized network to a global network. An Active Directory domain can scale to ten million objects, although this limit has been tested only to around one million objects in a single domain. Compare this to a Windows NT domain, which was limited to 40,000 objects due to the Security Account Manager (SAM) database limitations. Scalability is further accomplished through forests made of domains, domains made of nested OUs, and sites that unite the logical Active Directory with the physical network. A description of all the components of Active Directory is available in Chapter 1, “Introduction to Active Directory.” Installation is discussed in Chapter 8, “Migrating from NT 3.51 and NT 4 to Active Directory.” A forest is the largest division for an Active Directory database. Each separate forest has its own global catalog, schema, and configuration that are shared by all its domains.The schema, which lists all the possible object types for a forest, and configuration, which contains the site topology, are copied onto all DCs.The Global Catalog, which is an index of all user accounts and network resources in the forest, is copied onto all DCs designated as Global Catalog Servers.There can be multiple forests within a network, if there are reasons to have separate Global Catalog indices, schemas, or configurations. For details about forests, see Chapter 5, “Designing the Basic Structure,” and Chapter 10, “Building Trees and Forests.” Forests are composed of domains and domain trees. A domain tree is a set of domains that have a contiguous DNS (Domain Naming System) namespace, as shown in Figure 3.1. Each domain is a partition of the Active Directory database. A copy of the domain partition is housed on every DC within a single domain.You cannot place more than one domain partition on a single DC. Or, in other words, you cannot have a DC that acts as a DC for more than one domain. Each domain partition contains its own users, groups, resources, and set of OUs. A domain is given a single DNS name, such as domain.com. For more information on DNS naming and domains, see Chapter 4,“DNS and Naming Strategies.” OUs are containers for objects within the domain partitions. Objects represent user accounts, groups, and resources in the database. Each OU can contain www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

other OUs, nested into a hierarchy, or tree structure.The hierarchy lends itself to many uses, such as delegation of administration and application of group policy. A sample OU hierarchy is illustrated in Figure 3.2. For more information on OUs, check out Chapter 5, “Designing the Basic Structure.” Figure 3.1 Domain Tree

domain.com

eng.domain.com

corp.domain.com

sales.corp.domain.com

Figure 3.2 OU Hierarchy

www.syngress.com

79

80

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Sites are defined as collections of well-connected Internet Protocol (IP) subnets.This is otherwise known as a Local Area Network (LAN), but can include Wide Area Network (WAN) links, if an administrator desires. Sites are used to localize traffic.When users contact a DC to authenticate or query Active Directory, they attempt to contact one within their own site. Sites are also used to manage the replication traffic. Replication traffic is uncompressed within a site; between sites, replication traffic is compressed.The site topology is automatically created by the Knowledge Consistency Checker (KCC) within a site. It is established as a bidirectional ring of no more than three hops between DCs.When there are more than three DCs, there are additional connections to ensure that the ring replicates updates quickly. Between sites, the site topology must be created by a Network Administrator.This is done by creating sites, site links, site link bridges, and connection objects, and assigning IP subnets to sites in the Active Directory Sites and Services shown in Figure 3.3. Replication and sites are discussed in Chapter 6, “Designing a Site Structure.” Figure 3.3 The Active Directory Sites and Services Console

Extensibility of the Schema The schema is the list of the types of objects that can be created within an Active Directory forest, and the attributes that any objects can have. Objects are user accounts, group accounts, and network resources. Attributes are descriptive values for the objects. For example, a person named Ulysses Ser would be represented by a user object “USER,” assuming the naming convention was first initial concatenated with the last name.The first name attribute of “USER” would be “ULYSSES,” and the last name attribute of “USER” would be “SER.”

www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

The schema can be extended to include new objects and attributes.This extensibility can enable an application or corporation to customize Active Directory for its uses.The possibilities are endless. If an application for Time and Billing extended the Active Directory, it might add attributes to user objects for a billing rate. Furthermore, the database itself could be represented in Active Directory by a time and billing object.Then, the users and groups can be granted or denied access to the database. Even if you do not plan to extend the schema, you may find that it is necessary due to an application’s requirements. For example, Exchange Server 2000 requires that the schema be extended to include the objects and attributes necessary for Active Directory to act as a directory service for a messaging platform. In addition, you may find that there are attributes you would like to have included in objects, such as user or computer accounts, to reflect the way that you organize users and computers in your network. The schema can be extended only on a designated schema Flexible Single Master of Operations (FSMO).The single master for the schema prevents conflicts from occurring.The first DC installed in the forest is, by default, the schema FSMO.The schema can be extended through the Schema Administrator console shown in Figure 3.4.This console is not available by default on a DC; instead, it must be added later from support tools or the Windows 2000 Resource Kit. Chapter 15, “Modifying the Schema,” discusses the schema and extending it. Figure 3.4 Schema Console

www.syngress.com

81

82

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Multi-Master Domain Controllers In the legacy NT domains, each domain was granted a single PDC, or primary domain controller, which held a read/write copy of the SAM. All other servers that participated as DCs were BDCs, or backup domain controllers, which held read-only copies of the SAM. In this arrangement, any changes that must be made to the security database are confined to a PDC. BDCs simply offer an authentication boost when they are placed close to users who are logging on. As a result, the PDC was a single point of failure for the domain. If a problem occurred that forced the PDC to go offline, no one could change passwords or add computers to the network, or execute any functions that make changes to the domain’s SAM, until one of the BDCs is promoted to a PDC or the PDC is brought back online. Active Directory is a Multi-Master database. Instead of having a single point of failure, it makes all DCs equal. Changes, additions, deletions, and updates to objects in the Active Directory domain can be completed on any DC. After a change is made, Active Directory synchronizes all the DCs using replication. In the event that two conflicting changes are made to the same object, time synchronization, along with an algorithm, ensures that the last change succeeds.That last change is written and synchronized across all copies of that domain partition on each of the domain’s DCs.

Intellimirror Intellimirror is a feature in which the user’s environment (shortcuts, menus, and favorites lists) and files intelligently follow him or her around the network.This is conducted through group policy. Group policies can be applied to the following, and are executed in this order: 1. Local group policy 2. Site group policy 3. Domain group policy 4. OU group policy The Local group policy exists on the local computer. Site group policies are linked to a site but exist on a single domain, and the site must contact that domain in order to execute the policy. Domain group policies are applied to a single domain. OU group policies are applied to an OU. A user will execute group policies in each OU from the top of the domain down to the OU where his or her own account is located. www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

Each group policy consists of two portions, a User configuration and a Computer configuration.When a workstation first authenticates to Active Directory, Active Directory applies the Computer configuration of the group policies that apply to that computer.When a user logs on to Active Directory, Active Directory applies the User configuration of the group policies that apply to that user. Even though the group policies may be housed together, they are applied independently.This independence enables a user’s environment to follow him or her intelligently around the network. The remaining part of Intellimirror is the ability to have redirected folders. This means that a user transparently can access files from a folder that appears to be local but is actually located on a network server.Those files can be backed up, and can be moved around the network without the interrupting the user’s daily productivity. Offline folders further enable the user to retain a copy of those files locally, which means that remote users can use network files when they are disconnected from the network. The Group Policy Editor is used to create and edit group policies.This console is illustrated in Figure 3.5. More about Intellimirror’s group policy is available in Chapter 13, “Intellimirror.” Figure 3.5 Group Policy Editor

www.syngress.com

83

84

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Kerberos Trusts Kerberos is an open-standard security protocol developed for the Internet. It provides a network authentication service. Active Directory uses Kerberos to verify the identity of users and network resources. Instead of relying on the network operating system or trusted IP addresses to authenticate the users and resources, Kerberos uses credentials to validate the identity and authenticate the user or resource to the network. This process is used between domains through Kerberos trust relationships. Unlike legacy Windows NT trust relationships (which were created explicitly, were nontransitive, and were established only in a single direction.), Kerberos trusts are created automatically within a forest.They are both bidirectional and transitive. For example, if a forest consisted of three domains—root.com, trunk.root.com, and tree.com—a Kerberos trust would be created between trunk.root.com and root.com, and another Kerberos trust would be created between tree.com and root.com, as shown in Figure 3.6. Figure 3.6 Transitive Kerberos Trusts

root.com

p

nshi

lied

Imp

t Trus

tio Rela

tree.com

trunk.root.com

Because the Kerberos trusts in Active Directory are transitive, it is implied that trunk.root.com and tree.com trust each other, because the trusts flow through, or translate, to the next trusted domain.This enables users in either domain to access resources in the other domain, but only if they have been www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

granted access to those resources. In order to view trust relationships within an Active Directory forest, use the Active Directory Domains and Trusts console shown in Figure 3.7. Domains and trusts are described in Chapter 10, “Building Trees and Forests.” Figure 3.7 Active Directory Domains and Trusts Console

Use of Standard Protocols Microsoft has made Windows 2000 and Active Directory Internet-ready by integrating the TCP/IP protocol stack.This stack originally was created for ARPANET and commonly made part of the UNIX operating system. Since ARPANET evolved into the Internet,TCP/IP is now the most widely used, open-standard protocol stack in the world. Two of the protocols from the TCP/IP protocol stack that specifically are used with Active Directory are LDAP and DNS. LDAP is a protocol that enables clients to access information within a directory service. LDAP was created after X.500, a directory service standard protocol, because of the high overhead and subsequent slow response of heavy X.500 clients, hence the name lightweight. LDAP clients are able to access Active Directory, which opens Active Directory up to clients other than those that access Windows 2000 in a standard fashion. DNS is a hierarchical naming system for domains. Since each computer is granted an IP address, and since IP addresses are difficult to remember, names were given to computers to make it easier for users to find and connect to resources.The naming system grew to a global hierarchy of names, starting with the root (represented by a dot “.”) and adding new domains and subdomains thereafter.This system is illustrated in Figure 3.8. DNS is used by Active Directory as a locator service. It holds service records indicating the DCs on the network. Not only do computers use DNS to locate resources, when DCs need to contact other DCs, they use DNS. Active Directory www.syngress.com

85

86

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

requires DNS to exist on the network or else it will not function correctly. DNS naming is discussed in more detail in Chapter 4 “DNS and Naming Strategies.” Figure 3.8 Domain Naming System Root .

.net

.com

microage.com

microsoft.com

Domains with various purposes: .com is commercial, .edu is educational; there are many more than listed here.

.edu

umich.edu

hq.microage.com

Specific Organizations

stanford.edu

eng.umich.edu

Optionally created subdomains within each organization.

Accessibility of Resources Active Directory enables resources to be accessible to users on the network. Whereas resources such as files and printers are available through standard sharing, Active Directory allows the resources to be organized and given searchable descriptions.Therefore, if a user is searching for a folder created for the Accounting department, the user can search with the word “Accounting” and find appropriate resources.These capabilities are not present in standard network shares.The search dialog is depicted in Figure 3.9. See Chapter 14, “Publishing,” for more information on publishing Active Directory resources. Active Directory is capable of being integrated with other applications.This can be accomplished through its extensibility and common protocols and interfaces. Accessing Active Directory is demonstrated by: ■

Metadirectories such as Microsoft’s Metadirectory Services (MMS)

■

Schema extensions such as Cisco Networking Services

■

Management utilities such as FastLane’s DM/Suite

■

Integrated databases such as SAP’s R/3

www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

Figure 3.9 Searching for Resources in Active Directory

To find out more about plugging in, see Chapter 17, “Plugging into Active Directory.” Resource accessibility is not merely the availability of resources and capability of plugging into the Active Directory—it is also the ability to access resources fairly quickly after a disaster has occurred. Many features of Windows 2000 support the recovery of the Active Directory and shared resources.These range from backups to the file replication system, from Uninterruptible Power Supply (UPS) support to Redundant Array of Inexpensive Disks (RAID). Disaster recovery issues are described in Chapter 18, “Disaster Recovery for Active Directory.”

Industries and Companies Affected by Windows 2000 It is difficult to imagine an industry or company that will not be affected by Windows 2000. Many companies have waited to install a new operating system simply because Windows 2000 was announced.They will be impacted by the new technology’s performance and administrative ease caused by the standardization that rolling it out will bring. Many have been and continue to be affected by Windows 2000, including: ■

Technology vendors and partners

■

Competitors

■

Customers

www.syngress.com

87

88

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Technology Vendors and Partners Both hardware and software manufacturers (known as Original Equipment Manufacturers or OEMs) were involved with the creation of Windows 2000 since it was first conceived as Windows NT v5.0.The need for technology partners is due mainly to the operating system needing to support the hardware and applications that potentially would be used on it. 3Com is a hardware manufacturer that worked closely with Microsoft. Hardware manufacturers in general benefit only by ensuring that their products work with a new operating system. 3Com develops many types of technologies, but one of their mainstays is their connectivity equipment.They make routers, hubs, switches, modems, and network interface cards (NICs), among other things. 3Com has had to ensure that the drivers for their hardware are compatible with Windows 2000. If a NIC driver is not compatible, a server could not communicate on the network. In addition, 3Com creates NICs that contain Pre-boot eXecution Environment (PXE) capabilities.They worked with Microsoft to ensure that Windows 2000’s Remote Installation Service (RIS) would function with their NICs.The PXE compliance level for RIS is documented by Intel at http://developer.intel.com/ial/WfM/tools/pxe/index.htm. Quest Software is an Independent Software Vendor (ISV).They have developed management utilities for Windows NT.With the advent of Windows 2000, Quest has created new management utilities and upgraded existing utilities for Windows 2000. Many ISVs are doing either or both in preparation for the change in users’ technology needs due to their use of Windows 2000. Cisco and Microsoft announced a partnership specifically surrounding Active Directory.This partnership is unusual since infrastructure historically has been separated from server-level networking applications.This partnership is strictly due to the Windows 2000 directory service implementation, with Cisco intending to leverage that directory service in order to enhance and extend infrastructure equipment management.

Competitors There are several directory service competitors for Windows 2000 Active Directory. Novell, Red Hat, and Netscape all come to mind. Novell has experienced a long-time reputation of having a best-in-class directory service (Novell Directory Services, or NDS) and a solid networking operating system (NetWare).There is clear competition between Windows 2000 Server and NetWare for the network operating system market, and that competition is www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

made fiercer with the introduction of Microsoft’s Active Directory.There are some white papers on both Novell’s (www.novell.com) and Microsoft’s (www.microsoft.com) Web sites that compare NDS to Active Directory. There is also another, friendlier side of this competition. Both Microsoft and Novell seem to realize that they will most likely have customers with integrated networks of both network operating systems. Novell has utilized the Active Directory Services Interface (ADSI) for interoperability as well as expanding on XML with its DirXML implementation as a metadirectory method. And Microsoft has created Directory Synchronization Services (MSDSS) for NetWare, in addition to developing Microsoft Metadirectory Services (MMS). Red Hat develops Linux, an open-source version of UNIX. Linux has been positioned as a competitor for Windows NT. Even though there are directory services for various UNIX versions, the position that Linux holds will be somewhat tenuous unless a comparable directory service is created for it. Netscape has developed a directory service for its Internet suite of applications. Netscape’s directory service is a direct competitor for Active Directory, since Active Directory is Internet-ready. It will be interesting to see what happens as the competition continues among these vendors!

Customers Microsoft created two similar programs, the Rapid Deployment Program (RDP) and the Joint Deployment Program (JDP). Both of these programs required active involvement with customers and resellers. Customers were supplied with beta copies of the Windows 2000 software and, with their reseller, they began the planning process for deploying Windows 2000 in their networks. All were granted a beta ID and access to newsgroups discussing the Windows 2000 beta software and issues. As the Windows 2000 software completed its beta cycle and was prepared for release to the public, these customers were adopting the technology in their networks and testing it in their labs.Their results were reported to Microsoft and shared among the various other participants so that all could learn from the experience. Now that Windows 2000 has matured past its first Service Pack, many customers have implemented it within their enterprise internetworks and even used it to support their Internet Web sites. These customer projects were closely monitored by Microsoft. Microsoft learned about real-world client requirements and discovered, first-hand, challenges that clients faced when rolling out the software.This learning experience was

www.syngress.com

89

90

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

shared with all RDP or JDP members through conferences, which provided large learning labs and university-like lectures about various features and case studies. Even those customers who did not participate in such programs have benefited from them.The experience was captured, and responses to the challenges have been prepared and distributed to customers who have implemented Windows 2000 since its release.

And… Microsoft Itself Microsoft was immensely affected by its own development of Windows 2000 Server and Windows 2000 Professional. Not only was the programming project for this network operating system one of the most extensive ever undertaken (with contributions from literally hundreds of programmers and partners over a series of years) for an operating system, but Microsoft followed it up by, well, eating its own dog food. Microsoft was one of the first corporations to run a pure Windows 2000 environment in production. In fact, Microsoft upgraded the servers in its Redmond domain to Windows 2000 Server beta 3 as a production test of its reliability.The fact that Microsoft would place thousands of users on a system that had not completed its programming cycle says a lot about their confidence in the product!

Advantages and Disadvantages of Active Directory Rarely will anyone find a perfect solution in any technology.There will always be adjustments and changes, or resistance from users during its implementation. People are the users of the technology, and they either will embrace new technology or resent it—and have many reasons to do both. Let’s take a look at what could possibly be a benefit or a challenge with Active Directory.

Advantages with Active Directory If you have a current Windows NT network, or one in which all the servers are stand-alone, Active Directory is a huge advantage for you. It will provide a single location for administration of the network, and will automate the way domains and servers communicate. Users will have a single logon to the network and enhanced security when they access resources. Since Active Directory can be implemented with little interruption to the user’s view of the network, users will have an easy transition to the new system. www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

An obvious advantage to the Active Directory for anyone who has implemented Windows NT Servers is the ability to easily promote and demote DCs. Legacy NT Servers must be reinstalled completely if they need to be promoted to DCs or demoted to servers.With Windows 2000, Active Directory DCs can be promoted and demoted as required by executing Dcpromo.exe. For anyone with Windows 2000 Professional workstations, using Active Directory offers a way to manage those workstations with group policies.This can reduce the overall cost of managing the network. The hierarchical tree is a flexible, intuitive model for network resource organization. Not only is this superior to a flat container for resources, but it can be used to delegate administration.This offers existing Windows NT networks the ability to restructure into a smaller number of domains, thus reducing management costs. Active Directory is scalable and enables growth for organizations. It is flexible enough to be structured for any organization’s requirements. Domains can contain millions of objects, rather than thousands, and can automatically be trusted in a forest using secure Kerberos trusts.

Problems with Active Directory Integration with Windows 2000 is a challenge for many organizations with existing networks. If a network consists mainly of Novell NetWare or UNIX servers, implementing Windows 2000 may be difficult to accomplish. One of the reasons is that Active Directory cannot be separated from Windows 2000 and implemented as a separate product. If intending to implement Active Directory, at least one Windows 2000 DC must exist. And, if intending to use it to organize all resources, a method of synchronization or a metadirectory must be implemented for all the other network operating systems on the network. Little management for non-Windows clients is a problem. Group policies are Windows-centric. If an organization has a significant percentage of Macintosh, UNIX, or other clients, Active Directory will not add many benefits to managing clients or users. Even for client management of Windows workstations, Active Directory does not offer an integrated method of remotely controlling the workstation for administrative purposes.To do this, other software products must be installed. The architecture for Windows 2000 intended to enable a single forest for any organization.The problem with it, however, is that any need to have separate schemas or GCs will force additional forests on the network.This will further add an incremental amount of network traffic and administrative overhead.

www.syngress.com

91

92

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Forests and domains cannot easily be merged. If a corporation purchases another corporation that has an Active Directory forest, it will need to undergo a complete migration project in order to combine both forests into a single forest. This type of restructuring, although doable, is not a simple task. Many existing DNS servers may not meet requirements for Active Directory to function. Active Directory requires Service Resource Records to be supported by the DNS servers.This is a relatively new feature for DNS. Many organizations use UNIX BIND or other DNS servers that do not support this feature, and may wish to continue using their DNS servers.To implement Active Directory, this will not work and there may be a conflict, especially if one group manages DNS servers and another group manages the network file,Web, and print servers. New technology implementations usually result in changing the way people do things. In essence, a new technology project is always a form of business process reengineering, and business process reengineering always meets some resistance. Users are not comfortable with new ways of doing things. In a way, they are faced with the idea that the way they did business before was not “as good” as the new process, and if they were proud of their work, it can be somewhat demoralizing. Implementing Active Directory, luckily, will have little impact on end users unless the project is combined with a rollout of Windows 2000 Professional. However, it will greatly impact the Network Administrators and any users who were previously granted administrative authority. If existing domains are restructured, Administrators who previously were in charge of their own domain will now be faced with sharing or only having authority over a portion of a domain. These are major challenges when implementing Active Directory, and they should be considered thoroughly before deploying the new systems.

www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

Summary Active Directory is a directory service for Windows 2000 Server, and provides a hierarchical, extensible system to organize and store user accounts and resources. This is an important upgrade for the legacy Windows NT domain architecture.The new architecture consists of a hierarchy of domains, using DNS (Domain Naming System) names, which are implemented within a forest. A forest forms the boundary for domains that share a common schema, configuration, and Global Catalog (GC). Domains are database partitions of user accounts and network resource objects.They are similar to legacy domains except they are able to contain more objects and have Multi-Master domain controllers (DCs). Within each domain, the Administrator can create a hierarchy of organizational units (OUs).This hierarchy can be used to delegate administration, hide objects, apply group policies, and organize objects. Sites are provided as a method of optimizing network traffic. The Active Directory database contains an extensible schema, which is a listing of the types of objects contained within it.This enables Active Directory to respond to business requirements of organizations and to integrate with applications. Active Directory uses a standard set of protocols based on the TCP/IP protocol stack, and is Internet-ready.These protocols include LDAP and DNS. There are both advantages and disadvantages of using Active Directory. Clients will find challenges in implementing a new technology, but many will also find advantages in reducing administrative overhead.

Solutions Fast Track What Active Directory Is, and Why You Need to Know About It  Active Directory is the directory service incorporated into Windows

2000.The storage for Active Directory data is an Extensible Storage Engine (ESE) database.  Using Active Directory, an administrator can implement policy-based

administration to manage the user’s environment.  The hierarchy of organizational units in each domain can be used to

delegate administration in a decentralized organization.

www.syngress.com

93

94

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

Important Features  Each Active Directory domain can contain up to ten million objects. An

Active Directory forest can stack any number of domains.The result is a directory service that can scale to any size of an organization.  Multi-Master replication occurs between domain controllers (DC) in a

single forest. Each DC is a peer to the others.When an administrator makes a change to any DC, the change is updated to all DCs that contain the partition that was affected.  Windows 2000 was designed to use Internet standard protocols such as

Lightweight Directory Access Protocol (LDAP) and Kerberos.

Industries and Companies Affected by Windows 2000  Original Equipment Manufacturers (OEMs) were involved with

Windows 2000’s development at its inception in order to ensure that their hardware and software products were compatible with the Windows 2000 operating system.  Microsoft’s competitors have all made enhancements to their directory

service products, some including metadirectory capabilities that will ease integration between their own product and Active Directory.  A select group of customers were involved in programs that Microsoft

offered.These programs provided information that enhanced the ability for other companies to adopt Windows 2000.

Advantages and Disadvantages of Active Directory  If upgrading from a Windows NT environment, Active Directory will

help simplify administration and reduce the time required for some administrative responsibilities, such as promoting or demoting domain controllers.  Active Directory can scale to any size network, and the design is flexible

enough to fit any organization.  Single sign on can be implemented only with a metadirectory service,

unless you have a Windows 2000/Active Directory-only network. www.syngress.com

Active Directory for Windows 2000 JumpStart Tutorial • Chapter 3

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: What Metadirectory service should we look into if we want single sign on? A: You should evaluate your network before selecting a metadirectory service. Document each application, system, and service that users must log on to. Then, go shopping for a metadirectory service that incorporates all of them. Being able to find a solution that fits them all right out of the box may not be likely. However, the next feature you need to ascertain is that the metadirectory includes the ability to build links to other applications and systems, using standard protocols and programming interfaces.

Q: When I demote a DC, do I need to take it off the network first? A: No; actually you must leave the DC on the network so that it can contact at least one other DC during the demotion process.This is required so that Active Directory knows not to include the DC in its database anymore.

Q: If I delete a user account on a DC, but take it off the network immediately before replication occurs with the other DCs, will that user still be able to log on?

A: Yes.The user will be able to logon until the DC is placed back on the network and allowed to replicate the deletion to at least one other DC. Once the other DC learns of the deletion, it will continue to propagate the change throughout the internetwork to all other DCs in the domain, and to the Global Catalog.

Q: How does DNS interact with Active Directory clients? A: The client workstation contacts a DNS server.The DNS server locates domain controllers (DCs) within the client’s domain.The client is provided with a DC that also exists within the client’s site, if available.The client then contacts the DC.The DC authenticates the client to Active Directory.When

www.syngress.com

95

96

Chapter 3 • Active Directory for Windows 2000 JumpStart Tutorial

the user logs on to the workstation, the process repeats except that Active Directory provides the location of the user’s domain if it is different from that of the client workstation’s domain.When either a client workstation or a user cannot contact a DNS server, it won’t be able to find its DC, and will subsequently be denied access to the network.

Q: Should we install Active Directory now, or should we wait until the technology has matured?

A: This depends completely on your business requirements and your existing network. If this is a question that you cannot answer immediately by yourself, it may be best to have a consultant review your network and your business requirements with you and determine the best time and deployment strategy for you. However, if you already have decided that you will be implementing Active Directory but do not know exactly when to start, it is probably best to begin a planning project and a pilot deployment of the software as soon as you are able.This will only make a full deployment more successful because of your experience with Active Directory.

www.syngress.com

Part II

Designing Active Directory

Chapter 4

DNS and Naming Strategies

Solutions in this chapter: ■

What Is DNS?

■

Active Directory’s Integration with DNS

■

Planning Active Directory and DNS

■

Naming Conventions

 Summary  Solutions Fast Track  Frequently Asked Questions

99

100

Chapter 4 • DNS and Naming Strategies

Introduction Naming of objects, domains, servers, and other network resources facilitates network management by making it easier to assign a name, locate an object, or determine the purpose for an object. Before you install the first server on the network, you should have your naming strategy established. Active Directory uses Domain Name System (DNS) naming for its domains. It is dependent upon DNS to act as a locator service. Beyond that, each name within Active Directory must be unique. For a large network with thousands of users, the possibility of finding two people with the same name becomes progressively more probable.Therefore, a carefully considered and documented naming strategy will avoid future naming problems. In your project plan, determining the Active Directory naming strategy is the launch point for the project. In order to determine the naming strategy, you will use the information you gathered about the enterprise during your assessment. The information you need includes the existing Domain Name System (DNS) configuration, the existing NT Domain configuration, and the current naming conventions used on the network. Before deploying Windows 2000, the project team should fully understand the components of the Active Directory namespace plan.The namespace plan incorporates the naming strategy for DNS, since it is so tightly integrated in Active Directory. It also describes the domains and their structure for all of the Windows 2000 domains, and the standards that the team will adhere to when creating objects and published resources in the Active Directory tree. Do not make the mistake of discounting the importance of a solid namespace design.The namespace plan impacts all sorts of network mechanisms, including: ■

Administrative efficiency

■

Change management

■

Network usability

■

Bandwidth overhead issues

■

Network availability and fault tolerance

As this list demonstrates, naming is a critical juncture on your way to an Active Directory enabled network.

www.syngress.com

DNS and Naming Strategies • Chapter 4

What Is DNS? DNS is a general-purpose data query service for the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite. Used on the Internet as well as private TCP/IP-based networks, the data typically queried are host names (a.k.a. the name of the computer), and the query responses are normally hosts’ IP addresses. On a TCP/IP network, any communications that must be transmitted to a computer must be identified with that computer’s IP address. IP addresses are 32bit binary numbers that for ease of use, are written in a series of four numbers with values of 0 to 255, separated by periods.This format is known as dotted decimal and appears as 123.33.0.254. Even though this dotted decimal format is much easier to remember than a series of 32 ones and zeroes, it is still not user-friendly. Back when the Internet was known as ARPANET and was run by the Department of Defense for research purposes, host names eventually were applied to computers. Each networked computer was required to maintain a mapped list of host names and IP addresses in a text file named hosts. When a computer needed to access another computer on the network, it could look up the IP address in the hosts file, and the user could use the host name. If a new computer was added to the network, the host name and IP address were added to the hosts file. If the host name and IP address were not present in the file, the user was required to use the IP address of the other computer in order to locate and access it, or to add a new entry to the hosts file. Administrators invented centralized hosts files that were downloaded to network computers, to reduce the overhead with managing the hosts files. Even so, as the network grew to encompass thousands of computers and network traffic was stressed by the hosts file updates, hosts files became unwieldy and difficult to synchronize across networks. DNS was developed in 1984 to solve the administrative problems associated with using hosts files, providing scalability, decentralized administration, and support for various data types. Host names reside in a hierarchical database distributed across multiple servers. Because DNS is distributed and partitioned, the load is reduced on the servers as well as the traffic generated to update and synchronize records. Furthermore, by virtue of its hierarchical distribution, the DNS database is unlimited in size without growth impacting performance. Each partition, or zone, hosted by one or more DNS servers, maintains mapped lists of host names and IP addresses and allows registration of a variety of record types. Not only does each organization maintain its own partition, but it also has authority over a partition of the DNS namespace, including a per-partition administration. www.syngress.com

101

102

Chapter 4 • DNS and Naming Strategies

If an address is not found when a query is made by a client, the DNS servers are capable of passing the request through the organizational tree to a server that may have the mapping or know of a server that does. DNS requires a name format that fits its hierarchical nature. A fully qualified domain name (FQDN) is the name of a host that includes the names of each level of the hierarchy from the host to the root of the DNS tree, each separated by dots (.). For example, the FQDN of the Dot1 server in the Dot domain under the Commercial (.com) domain would be DOT1.DOT.COM. DNS names are treated in a case-insensitive manner, so that a host named seven.nine.borg.com would require that there are no hosts named Seven.nine.borg.com or any other capitalization permutation. Although these domains are well known,Table 4.1 lists some that you may encounter when on the Internet.These, and others, are discussed in RFCs 1034 “Domain Names—Concepts and Facilities” and 1035 “Domain Names—Implementation and Specification.” Microsoft first implemented the DNS service in its Windows NT 4.0 Server. The Windows NT 4.0 version does not supply the features, such as Service Resource Records (SRV RRs), Dynamic DNS (DDNS), or Incremental Zone Transfers (IXFRs), which are either required or recommended for a Windows 2000 Active Directory.Windows 2000 Server includes DNS with all of these features. Table 4.1 Top-Level Domain Names and Types of Organizations That Use Them Domain Name

Use

.com .edu .net .gov .mil .us .uk .au

Commercial Educational Network operations United States government United States military United States United Kingdom Australia

DNS uses a hierarchically structured namespace, a portion of which is illustrated in Figure 4.1, and can associate more data than just an IP address with the host name. All information is stored as a resource record, or RR. Clients issue queries to DNS servers to look for host names, IP addresses, or services that meet their specified needs. For example, an Internet mail server uses a Mail Exchange www.syngress.com

DNS and Naming Strategies • Chapter 4

(MX) RR to identify its service to any querying hosts. A simple host name to IP address association is known as an Address (A) RR. Figure 4.1 Hierarchical Nature of DNS Root DNS Root DNS Server .edu Educational DNS Domain

.mil Military DNS Domain

.com Commercial DNS Domain

microsoft.com Enterprise-Level DNS Domains microage.com

DNS name servers maintain the information about the domain tree structure. These servers keep a subset of the domain information and are considered an authority for that subset or partition of the tree.That subset of the domain, consisting only of the authoritative information, is organized into zones, which are then automatically distributed to redundant DNS name servers. A DNS name server with authority over a zone is considered primary. If the DNS name server does not have authority over a zone, it is considered secondary. Clients use an application called a resolver to query their assigned DNS server. DNS servers also have an application called a resolver that extracts data from the DNS database in order to respond to a client request.When the resolver cannot extract data from that particular name server, it can pursue the query through www.syngress.com

103

Chapter 4 • DNS and Naming Strategies

referrals to other name servers via recursive process to resolve the names for which they are not authoritative.The referral process is shown in Figure 4.2. Figure 4.2 How the DNS Referral Process Works a.root-servers.net

Step 3: Response Step 2: Query www.mycorp.com? Use dns.mycorp.com Step 4: Query www.mycorp.com?

dns.mycompany.com

Step 1: Query www.mycorp.com?

Step 5: Response 10.10.10.88

Step 6: Response 10.10.10.88

OK celel>

104




110

Mak

dns.other.com

dns.mycorp.com

Update the change in Active Directory

Read DNS from Active Directory

Multi-Master Replicat

ion

Active Directory Replica Active Directory Replica

www.syngress.com

DNS and Naming Strategies • Chapter 4

One of the benefits of Active Directory-integrated zones is that it removes the single point of failure for updates being written to a primary DNS zone file. If you are using DDNS, then you cannot be certain when a host will register itself in the DNS database. DDNS’ dynamic updates are helpful for reducing the administration needed for DNS since updates no longer require an Administrator to personally enter the RRs into the zone. However, a standard primary DNS server can become a single point of failure if it becomes unavailable. Since the primary server holds the only DNS database that can be updated, a dynamic update will fail when that server is down. There is always the chance for conflicts when Multi-Master replication exists. When Microsoft’s DNS is integrated with Active Directory, name-change conflicts are handled on a first-come, first-served basis. If two DNS servers create the same name or make changes to an RR, the first one to write it to Active Directory wins. You can convert a zone to any other type of zone. For example, you can convert a primary zone to a secondary zone, a secondary zone to a primary zone, a primary zone to an Active Directory-integrated zone, and so forth. If you perform a conversion of an Active Directory-integrated zone to a primary zone, you must delete the zone from all DCs that were also DNS servers authoritative for the zone. When a zone is converted to an Active Directory-integrated zone, DnsZone and DnsNode objects are added to Active Directory. Each zone becomes a DnsZone container, which then contains a DnsNode leaf object for each unique host name in the zone.The DnsNode objects have an attribute called DnsRecord, which can contain multiple record values associated with the DnsNode object.

NOTE Active Directory is loosely consistent, and that can affect results for name resolution. With Multi-Master replication, the Active Directory database occasionally can have conflicts, and those conflicts can affect an Active Directory-integrated zone. For example, a person in Site 1 can change the DNS record for Server1.Domain.com and at the same time, a person in Site 2 can change the records with different values. If a query is made to a DNS server in Site 1, the results will reflect one value and a query made in Site 2 will reflect the other value. After Active Directory synchronizes, the last change is replicated to all DNS servers for that zone. However, while the conflict exists, the name can be resolved in two different ways.

www.syngress.com

111

112

Chapter 4 • DNS and Naming Strategies

One benefit for Active Directory-integrated zones is being able to use Secure DDNS updates. Because Active Directory includes the ability to grant access rights to resources, once a DnsZone object is added to Active Directory, an Access Control List (ACL) is enabled.You can then specify users and groups who are allowed to modify the Active Directory-integrated zone. Secure DDNS is available only when you implement Active Directory-integrated zones.

Dynamic DNS In a network where IP addresses are statically assigned to servers and workstations, it is a simple extra step to update the DNS zone file with the IP address. DNS originally was designed for manual administration. However, networks have become increasingly dynamic. DHCP (as well as BOOTP) assigns IP addresses to network hosts, pulling the IP addresses from a pool, resulting in a merry-goround of IP addressing for any single network host. Keeping up with DHCP changes is too difficult with a manual DNS system. However, being able to use automatically assigned IP addresses is too easy to let go. DDNS was designed to keep up with the constantly evolving IP addresses on a network. Up to this point, DDNS has been mentioned as one of the recommended features of a DNS server in an Active Directory network. Once you become familiar with DDNS, and experience how well it works, you will discover why it is so effective. First, Active Directory publishes their addresses using SRV RRs, where the name of the Active Directory service is mapped to the address of the DC offering the service. SRV RRs use the form of ...When the Active Directory server is installed, it must have all the appropriate SRV RRs listed in DNS in order for other DCs and clients to contact it.There are several complex SRV RRs per DC in the zone file.The SRV RRs include priority and weight for the DC so that clients can select the most appropriate server. Dynamic updates allow computers to register themselves in the DNS system. Windows 2000 computers and its DNS service all support this, as well as the Windows 2000 DHCP service.The Windows 2000 DHCP service will remove any records that it registered upon the DHCP lease’s expiration. In order to use the benefits of dynamic updates, the DNS server must support RFC 2136. DCs can use DDNS to publish themselves.These DCs periodically will confirm their RRs to make certain that they are up to date. In Windows 2000 DNS, the server timestamps each RR as an aging mechanism. RRs are then refreshed periodically.When an RR does not refresh for a number of intervals, it is considered stale and is then scavenged from the database.This process greatly reduces

www.syngress.com

DNS and Naming Strategies • Chapter 4

the time and effort involved in administering DNS. In order to enable the aging and scavenging of Active Directory-enabled DNS: 1. RRs must be timestamped. 2. Zones must have a refresh interval and a no-refresh interval set. 3. Scavenging must be enabled for each zone and name server. 4. The name server must have a scavenging period established. DDNS uses a message format called update that can add or delete RRs from a specified zone after checking for prerequisites. If update does not discover the prerequisite conditions, then it will not update the zone file. Prerequisites include checking for a primary zone file and making certain that a zone transfer is not currently in progress.

Planning Active Directory and DNS There are four areas to document for an Active Directory and DNS namespace design.These will encompass both a logical organization of your network, including joint ventures, business units, and workgroups, and the physical network, including the geographic distribution of the users and the network topology.The four areas include: ■

Forest plan

■

Domain and DNS strategy

■

Organizational Units (OUs)

■

Site topology

Unless you register a private DNS name, using a local DNS namespace is easier said than done if you try to use a namespace that ends in “.com” or any other of the common Internet domains. However, Microsoft Active Directory supports the use of the “.local” domain for a private, local DNS namespace. In this scenario, a company called Cyberlabs could implement cyberlabs.com on the Internet and then implement cyberlabs.local on the private network.There would be a clear distinction between local and Internet resources, and there is no need to maintain near-mirrored, split-brain DNS servers because the internal namespace would not be exposed to the Internet.

www.syngress.com

113

114

Chapter 4 • DNS and Naming Strategies

Designing & Planning… Designing Active Directory on a Network Connected to the Internet When you select your Active Directory domain names and you are planning to be connected to the Internet, you can do one of the following: ■

Select a brand new, unique DNS name (or names) that you must register with InterNIC.

■

Use an existing DNS namespace that has already been registered with InterNIC and is running on the Internet providing Web services.

■

Use a subdomain of an existing DNS namespace that has already been registered with InterNIC but is not running on the Internet providing Web services.

■

Use a local DNS name that is completely outside the Internet.

You can have a separate DNS zone for a new DNS namespace, for a subdomain of an Internet-used DNS namespace, or for a local DNS namespace. However, you will have the most problems when you use an existing DNS namespace and share it with Internet Web servers. Sharing a DNS namespace with Internet Web servers provides a way for unintended persons to access your network simply by having the names of your Windows 2000 servers available in the DNS server that services the Internet. A person can run nslookup and check out the entries against your DNS server. The way to get around this is to establish two DNS servers with primary zone authority for the same namespace. Place one of the DNS servers inside your firewall and include all the Active Directory servers in that zone, as well as the Internet servers required for users to access the Internet. Place the second DNS server outside the firewall and make certain to exclude all Active Directory servers. Although this setup is confusing and requires extra management, it does provide a way to use the same namespace and maintain a measure of security.

Forest Plan The forest plan document for most enterprises will be a short document because of the nature of forests. A forest is a collection of multiple domain trees with www.syngress.com

DNS and Naming Strategies • Chapter 4

multiple namespaces that not only trust each other, but share a common configuration, schema, and global catalog.The trust relationships within a forest are transitive, and configured automatically. A forest is a logical formation that by itself does not significantly impact, nor is impacted by, the network’s topology.The structure within a forest is transparent to users.The Global Catalog shields them from domains and OUs. A forest should encompass most of the computers in any enterprise network, if not all of them.The forest plan should document the namespaces and trust relationships expected between domains. A pictorial representation of a forest is shown in Figure 4.7. Figure 4.7 Multiple Namespaces Exist in a Single Forest

root.com Intranet.com

myroot.com

sub.root.com

sub2.root.com

myroot.com Namespace 3

myroot.com Namespace 2

root.com Namespace 1

sub.sub.root.com

There are causes for having two or three forests: ■

A common schema A collection of objects and attributes allowed in the Active Directory database. www.syngress.com

115

116

Chapter 4 • DNS and Naming Strategies ■

A common configuration A globally available configuration for replication and interdomain activity.

■

A common Global Catalog index An actual user accounts and published resources in the tree.

The production network will benefit by being separated from any domains and forests that are connected to the Internet.This also applies to lab networks, since testing a different configuration or adding to the schema should be kept outside the production network until deployment. A separate lab forest or Internet forest keeps test users and public user accounts out of the production network’s Global Catalog. The final reason that an organization may implement more than one forest is for administrative separation.This is a common situation in companies that interconnect for joint ventures, or for those that have subsidiaries.The forest is the absolute separation of administrative authority.Two forests allow Administrators to have the authority over the configuration, the schema, the Global Catalog, and security completely separated from another Administrator’s sphere of control. Once a domain is created, it joins a forest.That domain cannot be moved between forests; it is a permanent member of the original forest. Furthermore, a forest cannot be split or merged (yet), but there is a tool provided for importing and exporting Active Directory objects, LDIFDE.exe, which is found in the WINNT\SYSTEM32 directory. LDIFDE (LDAP Directory Import File Directory Export) uses the LDAP protocol to access the forest’s Global Catalog, and to export the objects into a text file that can be imported into another forest. More about LDIFDE can be found in Chapter 10, “Building Trees and Forests.”

NOTE When you implement more than one forest, your users will need to learn about their namespace if they will be accessing resources outside of their own Global Catalog. They will be forced to query each domain directly for all resources that exist outside their forest.

Domain and DNS Strategy The DNS strategy requires you to examine the capacity requirements for your DNS servers.You should consider what performance you will require and ensure www.syngress.com

DNS and Naming Strategies • Chapter 4

that your DNS servers have adequate processing power and memory to achieve that performance level.

DNS Sizing The minimum hardware requirements for a Windows 2000 DC running the DNS service on an Intel processor server are 100 bytes of RAM per RR on top of the RAM required for the server operating system, and at least a Pentium II 400 MHz processor. A Windows 2000 DNS Server requires at least 4MB of RAM just to start up the service, before you have even configured zones on that server. As you add zones and RRs, the server consumes more RAM. As previously stated, each RR consumes about 100 bytes of memory, which isn’t much if you have a small internetwork. If you have a zone with 50,000 hosts only having A RRs, then you will need at least 4.6MB of additional RAM for the associated records. If you also require PTR RRs for each of those hosts, then you will need 9.2MB more RAM. If you have a significant number of hosts requiring other types of RRs, this figure could grow by another 4MB. Most servers have hundreds of megabytes of RAM, or even gigabytes of RAM, so ensuring that there is sufficient RAM for Windows 2000 DNS Server is not going to be a difficult task. Just be aware that you should ensure that the server has sufficient resources to ensure good performance.

Domain Divisions Domains are the top-level division within a forest.The domain should not only be treated as a logical division, but also as a physical division.The reason for this is that there is significantly more traffic within the confines of a domain than there is between domains. New domains should be added only when the replication, query, and authentication traffic will overwhelm the available bandwidth of a slow network link and it is not feasible to upgrade the link. The domain is an administrative division, offering a boundary for security policies. All objects within a domain are granted identical security policies, which can be accessed through the Security Settings MMC utility found in the Administrative Tools menu.These include: ■

Password policy

■

Account lockout policy

■

Kerberos ticket policies

www.syngress.com

117

118

Chapter 4 • DNS and Naming Strategies

Since the domain is the division for policies, it is also the division for authentication. In this case, a user authenticates for logon and access to resources to any of the DCs that belong to the user’s domain.The user cannot authenticate to any other domain even if it is in the same namespace or forest.

Designing & Planning… Legacy NT Domain Planning Issues No Longer Apply Windows NT domain planning had several issues that are now obsolete in the domain planning process for Windows 2000 Active Directory: ■

There is no longer a need to delegate administration by separating domains. Instead, legacy NT domains can be combined and OUs can be used for administrative delegation.

■

Since Active Directory is scalable to millions of objects, there is no longer a 40,000-user limit for the SAM, or Security Account Manager.

■

Active Directory uses Multi-Master replication, so there is no need to plan for a PDC or BDC. Instead, only DCs (Domain Controllers) must be planned.

Requirements All DNS Servers for zones that encompass Active Directory domains must support SRV RRs. At least one DNS Server must be installed and configured prior to the first Active Directory DC installation. In order to install the first DC: 1. Verify that DNS is configured on a server on the network. 2. Ensure that the network is connected to the server and functioning properly. (You can test it using PING, if you are not certain.) 3. Configure the server’s connection to the network as a DNS client with the IP address of a DNS server. 4. Verify that the DNS server has DDNS enabled for the zone, so that the server can register itself when it is promoted. 5. When the server has been promoted to a DC, validate that the server has registered its RRs in the zone. www.syngress.com

DNS and Naming Strategies • Chapter 4

NOTE You can verify whether you have the DNS infrastructure deployed correctly with a utility called dcdiag. This command-line tool can be downloaded from http://download.microsoft.com/download/ win2000platform/Update/5.0.2195.2103/NT5/EN-US/dcdiag_setup.exe.

Root Domain The first DC for a domain that should be installed for the forest is a DC in the root domain.This domain will be the first domain created in the forest, and since it contains the management information for the schema of the entire forest, it should contain servers that are distributed to a majority of physical sites (if possible). Be careful not to try installing a DC for a different domain in your plan before you install at least one of the root domain DCs. For example, if you have a plan that includes two domains, Root.com and Trunk.Root.com, and you installed a DC for the Trunk.Root.com domain, you would not be able to install a DC for the Root.com domain.You are limited to installing subdomains of a DNS namespace or a completely different namespace.The Domain Admins group of the forest root domain is, by default, the schema administrator group for the entire forest. In view of this requirement, there are two ways to design the root domain: ■

As a standard domain that contains user accounts and published resources

■

As an empty domain that has no purpose other than to publish the schema and make it available to all other domains

The first option has the advantage, especially when there is only a single domain, of being able to distribute more than just the schema to multiple sites. The advantages of dedicating a root domain as in the second option is that there are no Domain Administrator conflicts and the domain never becomes obsolete. There is another benefit with the second option: If you have an empty domain, then you can limit the members of the Domain Admins, Enterprise Admins, and Schema Admins groups without fear of unintentionally granting people membership to a group that gives them access to more rights than necessary. For example, if you upgraded an existing Windows NT domain to Windows 2000, then all the www.syngress.com

119

120

Chapter 4 • DNS and Naming Strategies

users who were members of the legacy Domain Admins group would be upgraded automatically to Administrator status in the Windows 2000 domain. Not only that, but being members of that group automatically would enable those users to become Enterprise Admins and Schema Admins. In the wrong hands, a user could make serious changes to the network, and in the case of the schema, irreversible changes.

About Domains The main recommendation for planning domains and DNS is simply to delegate a separate DNS zone for each Active Directory domain.This makes it easy to manage, especially in a decentralized administrative environment.You should ensure that there are at least two DNS servers available to DCs, or even running on DCs, in the Active Directory site. When planning domains, there are a few rules to consider that may impact the decisions you make for your network: ■

A domain’s name cannot be changed.

■

Two domains cannot be merged.

■

A single domain cannot be split into two.

You can, however, still use the import/export tool called LDIFDE.exe to move objects outside both the domain and the forest.To move objects within the forest, but to a different domain tree, use the MOVETREE tool from the Windows 2000 Resource kit. Both LDIFDE and the MOVETREE tool are described in Chapter 10, “Building Trees and Forests.”

DNS Servers Active Directory requires DNS servers to be available at all times. Although it is convenient to use Active Directory DCs to provide the DNS services, this may not always be feasible.To ensure that DNS is always available for Active Directory, the recommendation is to provide, at a minimum, one primary and one secondary name server per domain.This will enable: ■

Load balancing between the name servers

■

Faster access, especially when placing the secondary name server across a WAN link

■

Redundancy, in case of failure of one of the name servers

www.syngress.com

DNS and Naming Strategies • Chapter 4

If at all possible, it is recommended that there is at least one DC providing the DNS service in each site.This will enable much faster access and ensure that DCs are not cut off from DNS if a WAN link goes down.These servers can be secondary servers for the zone rather than primary. You should consider placing DNS servers on different subnets.This will provide a level of fault tolerance should the subnet become somehow disconnected from the remainder of the network. It will also provide a boundary in case of attacks against the subnet, especially attacks where a subnet is flooded with so much garbage traffic that legitimate traffic is rejected.

NOTE All of the client computers on the internetwork should be configured to query both a primary DNS server and a secondary DNS server. Clients will use the DNS service to locate a DC in their local site in order to log on to the network, as well as for queries for services.

Organizational Units Organizational units (OUs) are the container objects that sit within domains. OUs were designed to be flexible. An administrator can create them, delete them, and reorganize them at any point in time.They are a logical arrangement of objects that can be nested, and have no impact on the network traffic.Two items will impact the OU design: ■

Group Policy

■

Administration

In both of these cases, the OU is the boundary. Different group policies can be applied to different OUs. Different Administrators can be granted administrative access to different OUs, without concern for conflicts over administrative control. How you create the OU hierarchy can reflect the company organizational chart, or some other tree structure that seems sensible.The Microsoft utilities do not require users to navigate the hierarchy of OUs although some tools do expose them, so there is no true need to create OUs that serve no purpose other than the reflection of an organizational chart. Instead, focus on the purpose that www.syngress.com

121

122

Chapter 4 • DNS and Naming Strategies

the OU will serve—to provide group policy or administrative area, or to group a set of users logically together. OUs are the most flexible container objects in Active Directory. Unlike forests and domains, OUs can be created, moved, added, or deleted whenever needed.These changes have no impact on the network. Objects within OUs also can easily be moved, created, added, and deleted.When these changes are made, the major considerations are simply about how the group policy and administration issues will change. Group policies will affect the time that it takes for a user to log on.The more group policies there are, the longer it takes. If an Administrator applies multiple group policies to a single OU, the user’s logon time will suffer. If the user is located three nested groups down, and the Administrator has applied a single group policy at one of the levels, that user will log on faster than the user with multiple group policies applied to a single OU. Group policies are the reason for logon times being increased.The problem, however, with OU design is that when there are multiple nested OUs, Administrators are more likely to apply group policies to each OU in the hierarchy than to apply multiple group policies to a single OU.When planning the OU structure, make sure to state where group policies will be applied, and whether multiple group policies will be acceptable.

Site Topology Site topology is a representation of the physical network. It consists of sites that are connected by site links. (Note that this is very similar to Exchange Server’s directory in which sites are connected by site connectors.) The site is a physical division of the network.When users authenticate to the network, their authentication traffic will be directed to a DC within their own site. Additionally, sites will maintain more query and replication traffic within them. Sites, as well as their Active Directory names, should represent the physical network, and should have a DC within each.The site should consist of networks that are connected by fast and reliable links.They can be LAN or extremely high-speed WAN links. A site should not span a medium- or low-speed WAN link (e.g., less than 10 Mbps). Unlike domains, sites are easily added, moved, changed, or deleted.This is one of the methods that makes Active Directory scalable with the internetwork’s growth.To manage sites, you can use the Active Directory Sites and Services MMC utility, which can be located by clicking Start | Programs | Administrative Tools | Active Directory Sites and Services.

www.syngress.com

DNS and Naming Strategies • Chapter 4

Naming Conventions The key to a solid namespace design is simplicity.The simpler the namespace design, the easier it is to manage and scale up later on. The namespace design should fit the ideal network for the enterprise, even if the ideal network is not quite what exists currently. After designing the ideal network’s namespace, make adjustments only for the anomalous network devices. Eventually, the network will adjust toward the ideal by taking this approach. Finally, the namespace design should be enabled for change management. Most enterprises are not static entities. People are promoted to new positions, move to different departments, start new business units in another city or country, leave the company, and so on.The PCs that they use either move with them, or change hands and are reconfigured. New PCs, servers, and printers are added to the network and old ones are retired. All organizations experience these changes, just in varying percentages. If the Active Directory namespace does not support changes, it will not be a success. Instead, it should support changes so that it is easy to move objects around the tree. One way to enable Active Directory for change management is to standardize unique names throughout the tree.This simple standard will ensure that no conflicts from moves, adds, or changes will ensue.

Designing & Planning… Naming Conventions for the IT Manager Naming conventions for user accounts are sometimes the keys to the internetwork for hackers. Many organizations use a standard of the first letter of the first name and the first five to seven letters of the last name as a standard for usernames. Hackers find it effortless to discover a user’s name. The only other piece of information is the user’s password, which is sometimes written on a Post-It note and pasted on the PC itself, or sometimes given by an unsuspecting user to a call from “IT Support” (a.k.a. the hacker). The other thing that organizations typically do is to leave the default Administrator name for the network. In Windows 2000, this is a domain Administrator named “Administrator.” Again, hackers have half the key to the network when an organization leaves this account with its original name intact. Continued

www.syngress.com

123

124

Chapter 4 • DNS and Naming Strategies

Finally, organizations that are on the Internet already have a widely published domain name for their Internet presence. Many of them use that same name, or a subdomain of it for their private, internal network. Again, there is no guessing involved in locating servers on the private network for a hacker. So what does an IT Manager do to secure the network through naming conventions? ■

Do not use the user’s name, or permutations of it, as the user’s logon id unless you add numbers or other data to the logon id to disguise it.

■

Do not be tempted to use a United States social security number for a user’s id, either. A social security number not only places a user’s personal information at risk, but companies with international sites will have users who do not have social security numbers.

■

Rename the Administrator account. Remember, however, that some applications are written to look for the “Administrator” account in order to be installed, although most allow you to input a different name.

■

Create Administrator accounts with randomly generated names using both upper- and lowercase letters and numbers. Who is to know that the Administrator’s name is X3460GzwGm?

■

Always remember to enforce a strict password policy, especially if the organization is connected in any way to the Internet.

■

Register a new domain name with InterNIC for your internal network that is completely different from the one used on the Internet.

Aside from DNS naming conventions, there are other interoperability issues with names for most internetworks because of legacy systems. The following rules will help evade many trials and tribulations when connecting to legacy systems: ■

Always create unique names for users, computers, printers, and other resources.

■

Avoid the following characters when creating user or computer names since many computers will translate these Continued

www.syngress.com

DNS and Naming Strategies • Chapter 4

as encoding characters or will not understand them: !@#$%^&*()_?’”;:[]{}\|/., ■

Keep object names for logon ids to eight characters or less. Many legacy systems stop after eight characters.

■

Keep object names for computers to eight characters or less. Many legacy systems stop after eight characters.

■

Do not depend on the letter case (upper and lower) to create unique names. Many computers translate both Frank and fRANK to equate to FRANK, so they would no longer be unique.

■

Do not depend on a distinguished name to create unique names. Legacy systems may not understand context-sensitive names and will translate /CN=M1craft3/CN=USERS/ DC=Panther/DC=MicroAge/DC=com simply to be M1craft3. So if there is another M1craft3 in Active Directory, but in a different tree location or domain, the name will not be unique.

Defining DNS Names You can’t use just any name in a DNS zone database. For example, it wouldn’t accept someone’s street address with spaces and punctuation in the DNS database, so you couldn’t name a computer after its postal location.The rules regarding DNS names are simple: ■

Each host in the DNS database is allowed to have a name of up to 63 characters in length, and many allow names up to 255 characters.

■

All hosts must have unique names. For example, a host named george.microage.com and a host named george.eng.microage.com are each considered unique.

■

All subdomains must have unique names within their parent domain.

DNS names for each domain should be defined when creating the domain plan. Each domain should be assigned a name that follows the format of root.com. Domains that will share the same namespace as the forest root domain will have a subdomain name format of parent.root.com. Any domains beneath them in the domain tree hierarchy will have the sub-subdomain name format of child.parent.root.com. Further subdomains are allowed, but not recommended

www.syngress.com

125

126

Chapter 4 • DNS and Naming Strategies

because of the complexity added to the internetwork.Trust relationships will follow the tree structure. Each DNS root domain namespace should be registered with InterNIC.This will avoid conflicts if there is another one being used on a connected network or the Internet. The DNS name for a domain in the Windows 2000 is defined when the first DC for that domain is installed with Active Directory.The Active Directory Service is installed with the Active Directory Installation Wizard, as shown in Figure 4.8. Figure 4.8 Naming a New Domain in Active Directory

Designing & Planning… Naming Convention Rules for the IT Professional Microsoft’s DNS service that comes with Windows 2000 is more forgiving when it comes to naming conventions than the DNS applications from other vendors. Even if you are using Microsoft’s version of DNS, you may, at some point in time, connect to a network that uses a different vendor’s DNS. When that happens, the naming conventions that you are using will need to be compatible with both DNS versions. Otherwise, you will encounter a few problems. Continued

www.syngress.com

DNS and Naming Strategies • Chapter 4

Standard DNS naming rules, which are understood by all DNS versions, are as follows: ■

Use a registered DNS name. You can register DNS names with InterNIC.

■

Use the standard character set of A through Z, a through z, and 0 through 9 and the hyphen (-). Note that the Windows 2000 DNS will support both the underscore (_) and Unicode characters.

When in doubt, verify your naming strategy with RFC 1123, which is available on the Internet at http://freesoft.org/CIE/RFC/1123/index.htm.

Defining DNS Zones All DNS zones and RRs are managed in the DNS Management Console.To add a zone, follow these steps: 1. Click Start. 2. Select Programs. 3. Select Administrative Tools. 4. Choose DNS.The DNS Microsoft Management Console utility will start. 5. Select either Forward Lookup Zones or Reverse Lookup Zones below the server that will be managing the zone, depending on which type of zone you are adding. 6. Click the Action menu. 7. Select Create a New Zone.The Add New Zone Wizard will begin. 8. Select the zone type. 9. Assign a name and complete the wizard.The new zone will appear in the DNS utility. Adding an RR also occurs in the DNS Microsoft Management Console utility.

Naming Conventions for Active Directory Active Directory is an open directory service in that it supports a wide range of protocols, objects, and application programming interfaces (APIs).These are the www.syngress.com

127

128

Chapter 4 • DNS and Naming Strategies

mechanisms that define the availability of Active Directory to various types of clients. As a result of Active Directory’s support for diverse protocols, Active Directory supports many different name formats: ■

Internet e-mail addresses, as described in RFC 822—[email protected].

■

Uniform Resource Locators (URLs) for HyperText Transfer Protocol (HTTP)—http://www.mycorp.com.

■

Lightweight Directory Access Protocol (LDAP) names— LDAP://myserver.mycorp.com/CN=myname,OU=Users, O=Mycorp,C=US.

■

Universal Naming Convention (UNC) names—\\myserver.com\ myvolume\file.ext.

Such diversity in naming format support enables companies to select nearly any names that are appropriate for their company.The major influence on a naming convention will be the connectivity to external systems on the internetwork.Windows 2000 Active Directory is more forgiving than other systems for names in that it supports a wider variety of characters and character sets, and even lengthier names.

Configuring & Implementing… Virtual Containers Active Directory can incorporate information from other directory services through a virtual container. The other directory service must be LDAP-compliant for this to work. Active Directory implements a virtual container in what amounts to a pointer to an LDAP server in the foreign directory service. The foreign directory server’s DNS name is contained as part of the virtual container’s properties, which must be created manually by an administrator. When a client performs a query in Active Directory on the virtual container, DNS locates the foreign directory via the LDAP server that is listed in Active Directory and passes an LDAP query to it. The response to that query is returned to Active Directory, which then presents it to the LDAP client.

www.syngress.com

DNS and Naming Strategies • Chapter 4

Migrating an Existing Exchange Server Design Active Directory inherited many of its characteristics from Exchange Server’s directory system. Additionally, the design premises are nearly identical. If an organization already has a highly performing Exchange Server directory with basically the same scope of sites, users, computers, and servers, then it can mirror the design of Active Directory and expect good results.

Migrating an Existing Novell Directory Services Design Many organizations have invested a significant amount of time and effort in a Novell Directory Services design.This design is generally a geographical division at the top of the tree and an organizational division lower down. If the Novell Directory Services design follows this scheme and it has the same scope, it is easy to translate it into an Active Directory design. Instead of each top-level OU, replace it with an appropriate domain.Then retain the hierarchy of OUs that exist within that top level and place them within the domain.

Designing & Planning… Workstation DNS Names When a Windows 2000 workstation or Windows 2000 Server starts up, and periodically thereafter, it updates the DNS attributes for its own object in Active Directory. These attributes are dnsHostName and ServicePrincipalName. A failure to update these attributes can occur if the DNS domain name for the computer does not match the Active Directory domain name to which it belongs plus the Change primary DNS suffix when domain membership changes checkbox is unchecked in the Properties for My Computer on the Network Identification tab. To resolve this issue, you have two options: 1. Require the computer to change its domain name to that of the Active Domain. Simply check the box for Change primary DNS suffix when domain membership changes and restart the computer. Continued

www.syngress.com

129

130

Chapter 4 • DNS and Naming Strategies

2. Allow disjointed computer and domain names—this is not recommended because it opens a security breach. Open the Active Directory Users and Computers MMC in the domain. Make certain you have selected the View menu and checked Advanced Features. Right-click on the domain and select Properties from the pop-up menu. Click the Security tab, click Add. Select the Self group and click Add then OK. Click on Advanced, click Self. Select the View menu and then Edit. Select the Properties tab. Click on Computer Objects in the Apply onto area. Under permissions click Write dnsHostName and check the Allow check box.

www.syngress.com

DNS and Naming Strategies • Chapter 4

Summary DNS is tightly integrated with Windows 2000 Active Directory Services. Active Directory uses DNS for its locator service for the NetLogon service.The DNS must support SRV resource records, and preferably will support dynamic updates as well.This integration runs in both directions. Not only does Active Directory use DNS as its locator service, but Active Directory can manage and maintain the DNS information within itself as well. When Active Directory manages the DNS information, there are many benefits: ■

Multi-Master replication

■

Scavenging of stale RRs

■

Support for dynamic updates

Because of DNS integration, the entire Active Directory planning is involved in the DNS namespace design.There are four planning areas: ■

Forest

■

Domain

■

Organizational Unit

■

Sites

The forest plan describes the number of forests that will exist on the internetwork.The domain plan discusses the DNS namespaces, their hierarchy, and their corresponding Active Directory domains.The domains should denote a physical structure as well as a logical structure because of the amount of traffic that occurs within a domain.The organizational unit plan represents the logical hierarchy within the domain. It has little impact on the network, but provides an easy unit for administrative delegation. Sites are a physical representation of the network. When there are multiple sites, Active Directory uses site links to direct traffic between them. Naming conventions should be defined for the user accounts and published resources within Active Directory.The naming conventions should support Active Directory and any legacy systems to which users or computers may connect. Legacy systems tend to have stricter naming requirements than Active Directory. The DNS domain name is applied to a domain at the installation of the first domain controller in that domain. If using the Microsoft DNS service, DNS can www.syngress.com

131

132

Chapter 4 • DNS and Naming Strategies

be managed through the Microsoft Management Console DNS utility found in the Administrative Tools menu. Active Directory also uses DNS to locate and connect to foreign directory services, and treats them as virtual containers.

Solution Fast Track What Is DNS?  The Domain Name System (DNS) resolves names to Internet Protocol

(IP) addresses through a hierarchical system of servers and namespaces.  Zones are partitions of the DNS database that include a namespace and

may also include subdomains of that namespace.  Dynamic DNS (DDNS) enables a computer to register itself in the

DNS database rather than having an administrator manually enter the DNS records.

Active Directory’s Integration with DNS  Active Directory domain controllers must be able to contact a DNS

server during installation.  Active Directory servers and clients both use DNS as a locator service

via the Service Resource Records (SRV RRs) in the DNS database.  If a DNS service does not support SRV RRs, it will not integrate with

Active Directory.

Planning Active Directory and DNS  Make certain that your servers have sufficient capacity to support DNS.  Optimally, DNS Servers may be placed in every site so that both

Domain Controllers and client workstations can access Active Directory.  You should plan to include at least two DNS servers for each zone, one

primary and one secondary; or both Active Directory-integrated so that your DNS plan has built-in redundancy.

www.syngress.com

DNS and Naming Strategies • Chapter 4

Naming Conventions ■

When planning your namespace, you should strive for simplicity and scalability.

■

DNS names exclude the use of most punctuation marks and nonEnglish characters, unless you implement Windows 2000 DNS, which does allow Unicode characters.

■

When designating a naming convention for DNS, use the standard character set of A through Z, a through z, and 0 through 9 and the dash (-) character.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: Can we use a DNS server other than Windows 2000 DNS? A: Yes, but it must be able to support SRV RRs. Even if you have a Windows NT 4.0 DNS server, you will not be able to use it because it doesn’t support SRV RRs. However, a BIND 8.1.2.1 server can be used because it does support SRV RRs.

Q: Our company uses a DNS server that does not support SRV resource records (RRs). Can we use it when we implement Active Directory?

A: No. Active Directory relies on SRV RRs in order to locate domain controllers (DCs). All DNS servers for the namespaces that Active Directory encompasses must also support the SRV RRs.

Q: Our company uses a DNS server that supports SRV RRs but does not support dynamic updates. Can we still use it when we implement Active Directory?

A: Yes. However, dynamic updates are preferred when using the Windows 2000 DHCP service, which can dynamically register IP addresses and hostnames for clients, and can remove them from the DNS database once the DHCP lease has expired. www.syngress.com

133

134

Chapter 4 • DNS and Naming Strategies

Q: We are planning to create two forests on the internetwork.We will use one forest as a testing area and the other for production.We plan on developing the domains and their DCs on the test forest and then move them to the production forest later on. Is this a viable plan?

A: No. Although the use of a separate test forest and a production forest is recommended, domains do not have the ability to be moved from one forest to another. In this case, domains cannot be moved from the test forest to the production forest.

Q: The manufacturing department has a policy of changing passwords once every six months, while the HR department has a policy of changing passwords once every three weeks. Can these policies be implemented with OUs in the same domain?

A: No. Security policies, including the password policy, Kerberos tickets, and the account lockout policy, are applied to an entire domain. If there are two different security policies, they must be implemented in two different domains.

Q: We have installed two domains into our forest, and we want to install a third domain that will be the forest root. How do we go about doing this?

A: This is an impossible scenario.The first domain installed into a forest is the forest root. It is the home of the schema for the entire forest.There is no way to change the forest root domain.

Q: Will I be able to have Secure DDNS updates if I use Nortel’s DNS servers? A: No. Secure DDNS updates are only available with Active Directory-integrated zones, which in turn, require Windows 2000 DNS installed on Active Directory Domain Controllers.

www.syngress.com

Chapter 5

Designing the Basic Structure

Solutions in this chapter: ■

Designing a Forest

■

Designing a Domain Tree

■

Designing an Organizational Unit Structure

■

Designing a Site Topology

■

Using OUs for Delegating Administration

 Summary  Solutions Fast Track  Frequently Asked Questions

135

136

Chapter 5 • Designing the Basic Structure

Introduction To succeed in your Active Directory project, your enterprise’s business objectives should guide Active Directory design.This design will depend not only on your documented business objectives, but also on the network that already exists and the way that the enterprise is organized. Each company, organization, or even government office differs in its structure, and as a result has unique requirements for technology.Windows 2000 Server with Active Directory Services is flexible enough to meet most business requirements, but its implementation will vary widely because of these same requirements. When you design an Active Directory, there are four elements that must be planned. As a result, both Tekkietech.com and Insurance, Inc. (our two case-study, hypothetical businesses that will be discussed later), as well as any real companies, will require the same four documents: ■

Forest Plan

■

Domain/DNS Strategy

■

Organizational Unit (OU) Structure

■

Site Topology

Even though companies will have the same types of documents, the differences in the companies will generate very dissimilar contents.This chapter will deal with how a consultant will produce each of these documents for any company.

Case Studies In this chapter, you will follow the actions and decisions that a consultant might make when designing a network. Rules regarding network designs are never hard and fast; some network designs simply result in a more optimal performance than others. Even then, performance is not necessarily the top business driver for an organization. Security or costs may have a higher priority, thus precluding the highest performance that the technology is capable of.This chapter illustrates how to design a domain structure for Active Directory for two very different organizations, and shows how using business objectives affect the resulting technology implementation.

About Tekkietech.com The first organization is Tekkietech.com, a new Internet company that provides technical services around the globe. It prides itself on having the latest technology www.syngress.com

Designing the Basic Structure • Chapter 5

on its production network—even touting this fact from a marketing perspective in order to draw new customers.The Tekkietech.com sales division demonstrates new technologies on the production network to prospective customers. Tekkietech.com owns large offices having over 1000 users in each office, located in eight major cities all over the world.Tekkietech.com also owns small branch offices with less than 50 users each in various test markets.There is a European base of operations in Germany, several United States bases, two Australian offices, a large office in South Africa, and an office in Japan. Each continent competes against the offices in other continents, in a friendly way.This friendly competitive atmosphere was cultivated by the Chief Executive Officer as a means of producing larger sales figures.Tekkietech.com is involved in a joint venture with a German Internet Web development company.The joint venture uses a Domain Name System (DNS) namespace of Deutek.de.Tekkietech.com has the following business requirements: ■

The new network must be able to support widely varying technologies.

■

Performance of the network is the highest priority, since it is used to demonstrate technology as part of the sales process.

■

Downtime is not acceptable. Availability of the network is the next highest priority.

■

Internet connectivity is required for all sites—both incoming and outgoing traffic must be unhindered for users.

■

Security is required for the production, or private, network.The Internet portion of the network is publicly available, but the private portion of the network must sit behind a firewall and be secured from the public.

Tekkietech.com physical network consists of eight major sites and 72 branch offices. Each office, regardless of size, is connected via high-speed Wide Area Network (WAN) links with redundant failover connections to a major office in the same country. Most of the WAN connections are Asynchronous Transfer Mode (ATM), although some connections use OC-48 and T-3 lines. Half the users have laptops, the rest have desktops.There are at least four servers in each office. Some of them use Windows NT v4.0, some use NetWare with Novell Directory Services (NDS), and others use various versions of UNIX. All of the offices have a remote access server and an Internet Web server.The intranet Web servers (for internal use only) are all located in the United States in a single office and are managed by a single intranet Webmaster group. Other than the intranet

www.syngress.com

137

138

Chapter 5 • Designing the Basic Structure

Webmaster group, infrastructure support has several groups located in major sites. Most of the Web servers provide Internet pages, but the Web servers at the main sites provide additional Internet services such as File Transfer Protocol (FTP), and media services such as video presentations.Tekkietech.com has four registered Domain Name System (DNS) names:Tekkietech.com, tekkies.au, tekkies.de, and mytekkies.com.The mytekkies.com namespace is used for the intranet and the others are used for the Internet.Tekkietech.com’s business units are organized as shown in Figure 5.1. Figure 5.1 The Organizational Chart for Tekkietech.com

CEO

Internet

Development

Advertising

Administration

Web Management

Services

Engineering

Operations

About Insurance, Inc. The second sample organization is Insurance, Inc. Insurance, Inc. sells insurance through 3000 independent agencies all over the United States. It has a single, central office with 250 employees, referred to as HQ or Headquarters. HQ manages all aspects of the insurance sales, service, legal, claims, and marketing for the entire company.The agencies are not employed by Insurance, Inc., but are considered contractors who are paid commissions only on insurance contracts sold. Even though the agents are not employees, HQ supports their technology needs as they apply to the contracts sold through Insurance, Inc. For example, HQ deploys applications that help with sales to the agencies and supports those applications, but the agencies pay for their own hardware and operating system licenses. Insurance, Inc. is not on the bleeding edge of technology. HQ has a single computer connected to the Internet, located in the legal department and

www.syngress.com

Designing the Basic Structure • Chapter 5

used for verifying insurance laws and regulations on a subscription legal repository Internet Web site. A Web site may be developed in the future, but will be subject to the stringent laws regarding insurance sales in the United States.The initial Web site development committee is strongly recommending using a Webhosting company and keeping HQ’s network completely disconnected from the Internet for security purposes.The business requirements for the Active Directory project are as follows: ■

Insurance, Inc. is extremely concerned about the network’s security (as demonstrated by their meager Internet configuration).

■

Costs must be managed. Budget is their next priority.

■

Performance is the least of their worries.

■

The new Windows 2000 network should allow remote access by agents and employees because Insurance Inc. believes it will increase productivity.

■

HQ is extremely careful about licensing for software. As a result, no applications owned by Insurance, Inc. can be installed or run locally on a remote machine, only on a networked machine.

■

All executives will be assigned new laptops.The marketing department and managers may be given laptops or desktops.

■

Insurance, Inc. wants a centralized and easy-to-manage network, which mirrors their organization.

Insurance, Inc. currently operates a legacy Novell NetWare 3.11 network, and all workstations are desktops running Windows 3.1 or Windows 95. Most of these workstations are 486 and Pentium processor machines. Insurance, Inc. expects that all computers on the network will be replaced.The accounting department is running Token Ring; the rest of the office is running Ethernet over thick coaxial cable. Insurance, Inc. is planning to have the office rewired with Category 5 copper unshielded twisted pair wiring before rolling out Windows 2000.The IT department does not run a lab and is not considering building one. The network runs only the Internetwork Packet eXchange (IPX) protocol. Insurance, Inc.’s organizational chart is shown in Figure 5.2.

www.syngress.com

139

140

Chapter 5 • Designing the Basic Structure

Figure 5.2 Organizational Chart for Insurance, Inc.

Ins, Inc. President

Marketing

Advertising Leads

Agency Support

Finance/Legal

Operations

New Business

File Room

Insurance Service

Accounting

Legal and HR

IT

Designing a Forest The first thing the consultant will do is review what a forest is, what belongs in a forest plan, and the rules surrounding forests.This is a refresher step to ensure correct design. A forest is a group of multiple DNS namespaces (and multiple domains) that share a common configuration, schema, and Global Catalog. A forest plan describes the number of forests that will be positioned in the network, the reasons those forests were designated, the names of the root forest domain for each separate forest, and an optional pictorial representation of each forest. Like many engineers and consultants, our consultant likes to draw pictures because people find them easier to understand, so these forest plans will contain graphic representations of the final forest plan. Rules surrounding forests are as follows: ■

A forest cannot be merged with any other forest.

■

A forest cannot be split into two forests.

■

A domain cannot be removed from one forest and placed in another.

■

The root domain of the forest is the name by which the forest is usually referred.

www.syngress.com

Designing the Basic Structure • Chapter 5 ■

A namespace is fully contained within a single forest at its root, flowing down. For example, if domain.com is in the Domain.Com forest, then my.domain.com is also in the Domain.com forest.

■

A forest is a logical grouping, and has little impact on network bandwidth.

NOTE Some independent software vendors have developed utilities that can bend the rules surrounding forests and domains. It saves a lot of time and effort if you design your Active Directory in such a way that you won’t need to use such tools, but an organizational change, such as a merger, may require you to investigate into your options. Check out www.netiq.com and www.fastlane.com. You may even look to the Active Directory Migration Tool (ADMT).

Tekkietech.com Several namespaces already exist for Tekkietech.com.The mytekkies.com namespace is used for the private intranet, and the remaining namespaces are used for the public Internet.The Deutek.de namespace is set aside for a joint venture. Tekkietech.com may possibly want to add a lab namespace.The lab namespace would support Tekkietech.com’s need to use networking technology for demonstration purposes. Separating these namespaces into separate forests would keep them from sharing the schema, configuration, and GCs. For Tekkietech.com, the consultant has designed four forests, depicted in Figure 5.3. Each has been designated as a separate forest for the following reasons: ■

Tekkietech.com,Tekkies.de, and Tekkies.au all would become part of the Tekkietech.com production forest used on the Internet since each of these domains participates in the Internet.

■

Mytekkies.com would become the root of the internal, private forest also used for the intranet because it is not used on the Internet, providing a secure division.

■

Deutek.com would be the root of the joint venture’s forest, since it is the DNS namespace used by the joint venture.

www.syngress.com

141

142

Chapter 5 • Designing the Basic Structure ■

A new namespace would be registered for InterNIC to be used for a lab namespace because a new forest was designated for lab usage.To mirror the production forest, there would be three namespaces for this forest. Assuming that the consultant registers three namespaces for the lab— labtekkies.com, labtekkies.de, and labtekkies.au—they would comprise the fourth forest. Figure 5.3 Tekkietech.com’s Forest Plan

Tekkies.com Mytekkies.com Tekkies.de

Tekkies.au

Tekkies.com Internet Production Forest

Mytekkies.com Private Production Forest

Labtekkies.com Duetek.de Labtekkies.de

Labtekkies.au

Labtekkies.com Private Testing Forest

Duetek.de Joint Venture Production Forest

Insurance, Inc. Because Insurance, Inc. has never had a Web site, the consultant does not have an existing DNS namespace for Insurance, Inc. Active Directory cannot be implemented without a namespace.The consultant must register at least one domain name with InterNIC on behalf of Insurance, Inc. or consider using a .LOCAL www.syngress.com

Designing the Basic Structure • Chapter 5

namespace on the production network. Since the HQ IT department has no lab and is not considering building one, and Insurance, Inc.’s security requirements specify that no Internet connection will be established between the production network and the Internet (at least for the foreseeable future), there is no need for more than a single forest. (Remember, a separate forest would demand a separate schema, configuration, or Global Catalog. Also, forests with separate schemas cannot be joined.) The consultant decides to register a .com name—Insurinc.com—with InterNIC for Active Directory.This will be the namespace for the root domain of the forest. Figure 5.4 shows Insurance, Inc.’s new forest plan. Figure 5.4 The Insurance Inc. Forest Plan

Insurinc.com Insurinc.com Insurance Inc.'s Private Production Forest

Designing a Domain Tree The consultant initiates the domain planning session with the same steps as in the forest planning—with a review of domains, DNS, and the rules surrounding them. A domain is the top-level division within a forest.There is significantly more traffic within the confines of a domain than there is between domains, because the contents of the domain partition are replicated among all DCs that are members of the domain, but only forest level data (schema, configuration, and global catalog) are replicated between DCs that participate in different domains. Even so, each new domain adds an incremental traffic overhead.The traffic within a domain includes query, authentication, and further replication of the domain objects in Active Directory. Sites centralize this traffic somewhat by formalizing the paths for replication traffic. (More about sites and replication traffic in Chapter 6, “Designing a Site Structure.”) There is a preference to send query and authentication traffic to domain controllers (DCs) within the same site as the user making the request. New domains should be added only when the total of the www.syngress.com

143

144

Chapter 5 • Designing the Basic Structure

replication, query, and authentication traffic will overwhelm the available bandwidth of a slow network link and it is not feasible to upgrade the link.The domain is an administrative boundary, and new domains are sometimes added to respond to stringent administrative requirements. Domains theoretically can contain up to ten million objects.With the capability of domains and sites to be able to cross each other’s boundaries, determining the traffic needs becomes somewhat of an art.The following traffic guidelines are not absolute, but look for the following minimums: ■

512 Kbps available bandwidth within a site, whether or not it spans multiple domains

■

256 Kbps available bandwidth within a domain that spans multiple sites, where no sites span it and other domains

■

56 to 128 Kbps available bandwidth where a domain and site share a boundary—larger for those GCs with more than half a million objects

If using a single domain model, these issues do not apply. Aside from traffic issues, a domain can be added to the forest when the domain-level security policy for passwords and account lockouts must be different for two separate sets of users. Because of the security boundary, an empty root domain can be created to establish a core administrative root. DNS provides mapping between Internet Protocol (IP) addresses and computer host names. It can also map to further information such as Service Location Resource Records (SRV RRs). DNS is used by Active Directory as a locator service for logon, for locating DCs, and for Global Catalog servers. Rules surrounding domains and DNS are as follows: ■

A domain’s name cannot be changed if it is a root domain, or easily changed otherwise. Note that the domain’s globally unique identifier (GUID) cannot ever be changed, but display names for nonroot domains can be renamed in Active Directory.

■

Two domains cannot be merged.

■

A single domain cannot be split into two.

■

DNS must support SRV RRs.

■

DNS must be available for DCs at all times.

■

At a minimum, there should be one DC and one DNS server in each site.

www.syngress.com

Designing the Basic Structure • Chapter 5 ■

A DC also is allowed to be the DNS server running Microsoft’s Windows 2000 DNS service.

■

One recommendation is to have a single root domain hold the forestlevel information as a secure administrative boundary, and lower-level domains should then contain the resources and users in the tree.

■

Domains are an administrative and security boundary, so plan domains accordingly.

■

DNS names should be registered with InterNIC. InterNIC does not require subdomains to be registered, simply the parent domain level. Otherwise, you can use the .LOCAL namespace and deploy it solely on the private network.

Tekkietech.com Our consultant designed four forests for Tekkietech.com. Each forest will require a separate domain plan. But Tekkietech.com has eliminated the need to design more than one domain plan.The domains so far designated in the production Internet and joint venture forests will be concentrated in geographic areas. Tekkietech.com decides that they will have the DNS namespace represent single root domains (without subdomains) for each of the forests except the private, production intranet forest. For this forest,Tekkietech.com asks the consultant to create a comprehensive domain plan that will enable a flexible and growth-oriented domain strategy for subdomains. The consultant reviews Tekkietech.com’s existing network. Since Tekkietech.com desires flexibility, the consultant recommends that the root domain be empty—dedicated to the schema and forest-level information. Furthermore, the consultant decides all the DNS servers will be members of the root domain, which means that the consultant will be able to distribute the DNS servers and create Active Directory-integrated zones for Secure Dynamic Domain Name System (DDNS) updates at any site where the production forest needs to be.To do this, the consultant must designate at least one subdomain for mytekkies.com. Additionally, the consultant looks at the WAN links. All the production network sites are linked by high-speed network links and most have redundant, failover links.The availability of the bandwidth is very high on every link. RPCs can function across all links.There is no need to separate any domains to prevent replication from spanning a slow WAN link using Simple Mail Transfer Protocol (SMTP). www.syngress.com

145

146

Chapter 5 • Designing the Basic Structure

SMTP can be used only to replicate the schema, configuration, and Global Catalog. Because of that, it must be used only when domains do not span the link. Then the consultant looks at the logical configuration of Tekkietech.com.The offices exist in Germany, the United States, Australia, South Africa, and Japan.This involves a review of workflow and information flow between workgroups.The consultant knows that there are some security issues with international offices. For one thing, software containing 128-bit encryption cannot be shipped outside the United States. Additionally, there are some business politics that separate each office group by its continent.The consultant recommends that the level of domains below the root domain for mytekkies.com consists of the following: ■

Us.mytekkies.com Represents the United States. It uses 128-bit encryption exclusively from all other same-level domains.

■

Australia.mytekkies.com Represents Australia. It is separated from the other same-level domains for business politics.

■

Europe.mytekkies.com Represents Europe. It is separate from the other same-level domains for business politics.

■

Asia.mytekkies.com Represents Asia. It is separate from the other same-level domains for business politics.

■

Africa.mytekkies.com Represents Africa. It is separate from the other same-level domains for business politics.

The consultant looks further into the organization and network, and sees that all of the intranet servers are running in the United States and are managed by a single Webmaster group.This group wants to have complete control over the intranet.Therefore, below the Us.mytekkies.com, the consultant recommends that there are two subdomains, one dedicated to the intranet and the other dedicated to the private network.These are designated as: ■

Intranet.us.mytekkies.com

■

Net.us.mytekkies.com

The final domain plan for the mytekkies.com forest is depicted in Figure 5.5.

Insurance, Inc. So far, the consultant has designed a single forest in Insurance, Inc. with a root domain of Insurinc.com. In creating the domain design, the consultant considers that Insurance, Inc. is a relatively small company, having only 250 users, with a www.syngress.com

Designing the Basic Structure • Chapter 5

single physical location at its headquarters.The consultant knows that external connectivity will be provided with Windows 2000 remote access services (RAS) in conjunction with Windows 2000 Terminal Services to several thousand agents. The consultant knows that Insurance, Inc. is not growth oriented. It does not implement technology unless there is a business requirement for it. Insurance, Inc. does not have a large IT department, does not connect to the Internet because of strict security reasons, and does not have a technology lab.There is no reason to implement more than a single domain with a single DNS name, Insurinc.com, as shown in Figure 5.6. Figure 5.5 Domain Plan for mytekkies.com mytekkies.com

australia.mytekkies.com

europe.mytekkies.com

us.mytekkies.com

intranet.us.mytekkies.com

asia.mytekkies.com

africa.mytekkies.com

net.us.mytekkies.com

Figure 5.6 Insurance, Inc.’s Domain Strategy

Insurinc.com

www.syngress.com

147

148

Chapter 5 • Designing the Basic Structure

Designing an Organizational Unit Structure As in all other designs, the consultant begins with a review of OUs, their purpose, and their uses in the internetwork before beginning to design the OU strategy. OUs are container units that can be nested into a tree structure, or hierarchy, within a domain. OUs can contain user accounts, resource objects, and other OUs.They reside within a single domain, so each domain requires a separate OU design.The OU strategy provides an initial hierarchy within each domain, because administrators can change it at any time later. OUs are flexible enough to be changed as needed, with little or no impact to the network.This OU strategy may change over time, or at any time, to better meet the changing needs of the enterprise.The rules regarding OUs are as follows: ■

OUs can be created, moved, added, or deleted whenever needed.

■

OU changes have no significant impact to the network traffic, except for the small, initial update traffic replicating the change throughout all the DCs of a domain.

■

Objects within OUs can also be moved, created, added, and deleted easily.

■

OUs are containers for implementation of group policy.

■

OUs are containers for delegation of administration.

Tekkietech.com The consultant decides to simplify the OU structure design process. He decides that within each of the domains for the mytekkies.com forest the OU design will be identical. Since the domains are used to separate most of the political and administrative units, there is no need to create OUs for the delegation of administration. Group policies are not likely to be implemented except on a business unit by business unit basis.The company is exceptionally large, and each employee is easily identified by his or her business unit.The consultant decides to create the OU strategy shown in Figure 5.7. Note the similarity of this figure to the organizational chart in Figure 5.1, which the consultant duplicated to help Network Administrators work with user accounts. Although the original OU strategy is identical for each of the mytekkies.com subdomains, it can easily be changed to better meet business requirements later. Since the administrative model is distributed, it is highly probable that the OUs www.syngress.com

Designing the Basic Structure • Chapter 5

will not remain identical for long as administrators adjust and extend the tree to meet their administrative needs.The OU strategy, although important, is the simplest to design because there are no real impacts to the network or problems with changing it after the fact. Figure 5.7 OU Strategy for mytekkies.com Subdomains subdomain.mytekkies.com

Internet

Development

Advertising

Web Management

Administration

Services

Engineering

Operations

www.syngress.com

149

150

Chapter 5 • Designing the Basic Structure

Insurance, Inc. Insurance, Inc. already has a logical workgroup structure of associates at HQ. However, the consultant is concerned with handling the numerous agencies and their own employees that work independently yet are still associated with the company. Since HQ has a single IT department in a single location, there is no need for delegation of administration, and the IT department intends to implement group policy only for the accounting group. Insurance, Inc. must add the agency users into the domain in order to grant them access to the network, but they do not fit into the HQ organization chart. The consultant also soon discovers that the agency users have never been granted access to the network in the past, so they do not have existing user accounts on any of the systems.Tackling this issue, the consultant divides the top-level OUs into corporate and agency containers.Within the corporate container, the consultant reflects the Insurance, Inc. organizational chart.There are so many agents that the consultant does not want to lump them into the same container. Instead, the consultant places each state (since Insurance, Inc. sells only within the United States) beneath the agency container, and then the agencies within each state. This structure is represented in Figure 5.8.

Designing a Site Topology For the final design component, the consultant reviews Active Directory sites. Sites are not bound by anything but the forest. If you have more than one forest, you will need more than one site design. A site is a collection of IP subnets that are connected by fast, reliable links. Sites are typically LANs, and do not contain WAN links except where the WAN link is very fast and reliable.The site is used to create physical divisions of the network in order to localize traffic. It directs authentication and query traffic for users within a site to a DC within a site. Replication traffic is similarly controlled, where intrasite replication is executed upon update to the domain partition and intersite replication is executed on a schedule set by the administrator.The following design rules apply to sites: ■

The site topology should reflect the network’s topology.

■

Each site should have a dedicated DC.

■

No site should span a slow or unreliable network connection, especially WAN connections.

■

Sites do not need to be created for clients that connect via remote access.

www.syngress.com

Designing the Basic Structure • Chapter 5 ■

Sites should be created whenever replication traffic needs to be scheduled across a link.

■

Sites are easily added, moved, changed, and deleted.

Figure 5.8 Insurance, Inc.’s OU Strategy Insurinc.com

Corporate

Marketing

Advertising

Agency

New Business

Operations

Files

Service

IT

Finance-Legal

Accounting

Legal-HR Agency State Agents

www.syngress.com

151

152

Chapter 5 • Designing the Basic Structure

Tekkietech.com When the consultant looks at the Tekkietech.com network for the mytekkies.com forest site topology, it appears extremely large and complex.The network is interconnected by extremely fast and reliable network links. It also has the design separation already established between the offices in the five continents at the domain level.The consultant could very easily establish a single site within each domain to represent the offices within the continent.The consultant could also establish a site for each physical office, whether it is one of the eight major offices or one of the 72 test market offices, which would create 80 sites for the network. Considering that Tekkietech.com has enough DCs, both designs are feasible. The consultant must thoroughly examine the way that the WAN connections are established. It is discovered that each major office is a central hub for WAN connections to the nearest test market offices.This creates a network that consists of eight areas of concentrated WAN/LAN traffic. With this in mind, and knowing how easy it is to change the site topology at any point in time, the consultant decides to establish a site for each major office. If there are problems for any particular office that warrant it having its own site, then it can be added at that point in time.The consultant creates a site link system that directs traffic in a serial fashion throughout the sites shown in Figure 5.9.This places the traffic on links between sites that are nearest each other.The consultant has rejected the hub and spoke system, which would place a single site as the main hub for the sites and all other sites would link to it because the serial system actually reflects the network connections available. The consultant does follow the rules and places the following servers in each site: ■

A DC for the root domain of mytekkies.com

■

A DC for the domain in which the site actually resides; for example a DC for Japan.mytekkies.com would reside at the Tokyo site

■

A Global Catalog server

■

A DNS server

Insurance, Inc. The consultant has a very simple job when designing the Insurance, Inc. site topology because the company is so centralized. Since the Insurance, Inc. network is located in a single site, and all servers will be maintained at HQ, then no sites www.syngress.com

Designing the Basic Structure • Chapter 5

need to be created for remote access, and there need only be a single site for Insurinc.com with no site links required. Figure 5.9 Site Topology for mytekkies.com Forest

Sidney Australia

Brisbane–Sydney Link

Sidney–CapeTown Link

Brisbane Australia

Tokyo–Brisbane Link

CapeTown, South Africa Africa

Tokyo Japan

Tokyo–WA Link

NY–AZ Link

Phoenix, Arizona U.S.

New York, New York U.S.

AZ–WA Link

Hamburg–NY Link

Redmond, Washington U.S.

Hamburg, Germany Europe

Designing & Planning… Which Is the Best Design? There is more than one right way to design a network. Two different people can look at the same network with the same business objectives, and have somewhat different results. Optimal designs take into account the business requirements, the current network environment, and the potential growth of a company. The designs for forests, domains, OUs, and sites could be completely different for two companies and still be Continued

www.syngress.com

153

154

Chapter 5 • Designing the Basic Structure

considered “correct” or “good.” This reflects the flexibility of Active Directory more than it does the benefits of a good design. There are a lot of options that can be employed to reach a stated result. In the cases here, with Insurance, Inc. and Tekkietech.com, the selections the consultant made were based on the business requirements for the company and its existing environment. Would it have made sense to have two domains for the Insurance, Inc. network? Perhaps an empty root domain in the forest would better satisfy Insurance, Inc.’s security requirement. Perhaps it would be a good idea to separate the agencies from the corporate culture by creating a separate domain for the agencies, or maybe new domains could separate the operations folks from the marketing and legal departments, which would provide an administrative and security boundary. Would it add any benefits to the network to create that separation? Probably not. Because the growth of the network is slow, and because there is a single administrative group at HQ, a single domain would be easier for them to manage. In this case, simplicity of design is the best option. Performance was not a high requirement; centralization and ease of administration were. Here are some design tips: ■

Do not be afraid to create a design that seems aberrant from standard models, as long as it supports business requirements.

■

Try to keep your designs as simple as possible.

■

Pay strict attention to the design of items that cannot change or be moved, merged, or split, such as forests and domains.

■

Play with a couple of design scenarios before you select a final design. Make sure it supports each of your business objectives, and you can justify that design above the others.

■

Make sure that whatever design you specify, you will have enough servers to support its creation.

■

Always register your DNS names with InterNIC.

Using OUs for Delegating Administration As stated earlier, OUs are containers within a domain that can nest within each other to develop a hierarchy.They are used for group policy and for the delegation of administrative authority. One thing you must understand about an OU is that it is not a security principal.What this means is that you cannot apply access www.syngress.com

Designing the Basic Structure • Chapter 5

rights to the OU so that the users, groups, resources, other containers, and objects would inherit them. An OU is merely a container with no other capabilities. However, if you use OUs for group policy, then the group policies will flow down the tree structure that the OUs build. In addition, you can use the OUs to decentralize your administration without requiring a separate domain. An Active Directory user does not always have to navigate the OU hierarchy to locate services and information, so the optimal structure for OUs should reflect the boundaries needed for applying group policy or for delegating authority. It is a good rule of thumb to keep the OU names short enough to remember.

OU Objects in Active Directory OUs are container objects within Active Directory.When you look at OUs in the Active Directory Users and Computers MMC, you can look at their properties, which include the Group Policies applied to them. OUs contain other objects, such as user account objects or other OUs. Policies can be applied to OUs, and those policies can be inherited by sub-OUs. Using the OU hierarchy, you can produce a granular system for managing the desktop environment, security, and a user’s network experience.

Group Policy and OUs Group policy settings are applied to users and computers in order to manage the desktop configuration. A specific policy is applied to a site, domain, and/or an OU as needed.The group policy can be filtered to control access; otherwise it is inherited by child containers. Group policies will affect users’ login time when they are in a nested OU that has multiple group policies. Longer names for OUs will also affect processing at login time. See Chapter 13, “Intellimirror,” for information on how to apply group policies.

Delegating Administration The legacy Windows NT delegation of administration did not offer much in the way of flexibility: ■

Administrators were forced to use built-in local groups on the servers for administrative authority.

■

They had to adjust predefined rights if they were not sufficient or if they were too lax.

www.syngress.com

155

156

Chapter 5 • Designing the Basic Structure ■

Their administrative design typically resulted in oodles of Domain Administrators so that everyone could access what they needed to.

■

Administrators created resource domains just to delegate administration, which then resulted in too many domains and complex trust relationships.

Delegating administration is more powerful and flexible in Windows 2000 than it was in earlier versions of NT. Using the flexibility of Active Directory, delegation of administrative responsibility can be applied at the OU level.The Administrator can assign administrative rights for each object’s attribute, and whether that control can be inherited.The result is that the appropriate Administrators are granted the appropriate control of their assigned users and published resources. If an Administrator delegates Full Control to another user, then that user is able to delegate administrative authority to others. Otherwise, the delegation of administration is completed by selecting the authority level over each object class and the ability to modify specific attributes.The process is fairly simple: 1. Create a group. 2. Grant the group specific access. 3. Populate the group with users. Windows 2000 even supplies a Delegation of Control Wizard in the Active Directory Users and Computers Microsoft Management Console (MMC) utility (which can be found in the Administrative Tools folder under Programs in the Start menu).This makes the process even easier to execute.The following steps must be taken to use the Delegation of Control Wizard (see Figure 5.10) in order to delegate Full Control to another Administrator for a single OU (the OU is also called a folder in the wizard). 1. Click Start | Programs | Administrative Tools on any DC. 2. Select Active Directory Users and Computers. 3. After the window opens, in the left pane of the window, navigate to the OU to which you will be delegating administrative rights. 4. Right-click on the OU and select Delegate Control from the pop-up menu. 5. The wizard box will start with a Welcome dialog. Click Next. 6. The next screen will show the path of the folder. Click Next. 7. The Group or User Selection screen will appear. Click Add.

www.syngress.com

Designing the Basic Structure • Chapter 5

Figure 5.10 Customized Delegation

8. Select the group to which you will be giving administrative access. 9. The group’s name will appear in the window.Verify it is correct and click Next. 10. In the Predefined Delegations window, select Do customized delegation and click Next. 11. In the Active Directory object, type window.You can select either the entire folder or a custom list of objects that are in the folder. Select Entire folder and click Next. 12. In the Permissions box, you can select a variety of permissions (see Figure 5.11).To delegate full administrative rights, you will need to select Full Control.Then click Next. Figure 5.11 Reset Password Is an Option in the Permissions Box for User Objects

www.syngress.com

157

158

Chapter 5 • Designing the Basic Structure

13. The final dialog will show you a summary of the options you have selected. Click Finish to enable delegation. If you click Back, you can change your options. If you click Cancel, no changes will be applied. (See Figure 5.12.) Figure 5.12 Summary Dialog

After completing this exercise, there is a way to verify that the changes are applied. In the Active Directory Users and Computers window, select the View menu and then the Advanced Features option.You can then right-click the OU for which you delegated control, then select Properties. On the Security page, click Advanced.The Permissions tab will show you the additional permissions created for the group. If you double-click the group, you will see that it has been granted full rights to all of that OU and any OUs within it. Another way to verify that the group has been granted access correctly is to log on as a user account that is a member of that group.Then start the Active Directory Users and Computers Wizard and try creating a new group. There are some challenges with delegating administration. For many with experience in other directory services, the most difficult problem with delegating administration for a container is with somehow losing the delegated Administrator’s password—whether the Administrator has forgotten it, or left the company, or some other mishap has occurred. For this reason, it is a good practice always to have a master administrative account that is granted access to every container, even if it is intended to be completely cut off.The account should be set aside in a secure place for disaster recovery purposes only.

www.syngress.com

Designing the Basic Structure • Chapter 5

Configuring & Implementing… Controlling Who Can Reset Passwords One of the most common problems users run into is that they forget their password. Usually this happens the day after they were required to change their password. Only certain Administrators can access that type of user control in legacy environments, so this capability typically is retained by a high-level IT group. In a large organization, it can become a huge headache! Active Directory can be an aspirin for this particular headache, if an organization has a group such as a Help Desk that is connected to the network. In this case, Active Directory allows the delegation of only the password resetting right. The Help Desk would have no other rights to the directory and could handle the password resets immediately. To delegate this specific right, create a group for the Help Desk. Then follow the Delegation of Control process up to the Predefined Delegations window in step 10. Here you would select the Delegate one or more of the predefined delegations, and from the check-box list, select only Reset passwords on users accounts. It is a simple matter of finishing the wizard after that.

www.syngress.com

159

160

Chapter 5 • Designing the Basic Structure

Summary Designing an Active Directory structure consists of four design objectives: ■

The forest plan

■

The domains and DNS strategy

■

The organizational unit (OU) strategy

■

The site topology

All designs should be based on the business requirements of the enterprise. When a design is based on a business requirement, it will better serve that enterprise—even though another design may be more optimal for a different company with the same size and locations, but with different business objectives. Although the forest plan is a simple document detailing the number, root domain, and purpose for each forest, it is the first set of decisions that must be made toward the final Active Directory implementation.This plan must be made wisely because the forests cannot be merged, split, renamed, or otherwise redesigned after they are implemented. The most critical decisions that will be made are those that affect the Active Directory domains and DNS strategy. DNS is compulsory for Active Directory to function.The DNS names used should be registered with InterNIC if new ones are required for the DNS strategy. Domains are both a physical and logical structure for Active Directory. Each domain has its own DNS name.The design for the domains should be treated with as much assiduousness as the forest plan because domains have the same permanent features:They cannot be merged, split, or renamed after they are first created. Since an OU is a logical grouping container in Active Directory and has no real impact on the network traffic, it can reflect the organization or another functional plan. OUs can be used for applying group policy and for delegating administration. OUs can be renamed, moved, created, and deleted at any time. Sites are a representation of the physical network. Sites are considered to be a group of IP subnets that share fast and reliable network connections.The site should not span any slow or unreliable WAN links. Each physical campus or building can be considered a site, or when using extremely fast WAN links, a group of geographically distant but well-connected areas can become a single site. Using OUs for delegating administration is a great tool for Administrators that prevents all the legacy Windows NT issues of creating groups of Administrators and multiple domains and trusts. An OU can be created arbitrarily, and specific rights www.syngress.com

Designing the Basic Structure • Chapter 5

can be assigned to a user or group for administration; this is both flexible and effective.This capability can enable an Administrator to provide password reset rights only to a group, which means that they can reset a password and not change any other information in Active Directory.Windows 2000 Server provides a wizard to delegate control, which simplifies this activity.The Delegate Control Wizard is accessed by right-clicking an OU in Active Directory Users and Computers MMC, then selecting Delegate Control from the pop-up menu.

Solutions Fast Track Designing a Forest  When designing a forest, remember that the forest cannot be merged

with another forest or split into multiple forests without using thirdparty utilities.  A large, distributed company may require multiple forests for lab,

Internet, production network, and even joint ventures.  A centralized company without a lab or Internet site will probably need

only a single forest.

Designing a Domain Tree  Each forest will require a different domain design consisting of its DNS

namespace(s) organized into domain trees.  A large distributed company’s domain design can begin with an empty

root domain that is designed to hold the administrative roles for the forest.  A small centralized company’s domain design is likely to consist of a

single domain that will contain all user, group, and administrative accounts as well as all computer, server, and domain controller objects.

Designing an Organizational Unit Structure  When designing an OU structure, don’t be tempted to use an organiza-

tional chart to dictate the OU design.

www.syngress.com

161

162

Chapter 5 • Designing the Basic Structure

 A large distributed company can use OUs to delegate administrative

duties to administrators and users at other sites.  A centralized company may design the OU structure to take advantage

of group policies that affect different types of users.

Designing a Site Topology  After the site topology has been designed and configured, you can move,

change, delete, and add sites at any time.The site topology will grow with your network.  A large distributed company will have sites for locations with many users

and servers.These locations should be separated from other sites by WAN links.  A centralized company located in a single building or campus will

require only one site, even if there are users that dial in to the network via remote access.

Using OUs for Delegating Administration  In legacy Windows NT, users who needed to execute even small admin-

istrative functions often were granted full administrative rights, and that may have resulted in a security breach.  When restructuring domains, the top-level OUs can represent the users

and resources that were contained formerly in separate domains.Then, Full Control administrative rights can be delegated to the former domain administrators for each separate, top-level OU, resulting in the same capabilities over their respective objects.  An administrator can grant specific rights, such as the ability to change

passwords only, to other users. In this case, a Help Desk can receive the right to change passwords at the time a user calls in, without being granted unnecessary administrative rights.

www.syngress.com

Designing the Basic Structure • Chapter 5

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: Our group has created a forest plan that consists of three forests.We have only a single registered DNS name.We would like to use the same DNS namespace for each of the forests. Can we do this?

A: No. Each forest must have its own dedicated DNS namespaces. A namespace cannot cross forests.

Q: There are two office buildings in our organization and we have a fractional T-1 line running between them at 256 Kbps.We have a legacy Windows NT domain that covers both sites. Can we keep this same domain design?

A: Yes.The domain design is flexible enough to span WAN links, but it is preferable not to.This should not prevent an existing legacy NT domain structure from being upgraded into Active Directory in its existing configuration.We recommend creating two separate sites with their own DCs—one site to represent each building—in Active Directory.This will help manage the traffic crossing the WAN.

Q: Two people in our OU planning group want to recreate the organizational chart for the OU structure.The rest of the group wants to create a structure that reflects the administration of the network.We intend to delegate administration through the OUs.Which is the right way?

A: That depends. If the administration of the network is in a one-to-one correspondence with the organizational chart groups, or even if there is one administration group to several organizational chart groups, then the organizational chart method will be effective for both. If there are two groups of Administrators who are each supposed to manage a part of an organizational chart group, then they will end up stepping on each others’ toes by sharing the OU administrative rights. In this case, the OUs should reflect the administration groups, or a combination of the two.

www.syngress.com

163

164

Chapter 5 • Designing the Basic Structure

Q: We are planning to implement three group policies separately, but want to create an OU structure that has several levels. Can we do this?

A: Yes.You can create three OUs at the top of the tree for the group policies. Then create an OU structure that makes sense below those three OUs. If you move a user, however, remember that the group policies affecting that user will change, too.

Q: Our company has eight buildings, but six of them are on a campus connected by fiber optic cabling and high-speed connections. Should we create eight sites or three?

A: In this case, you should probably create three sites.The campus really represents a single site under the definition of “collection of IP subnets that share fast and reliable links.”

Q: What permissions are required to move an object from one OU in a domain to another OU in the same domain?

A: You must have administrator or administrator-equivalent rights to both OUs in order to move objects between them.

Q: If I have a group in an OU named Groups, and all the users in that group are located in an OU named MyUsers, and I wanted to apply a group policy that applied to those users, to which OU should I apply it?

A: You should apply the group policy to MyUsers. A group policy is applicable only to user objects and computer objects, as indicated by the two nodes in a group policy named Users and Computers. If the group policy were applied to the OU named Groups, then it would have no affect on anything except the user or computer accounts contained in the Groups OU.

www.syngress.com

Chapter 6

Designing a Site Structure

Solutions in this chapter: ■

The Function of Sites in Active Directory

■

Replicated Active Directory Components

■

Site Replication Components

■

Replication in Active Directory

■

Planning a Site Structure

 Summary  Solutions Fast Track  Frequently Asked Questions

165

166

Chapter 6 • Designing a Site Structure

Introduction When designing a site structure, you are also delving into network traffic management. In Active Directory, you are no longer at the mercy of an automatic update of all the data sent across the wire at predetermined intervals, as was done between legacy Windows NT PDCs and BDCs.You see, sites are the basic building blocks of a replication topology, and replication is update traffic within Active Directory that can be controlled, scheduled, and even sent using two different protocols. Since sites are used to establish the replication topology, it was convenient to use them to manage other types of Active Directory traffic— namely that generated by logons, authentication, and queries. Managing traffic through sites is a new concept for Microsoft Windows networks.Windows 2000 Active Directory is not aware of the actual physical network without an Administrator configuring the overall site topology. Even if an Administrator may have designed a domain structure that mirrors the physical network, it will not provide the traffic management that a site topology will. However, a domain structure and a site topology are interdependent when it comes to the behavior of traffic generated by Active Directory. Using objects to represent the physical network, an Administrator can model the network in a variety of ways and confine traffic to network areas where there is plenty of bandwidth for it.To illustrate this concept, consider a network with multiple offices around the globe. Some offices are located physically close to each other and have fast network links between them provided by T-3 lines with well over 1.5 Mbps of available bandwidth (more than a T-1 line). Smaller offices with fewer end users are simply connected with slow network links such as ISDN 128 Kbps or Fractional T-1 lines at 256 Kbps.The network Administrator may have a concern about how the different network traffic caused by Active Directory may affect the available bandwidth on these connections. Creating a replication topology can alleviate this concern. Active Directory’s method of managing network traffic centers around its use of several new objects.These objects represent physical areas and connections in the network.Traffic is transmitted by one of two replication protocols.The objects with which you will build a replication topology are: ■

Sites

■

Connections

■

IP subnets

■

Site links

■

Site link bridges

www.syngress.com

Designing a Site Structure • Chapter 6

The Function of Sites in Active Directory Traffic management in Active Directory is based upon how sites function. Sites represent a physical boundary in the network. As a rule, sites should be fashioned based on the geography of the network.They then centralize the domain controllers (DCs) to which traffic should be directed in that area. A site is used by traffic as though it were a concentration of network servers and computers in a single geographic location. For instance, if a corporation held its headquarters office in Boston, Massachusetts and a satellite sales office in London, England, each with its own Active Directory Domain Controllers (DCs), the Network Administrator should create two separate sites: one for Boston and the other for London.This design will make certain that Boston users will log on and the resulting traffic will be directed to a DC in Boston, and London users’ traffic will be directed to a London DC.The network Administrator can configure the sites to manage other traffic as well. Sites represent a physical structure and domains represent a logical structure. Therefore, sites can span domains. Furthermore, several domains, or parts of domains, can exist within a single site.This occurs when a domain design separates each domain by its location.This design is illustrated in Figure 6.1.When a site spans multiple domains, there is an increase in the replication traffic within that site because two domain databases must be replicated in addition to the schema, configuration, and Global Catalog for the forest. Figure 6.1 Sites Span Domains

root.com tree.com

Site B

left.tree.com

Site A

www.syngress.com

167

168

Chapter 6 • Designing a Site Structure

Not only can sites span domains, but the opposite can occur—domains can span sites. If so configured, there can be several sites within a domain.That means that DCs from a single domain can be located in different sites.This design results from domains spanning multiple geographic locations, as shown in Figure 6.2. Figure 6.2 Domains Span Sites

Site A

tree.com

Site C

root.com

Site F

Site D

Site E

left.tree.com

Site B

Sites are specific to a forest. If there are multiple forests in the same location, a site must be created in each forest for that location.There are few limitations on how a site is designed, and sites can be created, deleted, or changed at any point in time. If you do not carefully manage your site design and ongoing creation, it may result in a rather confusing arrangement of your replication topology. Sites and placement of DCs will likely change over time due to the growth and changing business requirements of the company. A network is never finished. At any point in time, a single forest in your network might have sites spanning domains, in addition to domains spanning sites, as shown in Figure 6.3. If you want to ensure that traffic is managed, you will want to carefully specify where servers can be placed and how sites should be created. Administrators may use a written statement or policy regarding how sites can be created, and managing server placement to help control network growth from excessively impacting traffic. If sites are created improperly, there can be some unintended results. For example, consider a geographic location that normally would be considered a single site because it consists of only well-connected IP subnets. If the network Administrator decided to split those IP subnets between two different logical www.syngress.com

Designing a Site Structure • Chapter 6

sites, then some users may experience high performance for logons and queries, while others experience a lag.This is due to the fact that the network Administrator could have placed the IP subnets with the Global Catalog servers and Domain Controllers into one logical site, but not into the other. If there are Global Catalog servers and Domain Controllers in both sites, but configured replication occurs on an infrequent basis, then there may be inconsistent data. This could be confusing, especially for users who move around the building. Figure 6.3 Domains and Sites Span Each Other

Site A

tree.com

Site C Site E root.com

Site F

Site B

left.tree.com

Site D

Problems can arise if two (or more) geographical locations, both with large numbers of users and domain controllers, are combined into a single site even though the two locations are split by a WAN link.When users log on or query Active Directory, their logon or query can be directed to a Global Catalog server that exists on the other side of the WAN link.This would probably result in very poor performance. Replication traffic also would be spontaneously transmitted across the WAN link at frequent intervals, and whenever updates are made to www.syngress.com

169

170

Chapter 6 • Designing a Site Structure

DCs.This traffic may consume an excessive amount of WAN bandwidth, even to the point of interrupting production-level traffic. Sites are not part of the DNS namespace; they simply set a geographic boundary for managing network traffic.This means that you will not have a name for a site such as site.domain.com.You will not be able to ping a site, and it won’t be assigned a host name or IP address. Sites determine the proximity of network computers for those that are sending Active Directory-based data, such as replication, authentication, and query traffic. For instance, clients will be directed to DCs within their designated site when authenticating or querying.

Default-First-Site-Name Amazingly, or maybe not so amazingly, the first DCs that are installed within Active Directory automatically are placed within a site called Default-First-SiteName, as shown in Figure 6.4.This can be viewed in the Active Directory Sites and Services console found in Administrative Tools.The Active Directory Sites and Services MMC is used for nearly all site management. Figure 6.4 Default-First-Site-Name

The Default-First-Site-Name name can be changed.To change the name: 1. Click Start | Programs | Administrative Tools | Active Directory Sites and Services. 2. In the left pane, click the plus sign (+) next to the Sites container to expand it. 3. Right-click the Default-First-Site-Name. 4. Select Rename from the pop-up menu. 5. You can then type the name directly into the pane. www.syngress.com

Designing a Site Structure • Chapter 6

Replicated Active Directory Components Several components within Active Directory must be replicated. Some of these are replicated solely within a domain, whereas others are replicated to all parts of a forest.

Domain Partitions The Active Directory database is partitioned at each domain. For example, if you have a domain named domain.com and another domain named syngress.com, then the DCs in domain.com will contain a partition of the domain.com domain, and the DCs in syngress.com will contain a partition of the syngress.com domain.The DCs maintain a replica of the partition for their own domain and no other.This replica is identical to all other domain replicas until an Administrator makes a change to the domain. At that point, the change is replicated to all other domain replicas.The domain partitioning enhances performance for the database, since smaller database parts enable faster response to queries and more efficient processing. Using Figure 6.5 as an example, if a change is made to a user account in tree.com, the replication is affected only in tree.com. Neither leaf.tree.com nor trunk.tree.com are impacted, unless the network Administrator has defined bridgehead servers to pass through traffic from one site to another through one of those other domains.The sites that are affected with the update replication are site A and site C. Sites B and D are not affected because they do not contain any DCs for tree.com.

Global Catalog The entire Active Directory forest is represented by a single Global Catalog.The Global Catalog is a database that contains a partial replica of every object in each Active Directory domain within a single forest. In effect, the Global Catalog is an index of all the information that is contained within all the domain partitions. The Global Catalog provides a single database to search for users or resources. This database is dealt with as though it were another partition to be replicated. Any DC can be designated as a Global Catalog server. Because the Global Catalog server provides logon authentication for UPNs and the source data for queries, there should be at least one per site to retain query traffic within the site boundaries. Additionally, Universal groups publish their entire group memberships within the Global Catalog.You only should make global groups members of www.syngress.com

171

172

Chapter 6 • Designing a Site Structure

universal groups, rather than placing user accounts directly in them. If there are thousands of users within a Universal group, the Global Catalog will increase tremendously.This will increase the time it takes for users to logon because the Global Catalog will search through each member of the Universal Groups. However, if you nest global groups within Universal groups, then the published membership in the Global Catalog is greatly reduced even though the membership within the Universal group is the same. Figure 6.5 Domain Partitions

Site C

Site A

tree.com

trunk.tree.com

Site D

leaf.tree.com

Site B

To designate a server as a Global Catalog server, use the Active Directory Sites and Services console. 1. Expand the Sites container by clicking the plus sign (+) to the left of it. 2. Expand the site that contains the server. 3. Expand the Servers folder. 4. Expand the server you wish to designate as a Global Catalog server. 5. Right-click NTDS Settings, located below the server.

www.syngress.com

Designing a Site Structure • Chapter 6

6. Select Properties from the pop-up menu. 7. In the Properties dialog, check the box for Global Catalog server, as shown in Figure 6.6. Figure 6.6 NTDS Settings for a Global Catalog Server

NOTE When there is a single domain within Active Directory, the burden of replication on the Global Catalog is not going to be taxed as if it were in a multidomain environment. Because there is a single naming context (for the single domain in the forest), User Principle Names (UPNs) are not required. Since Universal groups are useful mainly in distributing objects between domains, they too would not be required. However, in an organization that grows quickly, even if it starts with a single domain, the forest may grow to have multiple domains in the future. Therefore, you should plan for Global Catalog server placement and replication, even if you have a single domain. Your first automatically installed server will become the first Global Catalog server.

Schema and Configuration Containers All DCs in an Active Directory hold a copy of the schema and the configuration for their designated forest. Both the Schema and Configuration containers must be replicated to every DC to ensure consistency throughout the entire forest. www.syngress.com

173

174

Chapter 6 • Designing a Site Structure

Since the schema and the configuration are relatively static, they have very little impact on replication traffic.

Site Replication Components Replication requires an Administrator to configure different sites and the objects associated with those sites manually, before it can be managed. Several objects must be created and then configured within an Active Directory forest: ■

Site objects

■

Connection objects

■

Site links

■

Site link bridges

■

NTDS settings

Site Objects A site object represents an Active Directory site. A site is a set of well-connected IP subnets. Furthermore, well connected means that the subnets are linked together and have substantial bandwidth available to those links.The site object is an Active Directory object.You assign IP Subnet objects to it in order to define which subnetworks are bounded within the site. There are no hard-and-fast rules regarding which links are considered well connected and which are not, so designating an IP subnet to a particular site can be somewhat of a confusing decision.The characteristics of sites can help make this decision. Microsoft designed sites to reduce bandwidth consumption between sites, yet still enhance performance of the replication topology. The first DC installed is placed in the Default-First-Site-Name. All other DCs are placed within the same site as the first DC, or into a site designated as the default site for the Active Directory forest. If another site is created that contains an IP subnet to which a new DC’s IP address belongs, the new DC automatically will join the other site rather than the default site. After installation, new DCs can join various sites within Active Directory.

Knowledge Consistency Checker A network Administrator must generate a site design by creating site objects, connection objects, site links, site link bridges, and connection objects.This process is www.syngress.com

Designing a Site Structure • Chapter 6

almost completely manual when you have multiple sites. But there is some automation built into Active Directory replication.This is handled by the Knowledge Consistency Checker (KCC).The KCC is a built-in service that works on each DC. It checks to make certain that an update will be fully replicated inside that site within a default 15-minute time period. If there are inconsistencies, the KCC will rebuild the intrasite replication topology by generating appropriate connection objects.The KCC also builds intersite replication topology after sites have been created. The KCC will also look at site links to determine whether connection objects are needed for intersite replication. However, the KCC will not generate nearly as many connection objects for intersite replication as it will for intrasite replication.This is why an Administrator should thoroughly review connection objects when there are multiple sites.The KCC will not remove any connection objects that have been created manually. Workstations attempt to contact DCs within their own site for logon.The KCC will designate replication connections between DCs within a site and Administrators must manually configure connection objects with DCs in other sites.When replication occurs between different sites, the replication traffic is compressed to reduce the bandwidth consumption.Where replication occurs within a site, the replication traffic is not compressed to increase the speed of processing the replication. Finally, the replication within a site is triggered whenever a priority change is made to the domain database, as well as on a default five-minute interval, and replication between sites occurs based on a preset schedule.

Connection Objects A connection object represents the flow of replication between DCs within a site. Each connection object corresponds to unidirectional replication from one DC to another DC. Either the KCC will create connection objects automatically or the Administrator must create them manually. If you want replication to occur in both directions between two DCs, you must create two connection objects— one for each direction. Connection objects are found below the replication target DC, and they point to the replication source DC in a “pull-based” configuration.This means that if you were creating a connection object for replication traffic that flows from a server named DC1.root.com to DC2.root.com, then you would create the connection object under DC2.root.com for inbound traffic. Specifically, you

www.syngress.com

175

176

Chapter 6 • Designing a Site Structure

would create it within the NTDS Settings object for DC2.root.com. In this way, the connection object’s replication traffic flows in a single direction. An Administrator can create a connection object, or it can be created by the KCC on the destination DC.The KCC connection objects are created automatically and are sufficient for replication.The only time that an Administrator needs to create connection objects manually is to reduce latency or manage replication scheduling.The KCC will not delete any manually created connection objects, nor will it create a duplicate connection object where a manually created one exists. When you create a connection object between two DCs, the partitions that are common to both partitions are replicated automatically. Connection objects are not aware of the replication that has occurred with other connection objects. For example, if DC1.root.com pulls a copy of the domain partition from DC2.root.com, and it also has a connection object pulling from DC3.root.com, it will pull the domain partition updates again from DC3.root.com.

Site Links Without site link objects, DCs in different sites would not be able to communicate without extensive manual configuration of connection objects. Site link objects represent two or more sites and a network link between them. If there are more than two sites involved in a site link object, they are considered to be in a star configuration. Site link objects guide traffic between sites using a protocol, either IP or Simple Mail Transfer Protocol (SMTP). Each site link object represents a link of a particular type and all the attached sites to that link, and should have an equal cost. For example, a frame relay network may have several sites attached to it, and that frame relay network would be represented by a single site link object. The site link object contains information such as availability for replication, cost of using the link, and how often replication can occur for the link, as shown in Figure 6.7.The site link object offers a way for Active Directory to understand how to use the connection. Site link objects are used to connect DCs from different sites together.You should have at least enough site links to create a path that links every site to all the other sites, even if the replication traffic must flow through sites to get to other sites in a transitive configuration. The properties that influence how a site link object is used are: ■

Cost

■

Replication frequency

■

Schedule of availability

www.syngress.com

Designing a Site Structure • Chapter 6

Figure 6.7 Site Link Object Properties

Cost is the logical expense of using a site link object.When a cost number is high, then the logical expense of the messages is high, and that cost of messages is directly translatable into the amount of bandwidth that is available for them. Microsoft designed replication to select a link more frequently for low-cost messages and less frequently for high-cost messages. In routing scenarios, cost is established traditionally in inverse proportion to frequency or priority of a link’s usage. Since the site link object represents an actual network connection, replication frequency should be increased as the cost decreases in any particular object.When this value is configured, provide a value for the number of minutes, between 15 and 10,080 minutes.When there are redundant site links representing redundant network connections, Active Directory will select only the site link with the lowest cost: Less bandwidth = higher cost = less frequent replication

The schedule can intervene in an automatic replication system simply by setting up whether the link can be accessed.The schedule enables the link for certain blocks of time, then disables it during the remaining hours.

Site Link Bridges A site link bridge object consists of two or more site link objects.You create a site link bridge object in order to establish a transitive routing system. A site link bridge object creates a forwarding system, which models multiple segment www.syngress.com

177

178

Chapter 6 • Designing a Site Structure

routing, between site link objects that have sites and protocols in common. A site link bridge cannot exist between site links that have no mutual sites.When a site link bridge is created, the cost of the site links is additive. You could create a site link instead of a site link bridge to represent the transitive traffic between sites.The issue is handling costs. If you create the site links, and then a WAN link is upgraded from a T-1 to a T-3, you will be forced to reduce the cost of every site link object that encompasses that WAN link. However, if you use a site link bridge, then you only have to update the cost of the single site link that represents that WAN link, and all the site link bridges will be adjusted automatically. For example, Joe’s Parts, Inc., shown in Figure 6.8, has three sites: one in London, one in Sydney, and the third in Tokyo. Joe’s Parts’ Administrator creates a site link between London and Sydney called LONSYD, and another site link between Sydney and Tokyo called SYDTOK, because those site links represent the WAN links on the network.To ensure that replication will flow through from London to Tokyo, the Administrator must create a site link bridge between LONSYD and SYDTOK. If LONSYD has a cost of 2 and SYDTOK has a cost of 3, then the site link bridge has a cost of 2+3=5. Figure 6.8 Joe’s Parts, Inc. Site Link Bridge

Sydney

t2

SYD

s - Co

SYD

TOK

- Co

st 3

LON

Implied Site Link created by Site Link Bridge between London

LONSYD and SYDTOK - Cost 5

Tokyo

The default behavior of Windows 2000 is to have the Bridge all site links option enabled.What happens then is that site link bridges are ignored.This causes site links to be deemed part of one huge bridge. www.syngress.com

Designing a Site Structure • Chapter 6

Replication Protocols Two protocols are used for replication traffic: ■

Remote Procedure Calls (RPCs) over IP

■

SMTP

When you choose to use IP for your replication protocol, you are actually selecting RPCs over IP. RPCs over IP are used for traffic within a site between DCs over connection objects, and for replication traffic between sites across site links. RPCs are a Session-layer API that executes applications on remote computers but appears to be executing them locally. RPCs can be executed over other protocol stacks, such as Vines and IPX. However, in Active Directory, RPCs are supported only when executed over IP.To execute an RPC, the underlying network protocols must be in complete working order. If a DC’s network interface card (NIC) or DNS configuration is not working correctly, an RPC error may be the result. IP seems an obvious choice for a replication traffic protocol, but SMTP is not. SMTP was selected as the protocol to use solely for intersite (between sites) replication. SMTP, in this case, is asynchronous and appropriate for slow or lowbandwidth WAN links. SMTP-based replication is not supported for sites that contain DCs from the same domain; it can be used only to replicate Global Catalog, schema, and configuration data. Site links and site link bridges are created below the transports they utilize, as shown in Figure 6.9. Figure 6.9 Site Links Are Created within the Appropriate Transport Container

www.syngress.com

179

180

Chapter 6 • Designing a Site Structure

Replication in Active Directory Replication is the process of updating the data within the Active Directory database across all DCs containing a copy of that data. Replication is not limited to updating user accounts or computer objects. It includes updates made to the physical configuration of sites so that all DCs are aware of changes to the replication topology, and extensions made to the schema so that all DCs are aware of what types of objects they can have created on them. Plus, it includes all the data associated with all other objects, including users, groups, servers, computers, DNS objects, and others.This results in several levels of replication data: ■

Configuration Replicated to all DCs in the forest.

■

Schema Replicated to all DCs in the forest.

■

Domain partitions Replicated to all DCs in a domain.

■

Global Catalog Replicated to all DCs designated as Global Catalog servers.

The Global Catalog is a handled as though it was a domain partition, so typically you will see only configuration, schema, and domain information discussed in replication. Replication is an essential component to a distributed database system.When copies of the Active Directory database exist in multiple locations, and a change is made in one copy, the other copies must be synchronized with that update. Since there is a delay in time between the point at which an update is made and the point at which an update is fully synchronized or converged across the internetwork, Active Directory is called loosely consistent.The synchronization of updates is accomplished through replication.The result is that users are able to access Active Directory at any time, in any site or domain within the forest. Replication in Active Directory will: ■

Select efficient connections and site links.

■

Use multiple routes through the internetwork to provide fault tolerance.

■

Minimize the cost of replication by updating only the changed information.

■

Provide a method of conflict resolution.

Replication will occur between any two DCs with the minimum of the Schema and Configuration containers being replicated. Replication between any www.syngress.com

Designing a Site Structure • Chapter 6

two Global Catalog servers includes the schema, configuration, and Global Catalog. Replication between two DCs within the same site consists of the schema, configuration, and domain database. If those two DCs are also Global Catalog servers, then the replication traffic will have schema, configuration, domain database, and Global Catalog. You can create bridgehead servers to direct traffic between two different sites. Replication traffic will treat bridgehead servers with preference. A bridgehead server in a site will receive all updates from within the site and exchange those updates with other sites via site links and site link bridges.The bridgehead server will receive replication traffic from other sites and then replicate that to DCs in its own site.To establish a server as a bridgehead server, in the Active Directory Sites and Services management console: 1. Right-click the server. 2. Select Properties from the pop-up menu. 3. Click on a transport (either IP or SMTP, although IP is required if any domain spans the site link). 4. Click Add to make this server a bridgehead server for the selected transport, as shown in Figure 6.10. Figure 6.10 Setting Up a Bridgehead Server

Replication Topology The replication topology is the configuration of connections within a site, and the site links between sites.The intrasite (connections inside a site) configuration www.syngress.com

181

182

Chapter 6 • Designing a Site Structure

is generated automatically by the KCC.The KCC runs as a service that operates on each DC. It creates the connection objects between DCs, especially those that are located within the same site.The service executes every 15 minutes to reconfigure the replication topology, checking for bandwidth changes and new DCs so that optimal replication can take place. The KCC ensures that replication occurs by reviewing the replication topology and creating additional connection objects to provide redundancy or to overcome a failure in the replication.To do this, the KCC attempts to establish a replication topology that includes a minimum of two connection objects to each DC. Although the KCC automatically generates a replication topology, it can be overwritten by an Administrator creating new connection objects.The replication topology manages how DCs communicate with each other. The replication topology between sites must be created manually by an Administrator.The use of bridgehead servers and site link bridges can enable an efficient design. Scheduling the intersite replication can further make the replication topology effective. Each naming context has its own replication topology.This is due mainly to the fact that each context has a separate place to which it is replicated: ■

The schema and the configuration’s naming context applies forestwide, so they share a single replication topology across all sites and domains, and are replicated to every DC in the forest.

■

Each domain has a separate naming context, and its replication topology applies across all DCs within it, and any sites to which they may belong.

■

The Global Catalog follows the paths created by the domain partition topology, but does not confine itself to DCs within a single domain.

The replication topology is built on top of the sites in a single forest.There is no replication between forests.Within each naming context, a bidirectional ring is created and the spanning tree algorithm is used to prevent routing loops of replication traffic when redundant links exist. The optimum site topology is one in which domains and sites are in a one-toone correspondence. For example, if domain A is completely within site A, and domain B is completely within site B, the intersite traffic consists of only Global Catalog, schema, and configuration information, and the intrasite traffic is limited to a local domain plus the Global Catalog, schema, and configuration traffic. If a site consists of four DCs that are within the same domain, the replication topology resembles Figure 6.11. Note that in these diagrams, wherever one or www.syngress.com

Designing a Site Structure • Chapter 6

more double arrows exist between DCs, two connection objects must exist, one in each direction. Figure 6.11 Replication Topology in Same Site for Same Domain

svr1.root.com

Schema/Config Naming Contex t

svr4.root.com

root.com Naming Contex

root.com Naming Context

Schema/Config Naming Context

root.com Naming Context

Schema/Config Naming Context

t

Schema/Config Naming Contex t svr2.root.com

root.com Naming Contex

t

svr3.root.com

The replication ring for a single site with two domains in it is more complex. This replication topology demonstrates the incremental bandwidth overhead of sites that span multiple domains.The replication topology is depicted in Figure 6.12. The replication topology becomes more intricate as multiple sites are added. As you have seen in each of the previous figures as well as the following figure, there is no stated path for the Global Catalog namespace. Global Catalog replication is somewhat counterintuitive, since the data for the Global Catalog simply will follow the same path that the domain namespace follows. Figure 6.13 www.syngress.com

183

Chapter 6 • Designing a Site Structure

illustrates a replication topology for two sites that each contain DCs from two separate domains. Note that in Figure 6.13, two DCs in each site have been designated as bridgehead servers. Figure 6.12 Replication Topology in Single Site for Two Domains

Schema/Config Naming Context

Schema/Config Naming Context

Sch Nam ema/ ing Confi Con g tex t

root.co Naming m Contex t

root.com Naming Cont ext

com root. tree. Context ing Nam nfig a/Co t Schem g Contex in Nam

svr5.tree.root.com

svr4.root.com

svr1.root.com

tree.roo Naming t.com Context

root.com Naming Context

svr7.tree.root.com

Schema/Config Naming Context root.com Naming Context svr2.root.com

tr Nam ee.roo t. Sch ing Co com Nam ema/ ntext ing Conf Con ig tex t

Schema/Conf ig Naming Cont ext

184

Schema/Config Naming Context svr3.root.com

svr6.tree.root.com

The KCC executes on each DC to generate connection objects to handle intrasite replication. Every KCC service on each DC uses the same algorithm to compute the replication topology, ensuring that they all arrive at the same result. This process happens automatically so that Active Directory updates can propagate automatically throughout the site. For a bridgehead server, the KCC on a single DC in a single site will generate the intersite topology, creating inbound connection objects for all bridgehead servers in its own site.This DC is called the InterSite Topology Generator (ISTG).The ISTG will create the connection objects in its own copy of the configuration context, which is then propagated throughout the forest through normal replication. A DC does not need to be a bridgehead server in order to be the ISTG for a site. www.syngress.com

Designing a Site Structure • Chapter 6

Figure 6.13 Replication Topology for Two Sites with Two Domains

Schema/Config Naming Context

Schema/Config Naming Context

ig onf xt a/C onte m C e Sch ming Na

root.co Naming m Contex t

root.com Naming Cont ext

Schema/Config Naming Context

Schema/Config Naming Context

root.com Naming Context

nfig Schema/Co t ntex Naming Co root.com ntext Naming Co tree.root.com t ntex Naming Co

ig Schema/Conf t Naming Contex root.com t Naming Contex tree.root.com t Naming Contex

Schema/Config Naming Context

Schema/Config Naming Context

svr9.root.com

Nam root.c ing om Con tex t

svr9.root.com

root.com Naming Context tree.root.com Naming Context

fig Con ma/ text Sche ing Con Nam

root.com Naming Context

svr7.tree.root.com

svr6.tree.root.com

svr3.root.com

svr2.root.com

Schema/Conf ig Naming Cont ext root.com Naming Contex t

m t.co t .roo Contex e e tr ing ig onf Nam ma/C ntext cS he ing Co Nam

svr11.tree.root.com

Schem a Namin /Config g Con tree.r text Namin oot.com g Con text

Schema/Conf ig Naming Cont ext

svr1.root.com

Sc Na hema min /C g C onfi ont g ext

svr5.tree.root.com

svr4.root.com

tree.roo Naming t.com Context

root.com Naming Context

Schema/Config Naming Context svr10.root.com

svr11.tree.root.com

www.syngress.com

185

186

Chapter 6 • Designing a Site Structure

NOTE You do not need to be concerned about the replication of operations masters, which are commonly referred to as FSMOs or Flexible Single Master Operations. These servers own tasks that should be executed only on a single DC either within its own domain or within the entire forest. The confinement of these tasks to a single DC ensures that they either are managed securely or cannot cause corruption to Active Directory if there were a conflict. Conflicts are greatly reduced when only one server can perform a task. The types of servers are: ■

■

■

■

■

Domain Operations Master The single DC in the forest that can add/remove domains from the forest. Schema Operations Master The single DC in the forest that can extend the schema. PDC Emulator The single DC in a domain that acts as a PDC for legacy Windows NT BDCs and handles password updates. Infrastructure Operations Master The single DC in a domain that can update SIDs of objects in the domain. Relative Identifier Operations Master (RID) The single DC in a domain that can generate groups of SIDs distributed to the other DCs in the domain.

The first DC placed within a site is granted the ISTG role, and remains the ISTG unless it becomes unavailable. Other DCs know whether the ISTG has become unavailable by looking at the InterSite Topology Generator attribute on the NTDS Settings object below the ISTG’s server object.This attribute is periodically refreshed. If the refresh is missed, then the DCs in the site know that the ISTG has gone down and a new DC is elected to become the ISTG.The new DC elected is the first DC listed in the site. If two DCs are both holding the ISTG role due to a downed ISTG being brought back up again, then there may be additional connection objects created until the change identifying the new ISTG is replicated. At that point, the new ISTG’s KCC adjusts the replication topology to remove any additional connection objects. You can change the refresh interval in the registry at HKLM\System\ CurrentControlSet\Services\NTDS\Parameters. Change the value of the KCC site generator renewal interval from the default 30 minutes.You can change the time in which a new ISTG is elected by changing HKML\System\

www.syngress.com

Designing a Site Structure • Chapter 6

CurrentControlSet\Services\NTDS\Parameters. Change the value of the KCC site generator failover from the default 60 minutes to the failover time you prefer.

Planning a Site Structure The primary goal of site structure planning is to ensure that users, Administrators, applications, and servers have up-to-date information about the rest of the directory, and can access that information at any point in time from any location.The more mobile a workforce, the more quickly this synchronization must occur. For example, if a traveling user were visiting Office A, which is located in Site A, and that user changed his password, he would be able to log on anywhere in Site A due to the intrasite replication topology that updates that password change to all DCs in the site within 15 minutes. However, if that traveling user visited Office B in Site B the next day, and intersite replication had not occurred, the user might have some problems logging on.This example is extremely unlikely, because the PDC emulator should have received the update and been contacted by the authenticating DC in Site B for the latest password. It still could occur though, if the link between Site B and the location of the PDC emulator went down—then there might be a logon problem. Rarely is anything truly failsafe. Even though you need to distribute the directory information throughout the internetwork, you must balance that with an optimal network performance. Uncontrolled updates to Active Directory could consume network resources at times when they shouldn’t.There are several mechanisms within Active Directory that can help you manage and optimize Active Directory replication traffic: ■

The KCC re-evaluates network connections every 15 minutes, and changes them to the most efficient configuration.

■

Connection objects and site links can be configured with multiple routes, enabling fault tolerance.

■

When an update is replicated, it consists only of the attribute, its new value, and the location of the object in the directory, reducing the amount of traffic generated for any object change.

One of the first planning decisions is whether to establish multiple sites, and if so, how many. Separating the network into sites gains the following: ■

Traffic from workstations and servers is localized.

■

Replication traffic is optimized between DCs.

www.syngress.com

187

188

Chapter 6 • Designing a Site Structure ■

Response performance from DCs is increased, typically resulting in reduced response time.

■

Overhead traffic is reduced over WAN links.

All of these items translate into enhanced performance from the perspective of the end user.The reasons to create a new site would be to gain performance and reduce overhead on the network. A site should be created separately from the default site only if it has a DC dedicated to it; otherwise it would not be involved in the replication topology. A separate site should be created for any office that has enough users to rate a dedicated DC. A site that has more than 30 users probably would benefit from having a DC. A site with less than five users probably would not.These are only suggested guidelines.The actual decision to place a DC and create a new site is one built of business requirements, usage, and performance requirements. Site links should be created to provide reliability and fault tolerance to the intersite replication topology. A single site link is sufficient to send data between two separate sites. However, multiple redundant site links can make the topology fault tolerant. You can configure the cost, replication frequency, even the availability of the site link.These values will provide the KCC with information it can use in creating connection objects. If there are two sites but no site link, then the KCC will not generate any connection objects between the sites.This will result in no replication occurring between the two sites. Firewalls can be problematic. If a site, site link, or site link bridge spans a firewall, the directory updates may fail unless the sending DC is configured as a firewall proxy.To design two locations separated by a firewall, you should create two different sites, then designate two DCs (one in each site) as bridgehead servers that are also configured as firewall proxies. When planning the site structure, the main organizing factor is the physical network infrastructure.The infrastructure typically is built to mirror the geography of the organization’s places of operation. For example, Grape Drapes has its headquarters in Paris, a manufacturing plant in Florence, and sales offices in New York and London as depicted in Figure 6.14.The infrastructure most likely would have a hub and spoke configuration, with links between Paris and all other locations. A single domain could encompass the entire corporation, and separate sites dedicated to each location would be most effective to centralize traffic. Since the KCC automatically generates each site’s internal replication topology, the

www.syngress.com

Designing a Site Structure • Chapter 6

only thing that must be planned are the site links, site link bridges, and bridgehead servers between the sites. Figure 6.14 Grape Drapes’ Network Infrastructure

London Sales

Paris HQ Florence Manufacturing

T1/

E1

3

T3/E

E1

T1/

New York Sales

In the Grape Drapes scenario, there are three WAN links, for which three site links should be created. Remember, a site link represents a network connection and the sites involved in that connection. Each link will require cost and frequency of replication. Florence has the fastest link to Paris with the T3/E3 link, whereas the other two links have much less bandwidth in T1/E1 links; therefore, the Florence cost should be lower and the frequency should be higher.The New York sales office is not available for replication during 10 A.M. to 2 P.M. in order to reduce the cost of the overseas link.The three site links can be created as shown in Table 6.1.

www.syngress.com

189

190

Chapter 6 • Designing a Site Structure

Table 6.1 Site Links for Grape Drapes Site Links

Cost

Frequency of Replication

London–Paris NY–Paris

5 5

45 minutes 45 minutes

Florence–Paris

1

20 minutes

Schedule Available all hours Available 12:00 A.M. to 10:00 A.M., and 2 P.M. to 11:59 P.M. Available all hours

This will enable replication to occur between any site and Paris, but does not enable replication traffic to occur between New York and Florence, New York and London, or London and Florence.To enable this type of connection, site link bridges must be created.The site link bridges should use Paris as the site in common.The site link bridges in Table 6.2 would be created for Grape Drapes. Table 6.2 Site Link Bridges for Grape Drapes Site Link Bridge

Site Link 1

Site Link 2

Cost

London–NY Florence–London NY–Florence

London–Paris Florence–Paris NY–Paris

NY–Paris London–Paris Florence–Paris

10 6 6

WARNING SMTP is asynchronous, and normally will ignore the schedule set on the site link properties. The only time that the SMTP site link schedule should be set is when the underlying network link itself is only live during certain time periods.

Placing Domain Controllers There should be at least one DC in each site.This will provide an efficient localization of traffic for queries and authentication. Every site should have at least one site link associated with it. Each site has to be associated with a subnet in order to be functional. Since a site is defined as a collection of well-connected subnets, each subnet associated with the site will automatically place a client workstation, server, or DC that is on that subnet into the site. It is recommended that the sites and their subnets are www.syngress.com

Designing a Site Structure • Chapter 6

designed and implemented prior to installing any machines—except, of course, for the first DC in that forest. When using a firewall, or when a site is connected to other sites only through a low-bandwidth network connection, a bridgehead server should be designated for intersite replication traffic. If using any SMTP-based site links, then a Certificate Authority (CA) service must be installed in the forest.The CA signs the SMTP packets, which enables their acceptance by the receiving DC.

Where to Place Global Catalog Servers There should be at least one Global Catalog server on a DC in each site.The main issue with the Global Catalog is how large the forest is.The larger the forest, the larger the Global Catalog, and the greater the replication traffic.This replication traffic is simply between Global Catalog servers. When there are fewer Global Catalog servers, there is less replication traffic, but there is more traffic for queries and authentication from workstations.When there are more Global Catalog servers, there is more traffic for replication, but less for queries and authentication from workstations. Replication traffic can be controlled between sites via the frequency and scheduled availability for the site link, so the most effective placement of Global Catalog servers is to ensure at least one server in each site. Another issue to consider when placing Global Catalog servers is that there will need to be an Infrastructure FSMO server for the forest.This Infrastructure FSMO cannot be run on the same DC as the Global Catalog, except in the case when the first DC is installed in the forest, which does place them on the same DC. As soon as you add another DC, you should either move the Infrastructure FSMO role or the Global Catalog role to a different server. Since the Infrastructure FSMO is flexible and can be changed from DC to DC as needed, each site that may possibly host the Infrastructure FSMO must also have a separate DC for the Global Catalog. The Global Catalog cannot be run on the same DC as the infrastructure FSMO because the FSMO is responsible for cleaning up stale references from objects in its domain to objects in other domains of the forest.The stale references are those objects that have been moved or renamed.This means that the local data is out of sync with the Global Catalog.The only way that the two can synchronize is by the FSMO server verifying the objects’ validity against the Global Catalog. If the Infrastructure FSMO and Global Catalog are housed on the same server, it will never recognize any references as stale, and cleanup will not occur. www.syngress.com

191

192

Chapter 6 • Designing a Site Structure

Summary A site is defined as a set of IP subnets that have a high amount of bandwidth available between them.The purpose of a site is to localize traffic from queries, authentication, and replication. Replication is the process of synchronizing all the copies, or replicas, of the distributed Active Directory database. Queries and authentication traffic is generated at the will of clients. Replication traffic occurs actively and frequently within a site, but can be managed through intervals and scheduled availability between sites. Because of the nature of replication traffic, sites typically define a single geographic location. When planning a site structure, make sure to place at least one domain controller and at least one Global Catalog server (they can be the same server) in each site.The configuration that will have the least amount of traffic between sites is that where sites and domains are in a one-to-one correspondence.This ensures a minimum of intersite and intrasite traffic, making this an optimum topology. The replication topology is the configuration of the physical flow of information between DCs. Each naming context (schema, configuration, and domain) has a separate replication topology. Replication traffic increases when sites span two or more domains.The Knowledge Consistency Checker (KCC) generates the replication topology within a site by creating a bidirectional ring for each naming context. Each direction in the ring is represented by a one-way connection object that can be found below each DC. The replication topology between sites can be created manually by an Administrator.The Active Directory Sites and Services console is used to create the replication topology.Within it: ■

Sites are created and assigned to a transport type, currently IP or SMTP.

■

IP subnets are created and assigned to sites.

■

Site links are created to connect those sites that have actual network connections between them.

■

Site link bridges are created to connect sites by hopping over sites in common when two sites do not have network connections between them.

■

Servers can be moved into sites, or if installed after the site has been assigned IP subnets, they will install into the site that contains their IP subnet.

www.syngress.com

Designing a Site Structure • Chapter 6

Solutions Fast Track The Function of Sites in Active Directory  Sites are useful for managing traffic, whether that is related to user

queries and logons, or to replication between DCs.  Users’ traffic is directed to the DCs and Global Catalog servers located

in the site to which their computer’s IP subnet belongs.  The site that is generated automatically within a forest is called Default-

First-Site-Name.

Replicated Active Directory Components  Each different domain has its own naming context, or domain partition,

which is replicated between all the DCs of that domain.  Global Catalog servers have a partition for the Global Catalog index, and

that partition is replicated among all Global Catalog servers, regardless of the domains of which they are members.  The schema and the configuration are two additional partitions that are

replicated among all DCs in the forest.

Site Replication Components  Sites are created to localize traffic in a single geographic area.  The Knowledge Consistency Checker (KCC) is a service that resides on

every DC and refreshes the replication topology automatically.  Site links and site link bridges are used to build scheduled replication

traffic paths between sites.

Replication in Active Directory  Active Directory replication converges the data in all the partitions of

the Active Directory database when updates occur, or periodically based upon a set schedule.

www.syngress.com

193

194

Chapter 6 • Designing a Site Structure

 The KCC service executes every 15 minutes to refresh the replication

topology.  As more sites and domains are added to a forest, the more intricate the

replication topology becomes.

Planning a Site Structure  The primary goal of site replication is ensuring that users receive up-to-

date information without sacrificing performance.  There should be a minimum of one DC in each site.You should place

at least two DCs in each site if you require redundancy or faster performance.  The Global Catalog is required for user logons and queries in a multi-

domain forest, so there should be at least one Global Catalog server in each site.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: I would like to test three different site topologies on a production network. Can I do this, or must I select one and stay with it?

A: Sites easily are created and changed as needed.They were developed that way to incorporate growth and change within an organization.Therefore, any number of site topologies can be tested before selecting the optimal version. This, however, does not apply to a domain structure, since domains cannot be merged, split, or easily deleted.

Q: We have three sites: site A is in Phoenix, site B is in Mexico City, and site C is in Vancouver. Both Mexico City and Vancouver have WAN links to Phoenix. Since there is no network connection between Mexico City and Vancouver, how do we enable replication between those two sites? www.syngress.com

Designing a Site Structure • Chapter 6

A: This can be enabled by a site link bridge. A site link bridge is generated by connecting at least two site links that have at least one site in common. It duplicates a multihop routing system for the replication traffic.

Q: We want to limit the number of servers that can send replication traffic between two sites. Can we?

A: Yes. Designate each of the servers that is allowed to transmit replication traffic as a bridgehead server.

Q: We do not want to use the automatically generated intrasite replication topology. Can we delete and create some different connection objects without the KCC reconfiguring them later?

A: Yes.The KCC will not change or delete any connection objects that were created manually by an Administrator.To reduce the cost of administration for replication, use the KCC-generated site topology.Whenever a manually generated connection object is created, an Administrator would be required to analyze each change to the site’s configuration (such as a new DC) and make appropriate changes to the connection objects.

Q: We would like to use a third-party time service that is SNTP-compliant. Is this possible?

A: Yes, an SNTP-compliant time source can be used as the primary time server with the W32Time service. Q. How can you filter group policy for a group of users that exists in an organizational unit (OU) with other users so only the first group receives the group policy and the rest do not? A.When you want to apply a group policy object to a group of users that exists within an OU and it is not feasible to move that group into its own OU, you can rely on applying rights to filter the group policy.To filter a group policy for a select group, edit the properties of the group policy object. Click the Security tab, then remove the Authenticated Users group from the ACL. Add the selected group and make sure to grant the Read and Apply Group Policy rights.This will provide an effective filter.

www.syngress.com

195

196

Chapter 6 • Designing a Site Structure

Q: Where are my group policy objects? They don’t appear as objects within their applied containers.

A: Group policy objects are stored in two places: in the GPT folder below SYSVOL on each replicated DC’s hard drive, and within the System\Policies container in Active Directory.The System container is not available by default in the Active Directory Users and Computers console.To view the System container and the Policies subcontainer, you can select Advanced Features from the View menu of the Active Directory Users and Computers console.

Q: If I plan to install a network with four sites, but a single domain, and each site is connected via Virtual Private Network (VPN) or slow Frame Relay and DSL, how do I install servers in the remaining sites?

A: As long as the server is connected physically and can contact the other DCs in the domain, you simply bring the server up in its own site and run Dcpromo. You can define the sites either before or after you have installed the new DCs.The traffic generated by Dcpromo is compressed automatically.

www.syngress.com

Chapter 7

Designing: A Case Study

Solutions in this chapter: ■

Assessing a Corporate Network

■

Designing the Forests

■

Determining Domain and Tree Structure

■

Planning the OU Structure

■

Establishing the Initial Sites

 Summary  Solutions Fast Track  Frequently Asked Questions

197

198

Chapter 7 • Designing: A Case Study

Introduction Organizations all over the globe are considering Windows 2000, planning their future Active Directory, or have already implemented Windows 2000 and Active Directory.With the experiences they have accrued, there are a lot of war stories to tell.This chapter, as well as others in this book that focus on case studies, represent some of those experiences.

Case Study Overview Kings Vineyards is a corporation dedicated to the production and distribution of wine.They have several divisions throughout their corporation, some located globally. Kings Vineyards believes that they should be involved in every aspect of the wine production from planting, to bottling, to sales.The Kings Vineyards holding corporation has the following subsidiaries (a map of these locations is depicted in Figure 7.1): ■

Kings Vineyards Holding Corporation Based in Oregon.

■

Kings Vineyards Estate The original California vineyard from which the company grew.

■

Saiga Vintners Another California vineyard with a different line of wine products.

■

Noir Champagne A French vineyard specializing in champagne products.

■

Kings Bottlers The Minnesotan bottling manufacturer that produces wine bottles and corks for all the vineyards, and which sells bottles to other vineyards and product manufacturers.

■

Kings Paper Products The Mexican paper manufacturer that produces the labels and boxes for the wine bottles. Kings Paper Products also produces all the letterheads for each vineyard and the home office, and sells paper products to other corporations.

■

PacRim Distributions A large conglomerate of wine distributors and wholesalers located in Japan and Australia.

■

Kings Wholesalers A conglomerate of wine wholesalers located throughout the United States.

■

PacRim Retailers A group of stores that sell wine retail, and are wholly owned by PacRim Distributions.

www.syngress.com

199

Figure 7.1 Kings Vineyards Geographic Map of Holdings

200

Chapter 7 • Designing: A Case Study

The organization of Kings Vineyards and all subsidiaries is composed of 20,000 associates—all computer users.This information is all obtainable from the Kings Vineyards Web site. Kings Vineyards is now considering Windows 2000 Server.

Assessing a Corporate Network The beginning step in any project is the assessment. A comprehensive network assessment ensures your project will be both efficient and effective.There are many methodologies developed around project beginnings. One part of the assessment is to look to the future of the organization and determine the business objectives for the project. In other words, the assessment includes an envisioning phase, one that should target all the areas of impact for the proposed solution. By targeting the impact areas, you can drive a more effective assessment.

Determining the Business Objectives Most people do not think in terms of the bottom line when initiating a technology project. Usually, people think in terms of their immediate needs or wants. For example, if you are experiencing a lot of pain in handling end-user password changes because there are multiple directory services on your network, you may think only of alleviating that pain, not whether the reduction of time and effort to administer passwords will result in reduced costs. Since it is not the natural thing to assume a bottom-line perspective, business objectives can be tricky to create. In order for your project to be considered successful by all levels in a corporation, the bottom line must be considered first, not after the fact.There are three ways that a technology can impact the bottom line: ■

Generate revenue This is usually the case if the technology is going to bring about a new way to sell, or to increase current sales results.

■

Reduce or avoid expenses Technology can avoid overhead by eliminating the need for personnel (either existing or future), reduce the use of consumable products, or eliminate the need to travel.

■

Comply with government or industry regulations Though not an obvious bottom-line objective, this one is critical for some industries. If a company was unable to comply with a regulation, there may be a fine, a forfeiture of some business, or even a closure of the business. Avoiding these expenses is a must.

www.syngress.com

Designing: A Case Study • Chapter 7

A business objective needs to be specific and realistic. If at all possible, it should be measurable so that the success of the project can be proven.

Kings Vineyard’s Business Objectives The goals and objectives for the Kings Vineyards project require a thorough understanding of the business.This includes interviewing key personnel within the organization.The interviews with Kings Vineyards reveal the following forward-facing statements: ■

Mission Statement Cultivate distinctive wines to suit a broad range of tastes and occasions.

■

Jack King, Kings Vineyards CEO “We take the wine business seriously, and with a long-term outlook.We tend grapes on some of the finest land in California and France.We expect to acquire other vineyards in Australia to expand our wine products.We then package, distribute, and sell wine all over the world.The wine business is a long-term investment. It takes time to grow new species of grapes and test the wines from them. Our business is being affected by the Internet, and a new breed of wine drinkers. Upstart vineyards are reaching customers that we want to reach.We must compete at a different level.We need to expand to the Internet to take advantage of e-commerce. And we need to offer instant distribution and custom labeling to the new wine drinkers.This will impact our retail sales and paper products companies the most. And it will require our marketing department to look to electronic media rather than strictly newsletters and catalogs.We expect any technology that we put into place to enable us to manage Internet users and their information.”

■

Noelle Santeo, Kings Vineyards CIO “Our technology is aging quickly.We haven’t had a refresh of any hardware since we ran our Y2K project in 1999.We are running Windows NT 4.0 on most of our servers.We are experimenting in our labs with Windows 2000. All users in all the subsidiaries are on a single Exchange 5.5 e-mail system that runs from our Oregon headquarters.We acquired one vineyard in France that uses UNIX exclusively, so they’ve been using POP3 to access e-mail until we migrate them over.We have a lot of Help Desk calls and they are increasing—mainly because the hardware is aging.We are really unhappy with the reliability of servers.The server administration group

www.syngress.com

201

202

Chapter 7 • Designing: A Case Study

is constantly flying out to our subsidiaries because of servers going down, or to put in new Backup Domain Controllers (BDCs) to enhance performance. Jack has been pushing us to enhance our Internet capabilities, but we don’t have the time to do so, nor do we have a network operating system that we trust to stay up long enough—at 99.99% availability—for our customers to be satisfied.” ■

Marie du Pont, Noir Champagne Vineyard Operations Manager “Our network is unique because it runs on UNIX, and all the others use Windows NT.We have had a great deal of problems with integration with the rest of Kings Vineyards, however, so we are anxious to move. Our operations, which we are proud of, are so stellar that Jack King has asked us to travel to all the other vineyard locations to help reduce their costs and increase the quality of the wines.When we travel, we have difficulty with the other systems because ours are different.We use DNS Bind version 4.1.2 for name resolution for host names.The data that we need to access is already migrated to the databases at Kings Vineyards, which we update on a weekly basis. Once we are moved over, we expect to access that data directly across the WAN or through a Virtual Private Network (VPN). Our little vineyard will continue to produce the high quality champagne products we are famous for.We would like to validate the types of people who purchase our champagne retail and expect to collect that data from the Internet purchases.We will want to know where they are located and what occasion they are using the champagne for.This information will enable us to better market our products, and that should result in increased revenue.”

■

Barry King, Kings Paper Products COO “We know that the future is the Internet and that it will affect us the most. Our expectation is that we will obtain orders from new people on the Internet requesting private labels. Some of these orders may be repeated by the same users or groups of users.We have to have a strategy to manage these users and their data, and be able to link that information from their Internet logon to our label printing software, which is based on a SQL Server database.”

Other interviews from other key personnel are also included in the assessment, but they repeat much of the previous information. Most interviews are conducted in person using a worksheet of key questions. However, the interview with Marie du Pont is conducted with an e-mail survey, due to her location in France. A Web survey form is used for end-users in a variety of business units. An www.syngress.com

Designing: A Case Study • Chapter 7

assessment may use any variety of instruments to gather the required data. From the earlier statements, the following business objectives can be extrapolated: 1. Expand the existing network into the Internet to increase revenues through e-commerce. 2. Increase the reliability of the network servers and consolidate the number of servers to reduce downtime and travel and expense costs for managing the domain controllers. 3. Ensure 99.99% availability of the Internet Web site for customer satisfaction. 4. Use a single system across all businesses so that there is seamless access to data from any location. 5. Integrate private data into the existing labeling system to generate increased sales with the added private label line of products. From these interviews, you could come up with a number of business objectives that differ from the five distinguished here. In fact, you would probably write down all that you could determine, and then validate those with the stakeholders of the project. Here it is assumed that the five business objectives are the ones remaining after the stakeholder validation process, and that they are listed in the order of priority, or stages of concern, that the stakeholders desired.These business objectives will be used to guide the rest of the project, so that is why we have looked at them first.

Current Environment As you may have noticed, the interviews that were conducted contained statements that discussed both the future of the network as well as what is being used currently. If you use a survey form or a list of questions, you can easily conduct interviews that have two purposes: 1. To find out business objectives. 2. To discover what is being used on the current network. During your interviews, you will gather documents and data regarding the business. Some of these will tell you critical information. Others may not. For example, if you find out during an early interview that user accounts are not created with a naming convention and that is causing problems for administration, then getting a list of current user account names may not be as helpful as a list www.syngress.com

203

204

Chapter 7 • Designing: A Case Study

of users because you will be changing the user account names.You should look for relevant data regarding all areas of the current environment and retain it for analysis.

Network Infrastructure To maintain reduced costs between companies, Kings Vineyards maintains wide area network (WAN) links between them (see Figure 7.2).They use both TCP/IP and NetBeui on the servers and workstations. Network attached printers are using DLC, but the network administrators want to migrate them to TCP/IP. Figure 7.2 Map of Wide Area Network Links Kings Bottlers Minnesota

PacRim Retailers Japan

PacRim Distributions Japan

Kings Vineyards Holding Company Oregon

PacRim Cloud

Kings Wholesalers New York

East Cloud

Noir Champagne France

PacRim Distributors Australia

Kings Wholesalers Texas

South Cloud PacRim Retailers Australia

Saiga Vintners California Kings Vineyard California

Kings Paper Products Mexico

www.syngress.com

Designing: A Case Study • Chapter 7

Each of the WAN links has the bandwidth characteristics detailed in Table 7.1. Table 7.1 WAN Link Characteristics Link Type

Location

T3

Oregon to PacRim cloud

T1

Oregon to South cloud

T1

Oregon to East cloud

512 Kbps frac-T1

All other locations connecting to clouds PacRim retailers to PacRim distributors Noir Champagne to New York

256 Kbps frac-T1

E1

Max Bandwidth

Available Bandwidth

Notes

44.736 Mbps 12.328 Mbps Bandwidth is maxed out during data uploads between 11:00 P.M. and 1:00 A.M. Pacific Standard Time (PST) 1.544 Mbps .032 Mbps Heavy utilization during standard business hours (8:00 A.M.–5:00 P.M. PST); drops to very little traffic after hours 1.544 Mbps .053 Mbps Bandwidth is maxed out during data synchronization between 2:00 A.M. and 5:30 A.M. PST 512 Kbps Approx. 30 Bandwidth is maxed to 50 Kbps out during all data uploads and synchronizations 256 Kbps Approx. 50 There are few data to 70 Kbps uploads and bandwidth appears to be steady 2.044 Mbps .508 Mbps Bandwidth is maxed out during data synchronization between 2:00 A.M. and 5:30 A.M. PST

The Kings Vineyards domain architecture is based on the Master domain model with some adjustments. One of the resource domains has Citrix MetaFrame servers, and to configure users in the Master domain, the resource domain with Citrix had to be trusted by the Master domain.The domain structure is exhibited www.syngress.com

205

206

Chapter 7 • Designing: A Case Study

in Figure 7.3. All distributors and wholesale end-users are members of the Dist domain.They are separated from the Master domain due to a government regulation that requires that the wholesale distribution business is secured and separated from retail data. Although this domain design has functioned well during the past few years, Kings Vineyard administrators want to separate the retail end-users for possible sales and expansions in that area. Figure 7.3 Legacy Windows NT Domain Structure

Kings Master

Dist

Bottlers

Mktg

Paper

Kings Vineyards has registered two domain names: kingvineyards.com and kvines.com. Neither of these domain names is in use on the Internet currently.The existing network strictly uses NetBIOS naming.When Kings Vineyards develops their Internet Web site, they wish to use kingvineyards.com for branding purposes.

Servers With 20,000 users, Kings Vineyards maintains 132 Windows NT Servers, 104 of which are version Windows NT 4.0 at the latest service pack level (SP6a, which they obtained by downloading from http://support.microsoft.com/support/kb/ articles/Q152/7/34.ASP).The remaining 28 servers are Windows NT 3.5 and 3.51 servers that are being used mainly for file and print sharing and are not being managed proactively by the IT department. In addition there are three UNIX servers in Noir Champagne Vineyards. Because hardware is aging, Kings Vineyards expects to upgrade server hardware and will use this opportunity to consolidate hardware. Of the 132 Windows NT Servers, there are four PDCs, one for each domain. In addition there are 31 BDCs scattered throughout the network. Every location has at least one BDC because logon performance is poor without it. www.syngress.com

Designing: A Case Study • Chapter 7

Desktops and End-Users The users in Kings Vineyards network are distributed according to Table 7.2. They all have a standard user access to the network, except for the retail users, who are restricted from accessing data about the distributors and holding corporations. Because the organization is so distributed physically, many users have been made members of the Domain Admins groups in their designated domains just for the purpose of managing passwords, user adds and changes, and other light administrative functions. A Help Desk exists for the entire organization and its staff must pass off these tasks to the local designated staff, even though it would save time if the Help Desk could make password changes and update user account information. Table 7.2 Distribution of Users across Kings Vineyards Network Location

Number of Users

Kings Vineyards Oregon

5000

PacRim Retailers Australia PacRim Retailers Japan PacRim Distributors Japan PacRim Distributors Australia Kings Vineyards California Saiga Vintners California Kings Paper Products Mexico

150 50 200 100 250 250 8000

Kings Bottlers Minnesota

4000

Kings Wholesalers New York Kings Wholesalers Texas Noir Champagne France

800 700 500

Types of Users Majority of Knowledge workers (Power users) IT staff (Administrators) Clerical staff (Standard users) Standard users Standard users Standard users Standard users Standard users Standard users Knowledge users (Power users) IT staff (Administrators) Clerical (Standard users) Knowledge users (Power users) IT staff (Administrators) Clerical (Standard users) Standard users Standard users IT staff Standard users

www.syngress.com

207

208

Chapter 7 • Designing: A Case Study

The last major hardware refresh for desktops occurred during the Y2K project in 1999. At the same time, a standard Windows 95 image was deployed to all network laptops and desktops. Since that time, new users have ordered hardware directly from manufacturers and have simply added applications and reconfigured whatever operating system came on the laptops and desktops. It is estimated that at least 3000 user machines do not use the standard Windows 95 image, and are using Windows 98,Windows ME,Windows NT 4, and Windows 2000 Professional. Users have a standard naming convention—the first initial of the first name concatenated with the first initial of the middle name concatenated with the entire last name.They require that all user IDs are unique. Some problems have occurred using this naming convention.There have been a few users whose resulting user IDs are longer than the 14-character limitation set by some of the systems. Other users have had identical resulting user IDs. As a result, Administrators have shortened IDs or added characters in order to make them fit within the system limitations and unique across all domains.

Designing the Forests The forest design process involves the designation of the number of forests required and selection of a namespace for the root domain. Each forest must have at least one domain. Since administrative overhead is increased, and replication and query traffic is amplified, when there is more than one production forest in a network, it is generally recommended that only one forest be designed for production. A forest also shares a common schema, configuration, and Global Catalog. The first forest designed for Kings Vineyards will be the production forest. This will have the root domain namespace of kvines.com. In the case of Kings Vineyards, the fact that there is a common schema in a forest may impact whether there are one or two forests used for production.This is combined with the fact that there is a common Global Catalog in a forest. It was discovered during the assessment that Kings Vineyards has an Internet strategy that will require users to log on to the Internet, and then store data regarding those users’ purchases.This data storage may require extension to a schema, and it may not be desirable to extend the production schema the same way that you would extend an Internet user’s schema. Kings Vineyards wants a single network operating system to reduce administrative overhead, so it is highly likely that their Internet strategy will be based upon Windows 2000 servers and Internet Information Services (IIS). It is not recommended to incorporate Internet users, who typically create their own IDs, www.syngress.com

Designing: A Case Study • Chapter 7

into a production Global Catalog. A hacker could, rather easily, create his or her own ID and then begin drilling into the systems. So, for security’s sake alone, a second forest should be designed for Internet usage.The root domain of the Internet forest will be kingvineyards.com In addition to these two designed forests, we will design a third forest for the lab. Given that Kings Vineyards has three locations with heavy IT administrative staff—Kings Vineyards in Oregon, Kings Bottlers, and Kings Paper Products—the lab forest will be designed to encompass all three sites, making it an unusual lab forest (most labs are confined to a single room, building, or campus).To prevent security issues due to the lab forest crossing WAN links, all lab users will be required to use complex passwords and no trust relationships will be created with production domains.To prevent traffic overhead, the lab forest will have a site replication schedule that will take place on weekends during the lightest usage. If lab users must force replication prior to the weekend schedule, they may do so. The lab forest root domain name will be kinglabs.local, so that a new DNS namespace does not need to be registered. The Kings Vineyard’s designed forests are depicted in Figure 7.4. Please note that Kings Vineyards may not implement all of the forests right away. It is likely that a lab forest will be implemented first for testing.Then the production forest will be implemented. If Kings Vineyards does not implement their Internet strategy using Windows 2000, they will not need to implement the Internet forest. Figure 7.4 Forest Design for Kings Vineyards

kingvineyards.com

kvines.com

Internet Forest

Production Forest

kinglabs.local

Lab Forest

www.syngress.com

209

210

Chapter 7 • Designing: A Case Study

Determining Domain and Tree Structure Domain design automatically brings about Domain Name System (DNS) namespace design. As with the forest design, the domain design process uses the business objectives as the guidelines. One of the business objectives is to create a single system to reduce administrative overhead. Since multiple domains cause administrative overhead, the domain design will reduce the number of domains overall. However, the regulation to keep the wholesale distribution separated from retail and the desire to separate out the retail users into their own domain both mean that there will need to be more than one domain. For the production forest, there needs to be a restructuring in order to provide fewer domains.We can combine all the domains except for Dist into a single domain.We will also create a brand-new domain for the Retail users.Then we will use a tool to move Retail users into the new domain.The question remains whether to create an empty root domain and place the old Master domain (Kings) beneath it, or to make Kings the root domain.The interviews do not reveal a particular concern about security. However, the best thing to do is ask the Kings Vineyard project stakeholders for their opinion.We will assume that the Kings Vineyards stakeholders stay true to their desire for fewer domains, and will migrate the Kings Master domain to the root domain.The DNS namespace design for each domain is listed in Table 7.3 and the Domain design is shown in Figure 7.5. Figure 7.5 Kings Vineyards Production Domain Structure

kvines.com

dist.kvines.com

www.syngress.com

retail.kvines.com

Designing: A Case Study • Chapter 7

Table 7.3 Domain Restructuring

Windows NT Domain

Domain Role

Active Directory Domain DNS Namespace

Active Directory NetBIOS Name

Kings Bottlers

Master Resource

Kvines.com Kvines.com

KVINES KVINES

Paper

Resource

Kvines.com

KVINES

Mktg

Resource

Kvines.com

KVINES

Dist N/A

Resource N/A

Dist.Kvines.com DIST Retail.Kvines.com RETAIL

New Domain Role Root domain Root domain (merged in) Root domain (merged in) Root domain (merged in) Subdomain Subdomain

SECURITY ALERT One of the best practices is to create an empty domain at the root of the forest because it avoids security breaches. If you upgrade an existing domain to a root domain, then any users who had been granted administrative functions in the past will be given administrative functions in the domain, plus will become default members of the enterprise admin groups. In addition, they will be able to take control of the schema and extend it, possibly even corrupting it (a problem that actually occurred for a company with which I consulted). If you do select the upgrade method, you should clean up the administrative groups prior to the upgrade, as well as check individual rights and privileges that may breach your intended security design.

In both the lab forest and Internet forest, Kings Vineyards will require only a single domain.These domains are the root domains listed in the forest plan (shown in Figure 7.4)—kingvineyards.com for the Internet forest and kinglabs.local for the lab forest. During the DNS design process, there’s a bit more to do than simply picking out names for each domain.We also need to consider our zones.We have three options:

www.syngress.com

211

212

Chapter 7 • Designing: A Case Study ■

We can create a separate zone for each domain.

■

We can create a separate zone for kingvineyards.com, another for kinglabs.local, and a third zone for the entire kvines.com domain tree.

■

We can create separate zones for both kingvineyards.com and kinglabs.local, then create two more zones, one that combines kvines.com with one of its subdomains and the other zone for the remaining subdomain.

Mainly, the zone configuration should be able to resolve host names quickly. If a zone is cluttered with a lot of resource records, then it will perform poorly. However, with only 132 servers and 20,000 users, a DNS zone that combines the entire kvines.com domain tree should perform well. Because Kings Vineyards wants a single system, they have elected to use the Windows 2000 DNS service throughout their network. One issue that will need to be addressed is the fact that Noir Champagne is using a version of UNIX Bind that is not compatible with Windows 2000 Active Directory.The plan for DNS should state that Noir Champagne’s DNS server will be migrated prior to the installation of Active Directory and Windows 2000 DNS. In order to do this without interrupting existing name resolution, the plan should follow these steps: 1. Install a Windows 2000 server as a standalone server. 2. Configure DNS on the Windows 2000 server to maintain secondary zones for each of the zones existing on the other DNS system. 3. Configure a zone transfer and ensure that all records are populated within the Windows 2000 DNS server. 4. Install and configure at least one other Windows 2000 DNS server for redundancy. 5. Configure DNS clients to use the Windows 2000 DNS servers as their primary and secondary DNS servers. 6. Take the original DNS servers offline. 7. Test and ensure that clients can resolve names. 8. Configure one of the DNS servers to be primary (authoritative) for the zone(s), and one—it can be the same server—to be the master server. 9. Install and configure the remaining DNS servers in the network. 10. Configure Windows Internet Naming Service (WINS) referral name resolution on the DNS servers so that DNS can be used for resolving names www.syngress.com

Designing: A Case Study • Chapter 7

of any machines with NetBIOS names using a WINS referral zone pointing to the WINS database.The WINS referral service will not resolve NetBIOS names; it simply points to the WINS servers for name resolution.WINS will be required by any environment that uses NT servers.

Designing & Planning… Split Brain DNS Many organizations have developed a DNS namespace that applies to both their internal private network and their external public Internet Web site. To achieve this single namespace with multiple purposes, they have utilized Split Brain DNS. Split Brain DNS can accomplish the following: ■

Expose the public portion of the DNS namespace to the Internet.

■

Protect the private portion of the DNS namespace from the Internet.

■

Enable a private computer to resolve both internal and external names within its own DNS namespace.

■

Enable a private computer to resolve any Internet DNS names.

The Split Brain DNS solution requires that at least one DNS server is exposed to the Internet (preferably two DNS servers for redundancy), and is authoritative for the zone including the public portion of the DNS namespace. Then, a second set of DNS Servers (at least two for redundancy) is devoted to top-level zones for the private network, and not exposed to the Internet. The second, private DNS servers’ zones will contain all the names, both internal and external, for the DNS namespace. All DNS clients will query these servers, or they will query servers that contain zones that will refer to these servers. These top-level DNS servers will then forward to the other set of DNS servers that are exposed to the Internet, any queries regarding zones for which they are not authoritative. You may want to add two external DNS servers in order to load balance the DNS traffic, especially during peak usage times. This, of course, would be based on capacity needs.

www.syngress.com

213

214

Chapter 7 • Designing: A Case Study

Planning the OU Structure Organizational Units (OUs) are unique to a domain.When you plan an OU structure, you must do so for each domain separately.You can save some time and effort, however, if you plan a basic structure that is applicable to all your domains. From there, as time marches on, you will find there are reasons to create, move, rename, or delete OUs. Luckily, OUs are intended to be flexible, so these changes are quite acceptable.

Administrative Structure When designing OUs, the top level is best designed to meet the administrative needs of the organization. Looking at Kings Vineyards network assessment, it is obvious that there are at least three IT groups: ■

Kings Vineyards Oregon (the holding company office with 5000 users)

■

Kings Paper Products Mexico (the paper company with 8000 users)

■

Kings Bottlers Minnesota (the bottling company with 4000 users)

Kings Vineyards overall organization contains many users who have full administrative capabilities, but require only limited capabilities for certain groups of users. In addition, the Help Desk needs to have the ability to manage user passwords and accounts for the entire organization.Therefore, we know that we have to have an OU that encompasses every user account.This will be the root of the OU structure, and we will call it World.This OU will sit directly below the domain, and at the same level as the default containers, which will not be included in the design. See Figure 7.6. Figure 7.6 The First OU in Kings Vineyards OU Structure kfines.com

World

www.syngress.com

Designing: A Case Study • Chapter 7

Full administrative rights at the World OU will be granted to Domain Admins, who are all located in the Kings Vineyards Oregon IT Staff. In addition, the Help Desk will be granted password and user account management rights at this level, and that should flow down to all users.The next level of the OU structure should encompass the various groups that require delegated administrative rights. Below World, we will provide a Bottlers OU, a Paper OU, a Marketing OU (for the merged Mktg domain), and an OU for the Holding Company called HQ. OUs for the three Vineyards—Kings, Saiga, and Noir—are placed below HQ due to the fact that they only need certain rights, rather than full administrative rights.The OU structure now has been designed for administrative delegation, and is depicted in Figure 7.7. Figure 7.7 Administrative OU Structure kfines.com

World

Paper

Bottler

Saiga

HQ

Kings

Mktg

Noir

Hidden OUs The next task in designing an OU structure is to create any hidden OUs. Once you know where your administrative rights are delegated, you can now strategically place any other OUs that you want to hide from other administrators. This is a system that works well for Application Service Providers (ASP), especially those that offer Exchange Server 2000 as a managed service. Exchange 2000 utilizes Active Directory for its directory service, rather than have a separate one of its own that is linked to user accounts, as is done with Exchange Server 5.5. www.syngress.com

215

216

Chapter 7 • Designing: A Case Study

The reason that Hidden OUs work for an ASP is that, for Exchange 2000, there can be only a single organization per Active Directory forest.This means that if an ASP is providing Exchange services to multiple companies, it must either create a new forest for each one (driving up its own costs), or it must hide each company’s information from all the others. Hidden OUs are the key. Designing hidden OUs means simply placing them at the same level where administration will be delegated.Then, you must assign and remove explicit rights to ensure that the OU will be seen by the intended users only, and not by others during standard browsing of the directory. In the Kings Vineyards case, we could hide an OU below the World level (remember the World OU admins, as we’ve designed them, have domain admin rights and will be able to see it all).This will hide the OU from the Paper, Bottler, HQ, and Mktg OU container admins. If an Administrator of these units has higher level rights, he or she will be able to see the hidden OU. If you wished to hide an OU from the Vineyard admins, place it at the same level as the Saiga, Kings, and Noir OUs. It may help to add a naming convention to your scheme to designate OUs that are intentionally hidden. Here, the letter H is added at the end, as pictured in Figure 7.8. Figure 7.8 Hidden OU Design kfines.com

World

Paper

Bottler

Saiga

www.syngress.com

HQ

Kings

Mktg

Noir

GroupH

VinH

Designing: A Case Study • Chapter 7

SECURITY ALERT In the Kings Vineyards example, you could have used hidden OUs to maintain the separation between the Distributors and Retailers, instead of designing additional domains for them. However, not knowing the intention for the government regulation that requires this separation, it is unclear whether this would have been a security breach or not. When in doubt about whether a hidden OU will provide you the security you need or whether you require a separate domain, select the separate domain or obtain more information about the security or separation requirements.

Group Policies The next design level for an OU structure is to design your group policies.You can spend either a lot of time—by looking at all the Group Policy options and designating actual inclusions into the design, or a little—by grouping your users in order of general to specific user environments, at this stage of design.The best way to design your OU structure for Group Policies is not to look at the group policies themselves, but rather what you want to achieve with them for different groups of users and computers. You will need to begin with considering the separation of users from computers. Are there any computers in the network that are not-user specific, or which have computer-specific roles? For example, kiosks, laptops, or Terminal Services servers all have computer-specific roles that might require a separate environment from a standard desktop workstation. In the Kings Vineyards example, there are both desktop and laptop users.This means that there are two types of environments.The question remains whether those desktop and laptop environments are currently different, or should be different from each other in the future.The answer is probably yes. Laptops are almost always remote users, and should have special consideration for application deployments that might occur through Group Policies.This means that we will create two OUs to contain computer accounts—one will be Desktops and the other will be Laptops. Each of these types of OUs will be placed below the OUs for the administrators who manage computers.These OUs are the ones located below the World OU.This is shown in Figure 7.9.

www.syngress.com

217

218

Desk

Paper

Lap

Desk2

Lap2

Bottler

Saiga

Kings

Noir

kfines.com

HQ

World

VinH

Figure 7.9 OUs Intended for Desktop and Laptop Group Policies

Desk3

Lap3

Desk4

Lap4

Mktg

GroupH

Designing: A Case Study • Chapter 7

Next, the Group Policy design looks at users who will require different user environments from their coworkers. In the network assessment, there were three types of users identified: ■

IT staff

■

Knowledge workers or Power users

■

Clerical or Standard users

The IT staff does not necessarily require its own OU, because we can filter out the Group Policies that may be applied to IT staff end-users. However, the Kings Vineyards objective for reduced administrative overhead is best met if we don’t expose IT staff users to any mistakenly applied Group Policies. IT existed in the Paper, Bottlers, and Kings Vineyard Oregon locations.The IT staff in the Oregon location was in charge of the entire enterprise network.This would provide them with an OU that could be placed outside the World level or below the World level.The Oregon IT staff wants to be outside the standard set of users because they do not want the Help Desk to have access to their own user information or to be able to change their passwords, so they are given a separate OU.The other IT staff units, who are not domain administrators but are container administrators, are each granted an OU below their own area of control—Paper and Bottler.This design is shown in Figure 7.10. We can take care of the remaining users, who are split between Power users and Standard users, by creating OUs only for the Standard users. A power user environment is less restrictive than a standard user environment.Therefore, the World OU will include a Group Policy that gives every user below it the Power users’ environment. Standard user OUs will be placed below administrative users, and will contain only those user accounts that require a strict user environment. Those Power users who are not placed in the Standard users OU will not receive the more restrictive Group Policy.The resulting OU structure is displayed in Figure 7.11. One of the benefits of this design is that no more than two group policies are ever applied to a single user account, and no more than one group policy is ever applied to a computer account.This will ensure that startup and logon times perform well.

www.syngress.com

219

220

Desk

Lap

Paper

IT2

Desk2

Lap2

Bottler

IT3

Figure 7.10 OU Design Including IT Users

Saiga

Kings

World

Noir

kfines.com

HQ

IT

VinH

Desk3

Lap3

Desk4

Lap4

Mktg

Group

221

Paper Desktop Policy

Desk

Paper Laptop Policy

Lap

IT2

Paper

Std User Policy

StdUser1

Bottler Desktop Policy

Desk2

Bottler Laptop Policy

Lap2

IT3

Bottler

Std User Policy

StdUser12

StdUser14

Std User Policy

Std User Policy

Kings

World

IT

Std User Policy

StdUser15

Noir

kfines.com

StdUser13

Saiga

Power User

Figure 7.11 Resulting OU and Group Policy Design

VinH

HQ

HQ Desktop Policy

Desk3

HQ Laptop Policy

Lap3

Std User Policy

StdUser16

Lap4

Mktg Desktop Mktg Laptop Policy Policy

Desk4

Mktg

Std User Policy

StdUser17

GroupH

222

Chapter 7 • Designing: A Case Study

Inheritance Inheritance happens automatically. In the Kings Vineyards design, the Power Users Group Policy will be inherited by every user account below the World OU.That includes the IT staff in the Bottler and Paper OUs. One thing that you will want to do when designing an OU structure is ensure that administrators do not have restrictive Group Policies applied to them accidentally.You can do this by creating inheritance filters. A group policy will be applied to all the users or computers in its own container, and then to all the containers below it. If you apply a Group Policy at the domain level, then the entire set of domain users is affected. If you apply a Group Policy at the HQ OU in the kvines.com domain, then all of the users in the Saiga, Kings, Noir,VinH, Desk3, and Lap4 OUs are affected (although you shouldn’t place user accounts in the Desktop and Laptop OUs, nor apply a Group Policy that contains user configuration information to those OUs). Therefore, you should ensure that your design does not affect administrative staff because of an unintended inheritance. In the Kings Vineyards design, the IT staff groups in the Bottler and Paper OUs may wish to filter out all Group Policies from their OUs. As the network grows and changes, it is likely that a new policy will be applied somewhere above their OU, and affecting their user accounts. In this case, the design can prevent inheritance by a filter placed at their OU level to prevent any Group Policy from being inherited by the IT staff user accounts.

Establishing the Initial Sites The reason that this section is called “Establishing the Initial Sites” is due to the fact that sites will change as the network grows and changes.When you are designing your Active Directory, you may have a lapse in time while you are testing and piloting Windows 2000, between the design stage and the actual production deployment of your servers. If during that time, your network undergoes other types of changes—whether that is a merger, or an office closure, or even an upgrade in a WAN link—you may have to make last minute changes to the site design before actually deploying the servers and configuring sites.Then, as you manage your network on an ongoing basis, you should continue to make changes to sites in order to mirror how your physical network develops. The initial site design will mirror the WAN link architecture. Since each site listed in the WAN link architecture contains more than 50 users, this is a clear

www.syngress.com

Designing: A Case Study • Chapter 7

delineation for sites.Table 7.4 lists the sites and designated site names for the Kings Vineyards organization. Table 7.4 Site Listing Location

Site Name

Kings Vineyards Oregon Kings Bottlers Minnesota Kings Paper Products, Mexico PacRim Retailers Australia PacRim Distributors Australia PacRim Distributors Japan PacRim Retailers Japan Kings Vineyard California Saiga Vintners California Kings Wholesalers New York Kings Wholesalers Texas Noir Champagne France

Portland Minneapolis Mexico_City Sydney_2 Sydney_1 Tokyo Kyoto Napa_1 Napa_2 New_York Dallas Champagne

Site Links The site links are created between two or more sites. In the WAN link diagram (Figure 7.2), a provider manages the links between the sites so that there are three clouds connected to Kings Vineyards Oregon, the Portland site.Then there are two direct WAN links, one between Sydney_1 and Sydney_2, and another between Champagne and New York.This results in the site links listed in Table 7.5. Table 7.5 Site Link List Site Link

Participating Sites

PacRim_OR

Portland Sydney_1 Tokyo Kyoto Portland Mexico_City Napa_1 Napa_2

South_OR

Continued

www.syngress.com

223

224

Chapter 7 • Designing: A Case Study

Table 7.5 Continued Site Link

Participating Sites

East_OR

Portland Dallas New_York Minneapolis Sydney_1 Sydney_2 New_York Champagne

Sydney Overseas

For Kings Vineyards, there is no real need to create site link bridges because the company is fairly static in nature. Site link bridges connect two or more site links, and are created when they have a site in common.The site link bridge can reduce the administrative overhead if the WAN changes so frequently that the site links also change.The bridge ensures that the costs and connectivity between sites is maintained. If Kings Vineyards did create a site link bridge, it could create one between the Sydney site link and the PacRim_OR site link. Another site link bridge could be created between the Overseas site link and the East_OR site link.

Placing Servers One of the essentials of site design is to place servers in the various locations. When placing servers, there are some simple goals: ■

Ensure that users can log on to and query Active Directory.

■

Ensure that servers can locate other domain controllers.

■

Manage traffic generated by Active Directory.

Domain Controllers Each domain controller placement will have some impact on the ability for users to logon. If there are too few servers or none at all in a site where users are attempting to logon, then the performance for logon may suffer. If the site, for whatever reason, becomes disconnected from the rest of the enterprise network, and there are no DCs in that site, then users are prevented from logging on altogether.Therefore, you should ensure that there is at least one DC in each site. In large sites, you should ensure that there are a minimum of two DCs to ensure redundancy and failover.You can add more DCs to increase performance. www.syngress.com

Designing: A Case Study • Chapter 7

For Kings Vineyards, the initial DC placement design would have one DC in every site, and three in each site with more than a thousand users (Portland, Minneapolis, and Mexico_City).This results in 18 DCs total.We will need at least two DCs for each domain—kvines.com, retail.kvines.com, and dist.kvines.com—for redundancy of the domain partition. DCs for a particular domain should be placed next to the users in that domain.The DCs that are placed are listed in Table 7.6. Table 7.6 DC Placement in Sites Site

Affected Domain

DCs

Portland

Kvines.com

Minneapolis

Kvines.com

Mexico_City

Kvines.com

Sydney_1 Sydney_2 Tokyo Kyoto New_York Dallas Napa_1 Napa_2 Champagne

Dist.kvines.com Retail.kvines.com Dist.kvines.com Retail.kvines.com Dist.kvines.com Dist.kvines.com Kvines.com Kvines.com Kvines.com

DC01.kvines.com DC02.kvines.com DC03.kvines.com DC04.kvines.com DC05.kvines.com DC06.kvines.com DC07.kvines.com DC08.kvines.com DC09.kvines.com DC10.dist.kvines.com DC11.retail.kvines.com DC12.dist.kvines.com DC13.retail.kvines.com DC14.dist.kvines.com DC15.dist.kvines.com DC16.kvines.com DC17.kvines.com DC18.kvines.com

Note that the 18 DCs is consolidated from the original 4 PDCs and 31 BDCs in the legacy Windows NT network. Planning for 18 DCs will more than satisfy the business objective to consolidate servers. In addition, it reduces the amount of traffic generated for replication, which is a goal for server placement. Looking at the business objective to reduce the travel expenses associated with managing domain controllers, we will further design DCs to all have Terminal Services installed, so that they can be managed remotely.

www.syngress.com

225

226

Chapter 7 • Designing: A Case Study

Global Catalog Servers The Global Catalog is used as an index of the objects within Active Directory. A Global Catalog Server is a Domain Controller for any domain in the forest, which has been given the added responsibility of holding a copy of the Global Catalog index database.When a user queries Active Directory, the query goes to a Global Catalog server.Therefore, it is a good idea to ensure that there is at least one Global Catalog server in every site. In the Kings Vineyards example, the servers are all going to be new servers, because of the hardware refresh included in the project.These servers will all have the capacity to perform both as DCs and Global Catalog servers.To that end, each site’s first domain controller will be given a Global Catalog server role.This means that every site with a single DC will have that DC acting also as a Global Catalog server. In the sites where there are three DCs, then only the first DC in the site will act as a Global Catalog server.

DNS Servers One of the goals of server placement is to enable DCs to easily locate each other as needed. DNS is used for locating Active Directory services on the network. In order for a DC to function without problems, DNS is required in every site where there is a DC. In large sites, it there might be multiple DNS servers to increase performance, and to provide redundancy in case of failover. Kings Vineyards has requested that a single system be used throughout their network.They will be using Windows 2000 DNS and they will have new, highperformance and high-capacity server equipment upon which to install DCs. They can take advantage of Active Directory integrated zones if they install DNS on DCs.Therefore, in sites where there is a single DC, it will also be the DNS server for the site. In the larger sites, the second and third DCs, which are not also Global Catalog servers, will be DNS servers participating in Active Directory integrated zone.

www.syngress.com

Designing: A Case Study • Chapter 7

Summary Assessing a network begins with determining the organization’s business objectives.These business objectives are then used to guide the remaining design, plan, and implementation of the project. A network assessment also relies upon information about the existing enterprise network. Using the current information about the network infrastructure, the users, the servers, the domain, and even the workstations, a project team can build the Active Directory. A forest design is based upon business objectives balanced against the constraints of the forest itself, such as having a common Global Catalog index.The domain design should also be based upon business objectives. The OU and site structures, however, reflect the users, computers, and network infrastructure that will be in place when the project is completed. OUs and sites are flexible, and designed to change over time.

Solutions Fast Track Assessing a Corporate Network  Interviews and surveys can be used to gather data about the existing

network and the objectives for the business.  A network assessment for an Active Directory needs to review the net-

work infrastructure, domain design, servers, desktops, and locations.  Naming conventions and user accounts should be reviewed during a

network assessment.

Designing the Forests  For each additional forest, there is an incremental increase in

administrative and network traffic overhead.  Forests should be designed to meet business objectives.  A forest shares a common schema, configuration, and Global Catalog.

www.syngress.com

227

228

Chapter 7 • Designing: A Case Study

Determining Domain and Tree Structure  The domain design incorporates a DNS design.  Design the best future domain design that will meet your business

objectives before deciding to restructure or upgrade. Once your domain design is complete, the decision already will be made for you.  Additional domains can be created to establish a security boundary to

satisfy regulations or administrative issues.

Planning the OU Structure  An OU structure is flexible, and will change over time.  Design the top-level OUs to meet administrative needs.The next level

of OUs should be hidden OUs, if desired.  Design the next level of OUs to meet your needs for distributing Group

Policies.

Establishing the Initial Sites  As the network infrastructure changes, so will the site design.You may

even be forced to update your site design between the point at which you design and the point at which you implement sites in your network.  Site links should reflect connections between sites over which data

can travel.  Design site link bridges for those site links that share a common site.

www.syngress.com

Designing: A Case Study • Chapter 7

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: What happens if I don’t find out and write down our business objectives before we start our Windows 2000 project?

A: You run the risk of having your project viewed as a failure. Unfortunately, even if the project works out technically perfect, it can be viewed as a failure if it doesn’t meet someone’s expectations—especially a project stakeholder’s expectations.To ensure your own success, you should be absolutely certain to write down those business objectives before you start.

Q: Why is “reducing travel and expenses involved with domain controller management” considered a business objective, but “no longer traveling to upgrade domain controllers” not a business objective? Aren’t they the same thing?

A: Actually they are not the same thing.The first statement uses a bottom line— reducing costs—as the objective. Reducing costs directly affects the viability of the business.The second statement uses an activity—not traveling—as the objective, but “not traveling” does not directly affect the viability of the business. A good rule to follow when defining business objectives is simply “follow the money.” If you find a way to reduce costs, avoid costs, or increase revenue, then you merely need to state that in those terms.

Q: Why would we need to document the WAN links for a server rollout of Windows 2000?

A: If you are rolling out Active Directory as part of your Windows 2000 server rollout, then you will want to have the information for the site design available.This includes WAN connection information.

www.syngress.com

229

230

Chapter 7 • Designing: A Case Study

Q: Can I design my OUs to match our organizational chart? A: It’s not recommended to use organizational charts for OU designs. Using an organizational chart for an OU design will probably not have nearly the impact on your project’s success as an OU design that takes advantage of administrative delegation and Group Policy application.

www.syngress.com

Part III

Installing Active Directory

Chapter 8

Migrating from NT 3.51 or NT 4 to Active Directory

Solutions in this chapter: ■

Server Migration Strategies

■

Upgrading with the Windows 2000 Setup Wizard

■

Installing Active Directory Services

■

Migrating Components

■

Delegating Administrative Authority

■

Insert into the Replication Topology

■

Upgrading Clients to Windows 2000 Professional

 Summary  Solutions Fast Track  Frequently Asked Questions 233

234

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Introduction Upgrading a production server, which everyone on the network is accustomed to using, is a project that causes more problems than installing an entirely new network from scratch. An upgrade requires a significant investment in preparing for the migration because of the existing usage of the network.When you install a brand-new network, you aren’t interrupting anyone’s production business, and you aren’t taking away systems or applications that users are habitually attached to. A new network installation even may take place during business hours, quietly setting up equipment and applications while people are working. On the other hand, a migration typically must take place either over a weekend and during evenings so it will not interrupt users during business hours, or during business hours while users are away at training. Even when users are training, they expect their PCs to be running on the new system when they return. All sorts of problems can happen, so the migration team must develop a contingency plan—just in case the migration fails or there is some form of data loss. New installs do not have these issues, although usually it is preferable that they take place during evenings and weekends to avoid business interruptions. As you’ve discovered, a migration project consists of several basic phases: 1. Envisioning The migration team is assembled, and the members of the team determine the business objectives and vision for Active Directory and Windows 2000.The network is assessed to determine its current state, and the costs and benefits of the project are reviewed. 2. Planning The technical requirements for Active Directory and Windows 2000 are defined, the tasks to complete them are determined, the resources for the project are gathered, and team members are assigned tasks and given dates and milestones. Gap and risk analyses may be employed during this phase. 3. Developing A design is created for Active Directory and Windows 2000 operating system, and is based on the business objectives.This design sometimes is broken out as a separate phase. After the design is completed, it is tested. A lab or test system is created where the migration team can test the proposed technical configuration and ensure that it meets the business requirements defined in the Envisioning phase.The team may develop an automated installation process and a quality assurance process, and will deploy a pilot group of users to ensure success.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

4. Deploying Windows 2000 and Active Directory are installed across the production network, clients are granted access to Active Directory, the system is assured to be stable through quality assurance, and the systems are turned over to the operations support staff.This phase includes communications and training for the end-users. After this phase is completed, the network is returned to a state of ongoing support. Your migration project probably will encompass more planning and development issues than are described here. Each enterprise has its own business requirements, and usually an existing internetwork with its own technical requirements. The project must take into account these factors when planning things such as the Active Directory security strategy or Domain Name System (DNS) requirements.

NOTE Before beginning your migration, make sure to have your Active Directory sites, forest, domain, and organizational unit (OU) structure documented, as well as your DNS strategy and your security strategy.

Server Migration Strategies The strategy for migrating servers will be based upon your previous examination of any existing Windows NT domain structure and the surrounding network environment.You should already have the Active Directory project plan and design in hand before beginning this phase of the project.These designs will include: ■

A DNS namespace and domain plan

■

A forest plan

■

The OU hierarchy

■

The site topology plan

These planning tasks involve documentation of the existing network and organizational environment. Most organizations maintain some documentation regarding their networks and businesses.This documentation should have been gathered, and if not current, updated to represent the present network.The documentation will validate the design plans and should include the information listed in Table 8.1. www.syngress.com

235

236

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Table 8.1 Analysis Requirements Documented Item

Purpose

Network server hardware

To determine compatibility, and if not compatible, an upgrade strategy. To determine compatibility, Applications running on the and if not compatible, an upgrade or replacement servers strategy.

Example Usage Refer to the Hardware Compatibility List (HCL).

Refer to application vendor’s site or Microsoft Application Compatibility List at www.microsoft.com/windows/ server/deploy/compatible/ default.asp. Network infra- To determine the bandwidth Large DNS zone transfers, available to new network structure replication traffic. traffic, assist in the domain and site designs. If not sufficient, to determine an upgrade strategy to assist with protocol requirements. Server locations To determine which servers Dedicated file or Web servers, are best as domain conand functions PDCs, or BDCs. Review functrollers (DCs) and DNS tions and needs by users. servers, to determine site locations. Security policies To assist in the design of Account policies in User domains and group policies, Manager for Domains. Review to determine which security functions and needs for netcomponents to include in work. Active Directory.

Only after the network documentation has been gathered and the design completed can you begin planning out your migration strategy. Although there are many methods of doing this, the following is a solid approach. First, look at the forest plan and select a forest to migrate first. If there is a single forest, then selecting a forest is easy. If there are multiple forests, the optimal choice is to migrate the forest that is least likely to have an impact on production if the migration fails for any reason. For example, the Honey Bee Corporation has three namespaces: honeybeeswax.com, honeybee.com, and workerbee.com.The workerbee.com namespace is dedicated to a lab network, and the other two namespaces are on the production

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

network.The Honey Bee Corporation decided to have two forests, one for the lab network and the other for the production network. For their migration strategy, then, the forest least likely to cause problems when it is migrated is the lab network forest, of which the root is the workerbee.com DNS namespace.Therefore the Honey Bee migration team should plan and execute a migration on the lab forest before attempting to do so on the production forest. Figure 8.1 illustrates the Honey Bee Corporation forest plan including subdomains. Figure 8.1 Honey Bee Forest Plan Two-Way Transitive Trust

honeybee.com

honeybeeswax.com

workerbee.com

test.workerbee.com us.honeybee.com

Production Forest honeybee.com is root domain

Lab Forest workerbee.com is root domain

There are two options for migrating each domain when migrating a legacy Windows NT domain structure: ■

A domain upgrade

■

A domain restructuring

A domain upgrade is simply upgrading each existing legacy Windows NT domain to a Windows 2000 domain.There will be no change in the number of domains or the users and computers contained within each of them.The upgrade strategy begins with the in-place upgrade of the primary domain controller (PDC), followed by in-place upgrades of each of the backup domain controllers (BDCs), and optionally in-place upgrades of all the member servers. www.syngress.com

237

238

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

A domain restructuring is a complete redesign of the domain structure either prior to or after the upgrade to Windows 2000. In a domain restructuring, you will not have the same number of domains, and they probably will not bear the same names that were used in the legacy Windows NT network. User accounts and computer objects will be moved around to the new Windows 2000 Active Directory domains. Because of the Active Directory capabilities for delegation of administration and site-centric traffic management, many organizations may consolidate their domain structure into a simpler design that still satisfies business requirements. Organizations that created additional Windows NT domains because they were limited with 40,000 objects in the legacy Security Account Manager (SAM) may also restructure to fewer domains because their new limit is up to ten million objects in the Active Directory domain. Your decision on whether to upgrade or restructure will already be made for you.When you’ve designed your domains and DNS namespace, if they are different than what you already have in place, you have a restructure. If they are the same, then you have an upgrade. Although a legacy Windows NT domain structure may satisfy many business objectives, simply upgrading it to Active Directory may not be the optimal Active Directory design.Take a company that has two business units, Payroll and Service, where each has separate administrative groups. A legacy domain structure would require two separate domains so that each administrative group has control over its own area, even though the two business units may share the same facilities, as illustrated in Figure 8.2. Figure 8.2 Legacy Domains Can Cross Physical Boundaries

New York, New York Cairo, Egypt

London, England

Payroll Legacy Domain

New York, New York Cairo, Egypt Service Legacy Domain Detroit, Michigan

www.syngress.com

Atlanta, Georgia

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

If this company simply upgraded the existing domains from NT to Windows 2000 Active Directory domains, the network would experience more traffic than necessary. Network traffic within a domain is higher than that between domains. When the traffic from two separate domains travels across the same links, it is not optimal for the network because there is higher bandwidth utilization. In Figure 8.2, there would be more overhead traffic in the links between Cairo, Egypt or New York, New York and every other site because of the two domains having domain controllers (DCs) in those sites. However, if the company with these two legacy domains restructured into a single larger domain under Active Directory, it would not experience the higher bandwidth utilization due to overhead traffic. In an Active Directory domain, the company could easily create OUs to delegate administration in the restructured domain. It would use sites within the domain to centralize traffic at each of the locations and then schedule replication traffic to take place during times when the WAN links were not heavily utilized by production traffic. An organization can best evaluate whether to upgrade or restructure by starting with a blank page.The key is to ask the question “If there were no domain structure in place, what would be the optimal Active Directory domain for the organization?” If the answer is an Active Directory domain structure that matches the existing Windows NT domain structure, an upgrade path will work well for that organization. Otherwise, the organization should restructure their domains to match the ideal Active Directory domain structure.

NOTE If you plan a new domain structure and realize that there are more domains in Active Directory than there were in the legacy structure, you will want to revisit your plans. Active Directory can be optimized in a simple structure because the simpler the structure, the easier it is to manage Active Directory.

The first domain that is created in a forest is the root domain.This means that the first set of DCs that must be installed and/or migrated belong to the root domain.Take the Honey Bee Corporation, for example. In the lab network, there is a single DNS namespace with the root domain of workerbee.com. As its first task, Honey Bee Corporation’s migration project team simply upgrades the existing lab server acting as a Windows NT 4.0 PDC over to the workerbee.com www.syngress.com

239

240

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

domain as the first DC in the new Active Directory domain.The remaining servers designated for that domain are then upgraded, starting with the BDCs and ending with the member servers. After migrating the root domain, the Honey Bee Corporation migration team follows the namespace down to the first subdomain below the root domain. In this case, it is test.workerbee.com.Then the team begins migrating servers into a new Windows 2000 Active Directory domain. Honey Bee Corporation does not have another domain in the lab to upgrade, so it migrates member servers and then promotes some of them to DCs using the Active Directory Wizard to create the new domain. The following are high-level overviews of the migration process. If you have vertigo, be careful—we are more than 1000 feet up from the tactical steps of actually deploying. If there are multiple forests, one must be selected for the first migration. As stated previously, the first forest migrated should be the one with the least impact on the daily production network. Once the forest has been selected, the forest migration strategy is as follows: 1. Migrate the root domain first. If creating a new root domain instead of migrating an existing domain, create the root domain first. Figure 8.3 illustrates the process of migrating a single domain to Windows 2000. 2. Completely migrate the root domain before starting the next domain. When migrating from an existing Windows NT domain to an Active Directory domain, there probably will be a period of time during which the domain works in mixed mode. A mixed-mode domain has at least one Windows 2000 Server DC and one or more legacy Windows NT BDCs.Transitive trusts are supported in both native mode and mix mode. A native-mode domain has only Windows 2000 DCs. For this reason, each domain should be migrated in its entirety before migrating the next domain in the Active Directory forest. A migrated domain will remain in mixed mode even after all the DCs have been upgraded to Windows 2000 until the Network Administrator switches it to native mode. 3. Follow the DNS namespace for each domain thereafter so that each domain tree is migrated completely before migrating the next domain tree. For example, if migrating the root.com first, the second domain to be migrated is trunk.root.com, and the third is leaf.trunk.root.com. 4. When migrating the next domain tree, start at the root of its namespace and work through each domain to the end of the domains. For example, after migrating the root.com domain tree, migrate the www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

nextdomaintree.com and its subdomains trunk.nextdomaintree.com and leaf.trunk.nextdomaintree.com in that respective order. Figure 8.3 Migration Strategy for a Single Domain Legacy Windows NT3.5x Domain

Legacy Windows NT4 Domain Legacy Windows NT4 BDCs

Windows 2000 DC Windows NT4 BDCs Windows NT4 Member Servers

Windows 2000 DCs Windows NT4 Member Servers Mixed Mode

Windows 2000 DCs Windows 2000 Member Servers Native Mode

Within the forest, each domain must be migrated completely before starting the next.The domain has its own migration strategy: 1. Complete all preparation work of cleaning users, groups, and applications. Perform a full backup of the PDC before migrating. 2. When migrating, begin with the PDC first. Even if you intend to have newly installed Windows 2000 servers installed as DCs, you must migrate the PDC before installing the new Windows 2000 servers. If you attempt to install an Active Directory DC into an existing Windows NT 4.0 domain with an existing PDC, it will fail. An Active Directory DC cannot exist in the same domain with a legacy PDC. www.syngress.com

241

242

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

3. Perform a full backup of each BDC before migrating it. 4. After the PDC has been migrated, the BDCs should be migrated next. 5. Perform a full backup of each member server before migrating. 6. After all DCs have been migrated, the member servers should be migrated to Windows 2000. 7. The last step in the domain migration is to perform a quality assurance check to verify the printers, clients, users, and other resources that were migrated. Domain restructuring is the migration strategy for merging two or more domains into a single Active Directory domain, or for splitting a legacy domain into two or more Active Directory domains, or any combination of merges and splits.This may be necessary if the domain and DNS plan collapses domains in favor of using sites to manage the physical network traffic and using OUs for delegating administration.The destination domain is the one in which all the users, computers, and resources will reside when migrated to Active Directory (see Figure 8.4).To do this: 1. Begin by migrating legacy NT domains to the destination domain first, or by creating a new domain for destination by installing at least two Active Directory DCs. By installing more than one DC, additional copies of Active Directory exist for fault tolerance. 2. Move user and group accounts into the destination domain from the other domains. 3. Move computers and member servers into the destination domain from the other domains. 4. Back up data on merging DCs from the other domains and run fresh installation into the Active Directory domain as DCs, or as member servers if they are no longer needed as DCs. 5. Reinstall applications on the newly installed servers. 6. Restore backup data to the newly installed servers. 7. Upgrade member servers into the Active Directory domain as members. 8. Verify resources, users, groups, and computers as a final quality assurance check.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Figure 8.4 Domain Restructure: Collapsing Domains into a Single Active Directory Domain First

Legacy Master Domain

Second Legacy Resource Domain with User Accounts

d

Thir Legacy Resource Domain with No User Accounts

Primary Domain Controllers Some preparation should be completed prior to migrating a primary domain controller (PDC).Your first effort is to streamline the domain so that user accounts, group accounts, and computer accounts are accurate. Before beginning, best practices dictate that a complete backup should be executed in case some account was deleted that should have been retained. After that, you have the following tasks to complete: 1. Delete old user accounts. 2. Delete the home directories associated with the old user accounts. 3. Remove empty groups. 4. Consolidate groups and simplify the group structure. 5. Remove computer accounts from the domain if they are no longer used. 6. Verify that the domain security policies are correct. 7. Simplify protocols so that only TCP/IP (if possible) is used. 8. Verify and validate the DNS, DHCP, and WINS configurations. 9. Make sure that existing DNS systems support Service Locator Resource Records (SRV) and, preferably, also support dynamic updates. 10. Update Windows NT and any applications with the latest service packs. 11. Convert the file system to NT File System (NTFS) on all DCs. www.syngress.com

243

244

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

12. Verify that the server hardware is compatible with Windows 2000. 13. Make sure that any NT v4.0 clients are upgraded with the latest service pack. 14. Uninstall third-party backup programs and virus detection programs. These applications have been proven to cause failures during Windows 2000 upgrades. 15. Run WINNT32 /CHECKUPGRADEONLY from the Windows 2000 setup files to ensure that the server can be upgraded. Before migrating any servers, a test should be conducted.This pilot migration should verify not only that the migration will work, but that a contingency plan to back out of the Windows 2000 migration will also work. One way to do this is by creating a back-out BDC.The steps involved in creating a back-out BDC are as follows: 1. Use legacy Windows NT servers with hardware comparable to that available on the production network. 2. Back up each pilot server. 3. Create a synchronized BDC for the domain. 4. Remove the synchronized BDC from the domain. 5. Execute the migration with the PDC first. 6. Test your recovery process by removing the PDC and recovering the domain with the new back-out BDC. 7. Test the recovery process again using backup tapes. Repeat the migration of the PDC process, but recover the domain using the backup tape.

NOTE You can take a PDC off the network and upgrade it to Windows 2000. If the upgrade fails, you can promote an existing BDC to a PDC and no one will be affected by the process. If the upgrade is successful, you can bring the PDC back onto the network where all BDCs will look to it as the PDC Emulator.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Changes Required When Upgrading a Domain Controller When you execute a domain controller upgrade or migration, you will need to consider two services that may be running on the server prior to the upgrade: ■

DNS

■

NTFS

Active Directory requires DNS in order to function.The DNS server must support SRV RRs because they are used to locate Windows 2000 DCs. Another feature that can facilitate DNS administration is dynamic update protocol (DDNS). DDNS is strongly recommended to reduce administrative overhead for DNS.The strategy you should take when upgrading a domain controller that also acts as a DNS server might involve a second server to take over the DNS zone, even temporarily. Because Windows NT 4.0 DNS does not support SRV RRs, it cannot be used as the locator service during the execution of Dcpromo.exe. However, the upgrade of the operating system and the DNS service will occur prior to Dcpromo executing.This means that the DNS service will become a Windows 2000 DNS service, but it will not have the correct resource records in the zone when it upgrades, nor will the upgraded zone support DDNS, so the server will not be able to register those RRs by itself.There are two strategies for working around this: 1. Prior to the server’s upgrade, you can bring up a different Windows 2000 DNS server and perform a zone transfer from your current DNS service, then make that new server authoritative for the zone.Then, you should configure that zone to support dynamic updates or to add the correct RRs for the new server. Finally, you configure the soon-to-beupgraded domain controller as a DNS client to the new server, and perform the upgrade. 2. When Dcpromo starts, you can simply let the first dialog screen sit unanswered while you kick off the DNS service. From there, you can either configure the newly upgraded zone to support dynamic updates or you can add the RRs needed for the new DC.Then, simply switch back to the Dcpromo screen and continue.

www.syngress.com

245

246

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Active Directory DCs must have NTFS in order for the Active Directory database to be installed. If the server is already running NTFS v4.0, it will be upgraded to NTFS v5.0. If the server is not running NTFS, the file system must be converted to NTFS in order for Active Directory to be installed. If you answered No to the prompt to convert to NTFS, and then wish you answered Yes, you still have some options.You don’t have to format the disk in order to convert to NTFS. Microsoft has provided a method so that you don’t lose all your data. However, it’s always a good idea to backup your data before you begin. You can update the file system in two ways: ■

Run CONVERT /FS:NTFS at a command line prompt.

■

Use the Disk Administrator.

Backup Domain Controllers One recovery method that can be implemented before upgrading the domain is the preparation of a recovery backup domain controller (BDC).This BDC is useful if there is a need to roll back changes if something goes wrong.The first thing to do is make sure that the legacy Windows NT domain has a BDC. If it does not, a BDC should be installed. The BDC should have a copy of each of the services that are running on the PDC. For example, if the PDC is also a DNS server, DNS should be installed and configured on the BDC. Other services that should be copied are DHCP,WINS, and any business-critical messaging, print, and file services. A backup copy of the data used by each of these services should be placed on the BDC.There is no need to start any of these services unless there is a failure. Synchronize the BDC with the PDC so that it has the most current security account data in it.This can be done through the Server Manager utility, shown in Figure 8.5.To synchronize the entire domain including the recovery BDC: 1. Click the Computer menu. 2. Click Synchronize Entire Domain. After synchronization, take the BDC offline. An interim step can be taken before taking the BDC offline to ensure that the network is recoverable.This process is to promote the BDC to a PDC and verify that each service will work. If that is successful, then promote the former PDC back to the PDC, which automatically demotes the recovery machine to a BDC. After verifying data integrity, simply shut the recovery BDC down and take it off the network. www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Figure 8.5 Synchronizing a Legacy Domain

Configuring & Implementing… About Windows NT 3.51 Migrating computers from one operating system to another can be a dilemma. There are issues with application compatibility and hardware compatibility—especially when the operating systems have great differences. It is more likely for a successful migration from Windows NT 4.0 to Windows 2000 than it is for a migration from Windows NT 3.51 to Windows 2000. The Windows NT 3.51 operating system is ancient in terms of software age. When it was developed, computers in the workplace tended to be 486s. The Windows 2000 operating system does not support most of the computers that were around when Windows NT 3.51 was developed. Even if the hardware is compatible, the applications may not work. Applications that were developed for installation into either Windows NT 3.5x or Windows NT 4.0 tended to create different registry keys for each operating system at the time of installation. Migrating the more similar Windows NT 4.0 may work, but migrating from Windows NT 3.51 probably will have errors and issues. Continued

www.syngress.com

247

248

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

To solve these issues, an incremental upgrade strategy may succeed better than a direct upgrade. For instance, the Windows NT 3.51 computers can first be upgraded to Windows NT 4.0. After that is completed, the computers can be upgraded to Windows 2000. Two known issues regarding using Windows NT 3.51 in a Windows 2000 environment involve authentication and SIDHistory. Authentication problems occur when a user from a Windows 2000 account domain attempts to access a resource on a Windows NT 3.51 server in a resource domain. The Windows NT 3.51 domain does not construct tokens including any groups except those from the account domain from which the user is logging in. This is unlike the behavior of both Windows NT 4.0 and Windows 2000 and may result in a denial of access to a resource, or access to a resource that should be denied. The SIDHistory issue occurs when a user account is moved from one domain to another and receives a new security identifier (SID). The SIDHistory attribute will “remember” the old SID and enable access to the old resources by using it. However, Windows NT 3.51 does not use the SIDHistory attribute and will not use them for access. This, again, may result in either the denial of access to a resource, or access to a resource that should be denied.

Member Servers Member servers are designated as resources in both the legacy Windows NT domains and the Active Directory domains. A member server does not have a copy of the domain security accounts or Active Directory. Instead, member servers provide services to users such as file and print services,Web services, databases, messaging, remote access, and so on. A user can gain access to the member server either by authenticating through the domain in which the member server is a part, or authenticating to a domain that trusts the member server’s domain, or authenticating to the member server’s local accounts database.The local accounts database, which is the local SAM on legacy Windows NT servers, stores a set of local users and local groups.The SAM participates in the registry.

Promoting Member Servers with Dcpromo Even though a server was a member server in a legacy Windows NT domain, it easily can be promoted to an Active Directory DC after it is upgraded to Windows 2000 Server.This is a change from legacy Windows NT, where DCs www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

had to be specified during installation only.The legacy NT server’s role could not be changed afterward. Now, the server can be promoted to a DC and demoted to a member server whenever deemed necessary. Windows 2000 Server provides a tool with which to promote a member server to a DC: the Active Directory Wizard, or Dcpromo.exe. As a member server, the Windows 2000 Server uses DNS to contact a DC and checks to make sure that requesting users actually have the correct rights to use whatever resource they are requesting.When a member server is promoted to a DC, the server copies the Active Directory locally, receiving a read/write replica for its domain’s partition. As a DC, the server simply uses its local database to ensure that there are appropriate permissions.The Active Directory Users and Computers Management Console enables a Network Administrator to manage the database for user permissions from any DC. Another change that occurs when a member server is promoted to a DC is that it can now make changes to Active Directory on its locally stored database. The server then participates in the replication topology, which increases the traffic between it and its peer DCs on the network.

Upgrading with the Windows 2000 Setup Wizard The final step before upgrading a legacy Windows NT server to Windows 2000 is to run the WINNT32 setup file with the /CHECKUPGRADEONLY switch. This action will be a final verification that the server can be upgraded. If upgrading directly from the CD-ROM, after inserting it, the dialog box shown in Figure 8.6 will appear. If upgrading from a network share, this prompt does not appear. Figure 8.6 Upgrading from the CD-ROM

The installation wizard begins with the screen shown in Figure 8.7.This dialog lets the installer select between an upgrade of the existing server, or a new installation of Windows 2000 in a different directory.The second option creates a dual boot machine. www.syngress.com

249

250

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Figure 8.7 Selecting between an Upgrade and a New Install

The second wizard screen is a standard license agreement dialog. After selecting the agreement option and clicking Next, the third screen appears as shown in Figure 8.8.This screen is significant because it will show any running services or programs that are known to be incompatible with Windows 2000 Server. If any of these services or programs are vital to the production network, the following steps should be taken: 1. Click Details and investigate the compatibility issue. 2. If the answers do not indicate that the installation can continue, click Cancel and bail out of the setup program. 3. Further investigate the compatibility by checking Microsoft’s Web site at www.microsoft.com and the vendor’s Web site. 4. Create a strategy for removing, replacing, or upgrading the application. 5. Upgrade or replace the application, or uninstall it. 6. Begin setting up Windows 2000 Server again. After clicking Next in the System Compatibility dialog, the rest of the installation continues without user input. Files are copied.The system reboots automatically and enters the Windows 2000 text mode setup portion.This completes without user interaction and automatically reboots.The Windows 2000 Server graphical setup completes without need for user input. After a final reboot, the server starts for the first time as a Windows 2000 Server. If the upgraded server was a PDC or BDC on a legacy NT domain, the Active Directory Wizard begins automatically.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Figure 8.8 System Compatibility Issues

Installing Active Directory Services The Active Directory Wizard installs Active Directory Services.This wizard is available from the Windows 2000 Configure Your Server screen, or can be prompted with the Dcpromo.exe command. The Active Directory Wizard branches out at each screen to enable you to install the right configuration.Table 8.2 lists the steps you need to take to reach the configuration you desire. Table 8.2 Active Directory Installation Scenarios Server Prior Role

Action

Domain Demote controller

Resulting Role Member server

Resulting Domain and Forest N/A

Steps in Active Directory Wizard 1. Click Next for first screen. 2. If this server is also a Global Catalog Server (GCS), a warning message will pop up. Click OK to confirm. 3. If this is the last DC in the domain, check the box. Click Next. 4. Provide the Administrator name and password that is authorized to remove this DC. Click Next. Continued

www.syngress.com

251

252

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Table 8.2 Continued Server Prior Role

Member server

Action

Resulting Role

Promote First domain controller in new domain

Resulting Domain and Forest

Root domain in new forest

Steps in Active Directory Wizard 5. Provide a password for the new local Administrator account. Click Next. 6. Click Next on the Summary, then click Finish. 1. Click Next for first screen. 2. Select Domain controller in new domain. 3. Select Create a New Domain tree. 4. Select Create a New Forest. 5. Either select to configure the DNS client on the server or install and configure DNS on this server. 6. Give the new domain a DNS name. 7. Give the new domain a NetBIOS name. 8. Select a location for Active Directory files. 9. Select a location for the system volume. 10. Select whether users will access this domain via NT4 RAS servers. 11. Provide the password to be used for Active Directory restore. Continued

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Table 8.2 Continued Server Prior Role Member server

Member server

Action

Resulting Role

Resulting Domain and Forest

Steps in Active Directory Wizard

Promote Additional Any domain 1. Click Next for first screen. domain in any forest 2. Select Additional domain controller controller in existing in existing domain. domain 3. If the DNS client is not configured on this server, this will need to be done prior to continuing through Active Directory setup. 4. Select a location for Active Directory files. 5. Select a location for the system volume. 6. Provide a password to restore Active Directory. Promote First Subdomain 1. Click Next for first screen. domain in existing 2. Select Domain controller controller domain tree in new domain. in new 3. Select Create a new child domain domain in an existing tree. 4. Either select to configure the DNS client or install and configure DNS on this server. 5. Give the new domain a DNS name. 6. Give the new domain a NetBIOS name. 7. Select a location for Active Directory files. 8. Select a location for the system volume. 9. Select whether this domain will have NT4 RAS servers. 10. Provide a password to restore Active Directory. Continued

www.syngress.com

253

254

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Table 8.2 Continued Server Prior Role Member server

Action

Resulting Role

Promote First domain controller in new domain

Resulting Domain and Forest New domain tree in existing forest

Steps in Active Directory Wizard 1. Click Next for first screen. 2. Select Domain controller in new domain. 3. Select Create a New Domain tree. 4. Select Place this new domain tree in an existing forest. 5. Either select to configure the DNS client on this server or install and configure DNS on this server. 6. Give the new domain a DNS name. 7. Give the new domain a NetBIOS name. 8. Select a location for Active Directory files. 9. Select a location for the system volume. 10. Select whether this domain will have NT4 RAS servers. 11. Provide a password to restore Active Directory.

NOTE NetBIOS does not go away in Windows 2000; instead, it is present as a backward compatibility feature for legacy Windows NT. You may not always see the word NetBIOS, but the Down-level name that appears in various dialog boxes and installation screens refers to the NetBIOS name.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Interim Mixed Domains A mixed-mode domain is one that includes both Windows NT 4.0 BDCs and Windows 2000 DCs.This should not be confused with native mode, which is discussed in this section.There are some benefits to having mixed domains: ■

Multi-Master replication can occur for the Windows 2000 DC that acts as a PDC.

■

The Network Administrator can retain Windows NT 4 BDCs for as long as needed and still be able to use Windows 2000 Server features. There are drawbacks to using the mixed-mode domains as well:

■

The domain size is constrained by Windows NT 4 requirements for maximum number of 40,000 objects.

■

The Network Administrator cannot implement new Active Directory security groups, such as Universal Groups.

■

Other features for Active Directory are not completely implemented until the domain is changed to native mode.These features are listed in Table 8.3.

Configuring & Implementing… Migration to the File Replication Service (FRS) The LanMan Replication (LMREPL) service may be used in Windows NT 4 domains. LMREPL is not compatible with Windows 2000 in native or mixed mode. To migrate, you can create an export container for LMREPL and point it at SYSVOL on a Windows 2000 DC. This is an interim solution until FRS can be fully implemented, which happens once all DCs are Windows 2000.

Mixed Mode After migrating the PDC and while running in mixed mode, the new Windows 2000 DC will act as a PDC Emulator in the domain.There is only one PDC Emulator in the domain, regardless of the number of Windows 2000 DCs.The www.syngress.com

255

256

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

PDC Emulator acts as a PDC for nonmigrated BDCs and clients. It will handle password changes for clients and BDCs, act as a Windows NT Master Browser, and provide the replication source for BDCs. Table 8.3 Active Directory Features and Mode Compatibility Active Directory Features

Native Mode Function

Mixed-Mode Function

Kerberos Transitive Trusts Kerberos Authentication

Available

Available

Available

Available only on Windows 2000 DCs and utilized by Win2k clients and other Kerberos clients Available but can be administered only using Windows 2000 tools Available only when no DCs are running NT4 Not available; can use only legacy Local and Global groups

Organizational Units (OUs) Active Directory Scalability Active Directory Security Groups (nested groups) Multi-Master Replication Group Policy Netlogon Replication

Available Available Available

Available

Available only on Windows 2000 DCs

Available

Available only on Windows 2000 Servers Available as a backwards compatibility feature for NT 4 BDCs

Not available; replaced by the File Replication System (FRS)

Native Mode Native mode domains are those that have only Windows 2000 DCs and that have been changed to native mode manually. After upgrading the PDC, the BDCs should be upgraded as soon as possible.This will enable the domain to be switched to native mode, at which point clients and servers alike will be able to participate in the Active Directory advanced features. Once a domain is in native mode, it cannot be switched back. For example, in mixed mode, the domain will be limited to a total number of 40,000 objects, whereas in native mode this number can be at least one million. www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

To switch a domain to native mode, start the Active Directory Users and Computers console by clicking Start | Programs | Administrative Tools, and then selecting Active Directory Users and Computers. In the left pane, click on the domain that will be changed to native mode. From the Action menu, choose the Properties option.When the properties dialog appears, on the General tab that is shown in Figure 8.9, click Change Mode. Figure 8.9 Switching to Native Mode

Migrating Components When performing a domain upgrade, the domain components, such as users and groups, are migrated automatically. However, restructuring domains into a single Active Directory domain will require components to be migrated.The scenarios listed in Table 8.4 will apply to a domain restructure that requires migration of components. Table 8.4 Restructuring Scenarios Restructure

Process

New Forest Migration

Create a new forest of Windows 2000 servers and migrate components from existing legacy Windows NT domains. Take existing domains offline and remove. The process for a new forest migration is illustrated in Figure 8.10. Continued

www.syngress.com

257

258

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Table 8.4 Continued Restructure

Process

Merge Domains

Perform domain upgrade of those legacy domains that will participate in the new forest, then migrate components from the remaining legacy Windows NT domains. Take legacy Windows NT domains offline and remove. Create a new domain and migrate components from the legacy NT domain. Delete the components from the legacy NT domain that remain within Active Directory. Either create a new domain and migrate the remaining components, or perform a domain upgrade.

Split Domains

Using Organizational Units to Create a Hierarchical Structure Even when upgrading a domain, the OUs will need to be created and users moved into the correct container OUs. OUs are created in the Active Directory Users and Computers Management Console.They should be planned out prior to being created, and typically provide one of four functions: ■

Delegating administration

■

Hiding objects

■

Applying group policy

■

Organizing objects logically

The OUs designated for delegating administration typically will be the toplevel OUs in the hierarchy because that will simplify the administrative structure. Administrators may be separated by geography or by business unit.There may also be levels of administrative authority, such that some Administrators have more control over more objects or properties than others.When delegating administration, the highest level of administrative authority should be granted at the top, and then lesser authority in OUs further down the tree. Below those top levels, the OUs for hiding objects and applying group policy will organize objects further.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Figure 8.10 Domain Migration

2. Trust the legacy domain. Use NETDOM to view trusts 1. Create new forest. Install DCs for each domain 3. Clone Local groups from legacy domain to new domain.

4. Clone Global groups from legacy domain to new domain.

5. Clone users from legacy domain to new domain. Use CLONEPRINCIPAL to clone groups and users

6. Create OUs and move users and groups into new hierarchy.

7. Move resources to new domain by upgrading servers to Windows 2000 and making members of new domain. Move machine accounts for client computers to new domain. Use NETDOM to make new member server accounts then promote to DCs.

8. Remove Legacy Account Domain.

www.syngress.com

259

260

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Configuring & Implementing… How to Hide Objects Sometimes Administrators do not want some objects to be seen in the tree, even when users do not have the authority to view their attributes. One use of OUs is to place one or more objects into OUs and limit the ability of users to see the objects in the entire OU by removing the List Contents for those OUs. To hide objects in this way follow these steps: 1. Open the Active Directory Users and Computers Management Console. 2. Navigate to the OU where you will place the hidden objects. 3. Right-click on the OU and select Properties. 4. Click on the Security property page. 5. Revoke all permissions by removing them from the Security property page. 6. Click Advanced. 7. Uncheck the box for Inherit Permissions from Parent, and click OK to return to the Security property page. 8. Add the groups that need to have rights to this OU on the Security property page with the appropriate rights. 9. Add any objects into the OU that you want hidden from users’ views.

User Accounts Network Administrators usually want the users migrated along with their rights to network resources.The only way to accomplish this feat is to make sure that when a user is migrated from one domain to another, and that user account belongs to one or more Global groups, the Global groups are moved as well. Some Global groups associate users with network resources via ACLs. In order to maintain user access to those resources, both the users and the group must be migrated at the same time.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

ClonePrincipal One utility used for migrating user accounts is called ClonePrincipal, and is found on the Windows 2000 Server product CD.The name is derived from the fact that it can clone a security principal, or an object that can be granted rights and privileges to other objects within Active Directory. Security principals are users and groups in Active Directory. ClonePrincipal uses customizable Visual Basic scripts for migrating objects incrementally to Active Directory from legacy Windows NT domains. Both user accounts and local groups can be migrated using ClonePrincipal.

Active Directory Migration Tool Microsoft realized early on that using command line tools and those requiring heavy scripting on the part of the network administrator could prove too timeconsuming for migrating accounts from an existing Windows NT domain.They needed a tool that was easy to use, and followed an intuitive migration process. Rather than develop this tool themselves, Microsoft chose to license a migration utility from a company called Mission Critical Software.This tool was christened the Active Directory Migration Tool (ADMT). ADMT not only can restructure domains by migrating objects, but it can be used as a tool for detecting any potential problems before beginning the migration. ADMT can migrate users, groups, computer objects, Exchange Server mailboxes, and grant rights to files—one-stop shopping for a domain migration. When you begin using ADMT, you install ADMT on a management workstation in the target Windows 2000 domain. After you begin migrating users, you will be pulling them from the source Windows NT domain.The ADMT is a zero-footprint utility. During the migration itself, ADMT installs agents in the background on the source domain servers.These agents translate the security on the resources and objects that are migrated. After the migration completes, the agents uninstall themselves. ADMT provides a series of wizards: ■

Computer Migration Wizard

■

Group Mapping and Merging Wizard

■

Group Migration Wizard

■

Reporting Wizard

■

Service Account Migration Wizard www.syngress.com

261

262

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory ■

Trust Migration Wizard

■

User Migration Wizard

You can use the wizards to migrate a set of objects from the domain directly into OUs, rather than pull all objects over and then move them to your target OUs.You may even enable the user accounts to remain active in both the source Windows NT domain and the target Windows 2000 domain.You can test your migration, which determines the success of the parameters you’ve set for a migration without actually making changes to the domains, and you can undo the last migration you performed. Microsoft has ADMT available for download at http://www.microsoft.com/windows2000/downloads/tools/admt/default.asp.

Machine Accounts Machine accounts are composed of both Windows for Workgroups and Windows NT computers. Some of those machine accounts can be clients, and others can be servers and DCs. Each legacy Windows NT computer has its own local SAM. Each SAM contains Local groups. In the legacy system, users became members of domain Global groups, and domain Global groups became members of computer Local groups.Then the Local groups were granted access to resources on the local machine.When migrating machine accounts, all the Local groups should be migrated as well. Member servers and client computers can join new domains at the computer. From the Network Properties, there is a button enabling domain membership that can be changed to an Active Directory domain. However, the computer account must be available within the new domain, or the user making the change must have a name and password to an account with the proper administrative rights for joining a domain. NETDOM is a command-line utility that can manage computer accounts, domains, and trust relationships.The NETDOM utility can perform the following functions: ■

Add, remove, and query machine accounts in a domain, even specifying the OUs.

■

Join Windows 2000 computers to a domain.

■

Establish and manage a domain’s trust relationships.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Nested Groups Windows 2000 has four types of groups: ■

Local A Local group is limited to resources within a single computer, but can have members from any trusted domains.

■

Domain Local Domain Local groups are limited to resources within a single domain, but can have members from any trusted domains.

■

Domain Global Domain Global groups are capable of being granted access to any trusted domain, but can have members only from the local domain.

■

Universal Universal groups can be granted access to any trusted domain running in native mode, and can have members of both users and computers from within the local forest.

Nested groups are a method of reducing the numbers of members in an Active Directory group. Group memberships are limited to 5000 or fewer members.The limitation is placed on the group because an update to the group membership requires that the entire group’s membership list be replicated. Nested groups not only help reduce the number of members in a group, but also facilitate administration by enabling a master security group that can have multiple logical groups of users that share work functions. The ability to nest the groups is available when the domain is in native mode, and nesting configurations are listed in Table 8.5.The reason for this is that legacy NT domains do not support nested groups. For backward compatibility, local groups can contain Global groups, which then contain user accounts. Table 8.5 Nesting Groups in Native Mode Container Group Group Members

Other Members Member Source

Universal group

Universal groups Global groups

Global group Domain Local group

Global groups Universal groups Global groups

User accounts Computer accounts User accounts User accounts

Domain Local group

Domain Local group

Any domain, same forest, or trusted Same domain Any domain, same forest, or explicitly trusted Same domain

www.syngress.com

263

264

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Global Groups Since Global groups are security principals, migrating Global groups can be performed with the ClonePrincipal utility.To ensure that the correct users can access the correct resources through the migration of the Global group, the user accounts must be migrated at the same time. Another method of moving a Global group is to recreate the group in Active Directory and then add the correct members to it.The Global group is traditionally a holder of users and less likely to be granted access to resources directly. Instead, it was usually granted rights to resources by being made a member of Local groups that had those rights. So, in order to grant permissions to resources, the Global group must be made a member of other Local groups in Active Directory that have those rights until the domain is switched out of mixed mode and into native mode. Once the domain is in native mode, the Global group can be changed to a Universal group or become a member of other Global, Universal, or Domain Local groups.

Delegating Administrative Authority One reason for merging legacy NT domains that were used for ensuring separation of administration is to take advantage of Windows 2000 Active Directory for the delegation of administration. In Active Directory, responsibility is delegated by the OU, but can be inherited by lower, nested OUs.This directly affects how OUs are designed, since the simplest design would place the highest level of administrative capabilities at the highest level of OUs. The migration strategy is to map out which users should have the highest level of administrative control, which should have partial control, and which may have the object- and attribute-level control.You should make absolutely certain that the inheritance of administrative rights is appropriate. Otherwise, you may inadvertently assign a person more administrative capabilities than you originally intended. After completing the map, delegate authority to those users at the top of the OU hierarchy for the full control, mid-level for partial control, and closest to the users for per-object and attribute control, as illustrated in Figure 8.11. To start the Delegation of Control Wizard, in the Active Directory Users and Computers Management Console, right-click on an OU and select Delegate Control. As you follow the wizard through the steps needed for delegating control in the Active Directory, you will find that there are predefined roles. A Network Administrator should not limit him- or herself to this predefined set,

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

and should investigate the variety of permissions allowed by selecting Do customized delegation instead of a predefined role.The Network Administrator can use the customized delegation to grant control over certain object types, such as only user accounts or only computer objects.To find out more about delegating control, see Chapter 5, “Designing the Basic Structure.” Figure 8.11 Delegation of Administration Design

Administrative Full Control

Legacy Account Domain A Per Ob

Partial Admin Control

ject an dA Admin ttribute Only Contro l

Administrative Full Control

Legacy Account Domain B

Partial Admin Control

ttribute ct and A Per Obje in Control Adm

Only

Insert into the Replication Topology When there is a single DC in Active Directory, there is no need to establish replication. Implementing a single DC is not the best practice for deploying Active Directory, as a minimum of two DCs is recommended. Once there are two DCs, replication begins between them. Replication concerns only the DC computers in Active Directory because they hold the copies of the Active Directory databases.When there is a single DC, there is no other DC to replicate changes to or receive updates from. The issues arise as soon as the second DC is installed. During the actual installation, Dcpromo must synchronize the new DC with the other DCs in the domain. Dcpromo uses compressed traffic to do this. Once two DCs exist in a single forest, there is a need to replicate something depending on whether the second DC is in the same domain or a different domain. And the frequency of the replication will be changed based on whether the second DC is in the same site or a different site. Same site, or intrasite, replication occurs automatically. Each DC has a function within it called a Knowledge Consistency Checker (KCC).The KCC generates an intrasite topology running over RPC (Remote Procedure Calls) whenever a new DC is installed into a site.

www.syngress.com

265

266

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

When a DC is installed into a different site, the Network Administrator has the option to let the KCC automatically generate the intersite replication topology, or to establish it manually.When the Network Administrator manually establishes the connections for replication, there is the opportunity to create bridgehead servers that direct the replication traffic over certain network links.To find out more about the replication system, see Chapter 6, “Designing a Site Structure.”

Upgrading Clients to Windows 2000 Professional Whether to upgrade a client workstation or not is a concern for many organizations. Some organizations have legacy applications that are not compatible with Windows 2000 Professional, although many will find comparable applications that are Windows 2000 compatible. Some will be faced with extra costs required to upgrade hardware to be compatible with Windows 2000 Professional, although many have planned for this change since the announcement of Windows 2000’s release. Microsoft realized after Windows 2000 was released that application compatibility was an issue for many of their customers.They responded by creating an Application Compatibility Toolkit and released it in August 2000.This toolkit can be downloaded from www.microsoft.com/technet/treeview/default.asp?url=/ TechNet/prodtechnol/windows2000serv/downloads/appkit11.asp. All organizations will need to plan for user support and training. Even though the usability features of Windows 2000 can make end users more productive in the long run, there is a learning curve at first.These organizations must weigh these concerns against the overall benefits that Windows 2000 Professional can bring them. Many of these organizations may be faced with the decision of whether to upgrade to Windows XP or Windows 2000.The newer Windows XP may be beneficial in some ways including improved application compatibility, so if you have to make this decision, you should carefully evaluate the investment that you have made so far toward a Windows 2000 Professional deployment, against the benefits you expect from a Windows XP deployment: ■

Enhanced security Support for Smart Cards and the Public Key Infrastructure.

■

Enhanced reliability More reliable than previous versions of NT, fewer reboots when changing configuration of the workstation.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8 ■

Enhanced usability Proven graphical user interface with improvements geared toward the way people work.

■

Enhanced performance Snappier performance.

■

Enhanced manageability Plugs right into Active Directory and takes advantage of all the Active Directory management features.

Once a decision has been made to upgrade to Windows 2000 Professional at the desktop, there is a secondary decision about whether to upgrade the servers or the clients first. If an organization plans to roll out Windows 2000 Professional by using the Remote Installation Service (RIS) of Windows 2000 Server, the “which first” decision is fairly obvious—Windows 2000 Server first.This decision is in line with long-standing networking best practices when deploying new networks: 1. Establish the network infrastructure first. 2. Establish security and servers next. 3. Establish workstations last. Microsoft does not recommend a particular migration method in preference over any other.There are reasons that a company may prefer to migrate their workstations first. For example, they may be using Windows 9x without a software distribution system and do not wish to install the DSClient prior to deploying Windows 2000 because it will mean touching the desktop twice.That time consumption can result in an expensive deployment.

NOTE RIS is a new feature of Windows 2000 that enables the operating system to install software remotely from a central distribution point. It requires either a BIOS or chip on the Network Interface Card (NIC) that will enable it to be managed remotely. These chips are called PXE (“pixie”), which stands for Pre-Boot Execution Environment. PXE is part of the Wired for Management (WfM) protocol set. Although these are not the only manufacturers with WfM technology, Phoenix BIOS produces a BIOS that is PXEcapable, and 3Com produces NICs that are PXE-capable. You can use RIS with network boot floppy disks, but then you will need to visit each desktop to deploy the operating system, removing the benefits of having a no-touch deployment via RIS but retaining all the expense of developing it.

www.syngress.com

267

268

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

Additionally, when installing the Windows 2000 Server first, there is only a single, Active Directory-enabled Windows 2000 Professional image that must be created and maintained. However, when installing the Windows 2000 Professional workstations first, they probably will need to be updated immediately after the Windows 2000 Servers are installed in order to be able to access resources that are migrated to a new area in the new Active Directory.This may be deployed easily using a logon script that executes NETDOM, however, to change the domain to which the workstation belongs. A second image must be created for all new workstations deployed after the Windows 2000 Servers are installed.This translates into additional work and affects the bottom line of a deployment project’s budget. When an organization has Windows 95 or Windows 98 clients, it will need to provide access to Active Directory in order for the clients to function on the network. An interim solution is found in the DS (Directory Services) Client.The DS Client enables Windows 95 and Windows 98 computers to work in Active Directory in much the same way as a native Windows 2000 Professional computer would.This includes the ability to: ■

Query Active Directory for users and resources.

■

Install Active Directory printers.

■

Utilize Kerberos authentication.

On the other hand, a Windows 9x client with the DS Client software will not be able to use Group Policy objects.The computer will not appear as an object within the domain and cannot be added to OUs, either.Windows 9x computers do not need to have DS Client in order to use standard file and print services; they need it to access some of the Active Directory features.

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

Summary Migrating to Windows 2000 from legacy Windows NT domains can take the form of one of two types of migrations: ■

Domain upgrade

■

Domain restructure

Regardless of the type of migration you undertake, DNS servers must either be validated, or installed and zones configured before you begin.The type of migration depends entirely on the plans for the Active Directory for the Forests, Domains, and Domain Name System namespace, Organizational Units , and site topology, and how they fit with the existing domain structure. A domain upgrade occurs if the legacy domains will remain intact as Active Directory domains after migration. A domain restructure is when the domains are merged or split into different configurations.The first place to start when migrating is with the forest: 1. Migrate root domain first. 2. Migrate each domain completely before starting the next. 3. Follow the DNS namespace to the next subdomain to migrate each domain tree before starting the next. 4. Completely migrate each domain tree before starting the next forest. Drilling down further into the migration strategy, the method for migrating each individual domain is next: 1. Complete all preparation work and back up the PDC. 2. Migrate the PDC. 3. Perform a full backup of each BDC before migrating it. 4. Migrate each of the BDCs next. 5. Perform a full backup of each member server before migrating. 6. Migrate each member server next. 7. Verify the working condition of printers, clients, users, and other migrated resources. When restructuring a domain, there are additional steps that require individual components to be migrated from source legacy domains to the target Active Directory domain(s). For example, the process to merge domains is as follows: www.syngress.com

269

270

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

1. Migrate the destination domain or create a new Active Directory destination domain. 2. Move user and group accounts into the destination domain from the other domains. 3. Move computers and member servers into the destination domain from the other domains. 4. Back up data and install DCs from the merging domains into the Active Directory domain. 5. Reinstall applications. 6. Restore backups of data. 7. Upgrade member servers with Windows 2000. 8. Verify resources, users, groups, and computers. When Windows 2000 Server is installed on a new computer, it automatically will install as a member server. However, when upgrading a PDC or BDC, Windows 2000 Server automatically will begin the process to install Active Directory by starting the Active Directory Installation Wizard as soon as the Windows 2000 Server installation is complete. An Active Directory domain has two modes, mixed mode and native mode. When running in mixed mode, Active Directory acts as a PDC for any legacy NT BDCs.This enables backwards compatibility, as well as an incremental upgrade strategy such that each server can be migrated and verified before beginning the next. Native mode is required for using Active Directory features such as nested groups and Universal Groups. Native mode cannot be used until all BDCs are upgraded, and the domain cannot be returned to mixed mode after switching. Two utilities are critical components for moving users, groups, and computers: ClonePrincipal and NETDOM. ClonePrincipal is a customizable scripting program that can copy a security principal (e.g., user or group) from one domain to another. NETDOM is a command-line utility that can manage domain trusts, machine accounts, and domain memberships. ADMT is a graphical tool for migrating or restructuring Windows NT domains to a Windows 2000 Active Directory. After components have been migrated, the Administrator may want to delegate control over some of them. Delegation of administration is necessary when merging two legacy NT domains and using the OU structure to separate the

www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

administrative duties.The Delegation of Control Wizard is available in the Active Directory Users and Computers Management Console. Inserting into the replication topology is an automatic function within a site. The Knowledge Consistency Checker (KCC) will generate the replication topology whenever a new domain controller is added. Only domain controllers are involved in the replication topology. New sites require that connection objects be created to establish replication between sites.

Solution Fast Track Server Migration Strategies  Before beginning your Windows 2000 migration, make certain that you

have completed your forest plan, DNS and domain plan, OU plan, and site topology.  Clean up user, group, and computer accounts prior to migrating or

upgrading the PDC of a legacy Windows NT domain.  When upgrading a domain, the PDC must be upgraded first, followed

by BDCs, and finally by member servers.

Upgrading with the Windows 2000 Setup Wizard  The Windows 2000 Setup executable for upgrading an existing

Windows NT Server is the 32-bit WINNT32.exe file.  To ensure that hardware can be upgraded to Windows 2000 Server, you

can run WINNT32.exe with the /CHECKUPGRADEONLY switch.  The Windows 2000 Setup Wizard will look at services running on the

Windows NT Server and review them for compatibility with the upgrade. Any services that may be a problem are flagged for your review.

Installing Active Directory Services  When upgrading a domain controller, the Active Directory Wizard

begins automatically.

www.syngress.com

271

272

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

 If you are installing Active Directory on a new Windows 2000 server, or

a server that was previously a member server in a Windows NT domain, you should run Dcpromo.exe, which is the executable for the Active Directory Wizard.  You will need to know what role the new server will be playing in the

Active Directory—whether you are installing a DC for a new domain or an existing one, and whether the new domain is in a new forest or an existing one.  A domain is automatically in mixed mode unless you update it to native

mode.You can update a domain to native mode only if all its domain controllers are Windows 2000 DCs.

Migrating Components  Before migrating any objects, you should create your OU structure in

the target Windows 2000 domain.  Use ClonePrincipal or the Active Directory Migration Tool to help in

migrating security principals and other objects.  NETDOM is a utility for managing trust relationships and computer

account memberships in a domain.

Delegating Administrative Authority  Use your OU plan for assisting with administrative delegation, if you

have designed the plan for distribution of administrative duties.  Map out delegation against your OU structure and ensure that you want

those administrative capabilities to flow down to lower levels in the hierarchy before you begin assigning rights.  Use the Delegation of Administration Wizard to assign administrative

rights.

Insert into the Replication Topology  The moment that a second DC is added to the Active Directory forest,

replication begins. www.syngress.com

Migrating from NT 3.51 or NT 4 to Active Directory • Chapter 8

 Dcpromo immediately replicates data from another DC in the forest to

the newly installed DC using compressed traffic.  Intrasite replication is automatic. Intersite replication may require some

configuration before it begins.

Upgrading Clients to Windows 2000 Professional  Upgrading clients to Windows 2000 requires that the desktop hardware

is compatible with Windows 2000 Professional.  Applications that are not compatible with Windows 2000 Professional

must be upgraded, replaced, or retired.  Remote Installation Services (RIS) can be used to upgrade workstations

from a Windows 2000 Server that has been installed with the RIS service. These workstations can be installed remotely if they have Pre-boot execution Environment (PXE) compatible BIOSes or network interface cards.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: How do you go about migrating two Active Directory domain trees into the same forest after a corporate acquisition?

A: You can use the Active Directory Migration Tool (ADMT) to merge any combination of domains from two different forests.

Q: I get an error when I try to upgrade a BDC to Active Directory. It says that the domain is not an Active Directory domain.What has gone wrong?

A: You will get this error if you try to upgrade a BDC before upgrading the PDC. Begin by upgrading the PDC and then go forward with the BDC.

Q: I want to migrate our network by starting with the member servers, following that with the BDCs, and finally by migrating the PDC so that we can have a www.syngress.com

273

274

Chapter 8 • Migrating from NT 3.51 or NT 4 to Active Directory

working copy of the NT domain SAM constantly updated until we are ready to cut over. Can this migration strategy work?

A: No. Active Directory domain controllers cannot exist in the same domain as a Windows NT PDC.The strategy should be changed to start with the PDC and follow with the remaining BDCs and then member servers.

Q: When I tried to upgrade a Windows NT 3.51 member server to Windows 2000, it failed.What should I do?

A: After reverifying that the hardware and applications are compatible, and that the users, groups, and registry are cleaned up of any unnecessary entries, you should try to upgrade the Windows NT 3.51 server to Windows NT 4.0 first. After a successful upgrade to Windows NT 4.0, try upgrading to Windows 2000 Server.

Q: What types of applications will cause the worst problems with Windows 2000 Server upgrades?

A: The two types of applications that cause the worst problems are virus detection applications and tape backup applications. Many folks forget to check these applications for compatibility because they are always running in the background, and many times they are services on the server. Not only do these applications have very specific registry entries that are difficult for the upgrade to process, but their nature is one that prevents the operating system from being changed.Take a virus detection program: It looks for changes to the boot files and has different methods of preventing them from being changed, whereas the upgrade process makes necessary changes to those same critical files.The conflict causes errors and issues.The backup application is necessary for restoration of the server files if there is a problem, so completely removing it is probably not the best tactic.The best thing to do is to uninstall all virus detection programs and turn the backup application service off. If, after upgrading, the backup application does not work, it can be reinstalled over the old one.

www.syngress.com

Chapter 9

Implementing a Domain

Solutions in this chapter: ■

Installing DNS

■

Installing Domains in Active Directory

■

Integrating DNS into Active Directory

■

Managing Objects in Active Directory

■

Role-Based Administration

 Summary  Solutions Fast Track  Frequently Asked Questions

275

276

Chapter 9 • Implementing a Domain

Introduction Once you complete your domain structure design, implementation can proceed in accordance with your design strategy. Since large Windows 2000 implementation projects may have teams of people with different roles, you should ensure that the installation part of the team has reviewed the design documents and understands them before installing the servers into the domain. If you are lucky, the installation team and the design team are the same set of people or have the same vision for the network. If you’re not so lucky, these teams are two different sets of people with different ideas on how the domain should be structured.The business objectives that you developed during the assessment phase can resolve any difference of opinion between the groups.When design decisions are made for business-specific reasons that are understood by all involved, the two teams generally can come to an agreement for the implementation of that design. Implementing a domain can be as simple as installing a single domain controller (DC), or as complex as upgrading a Windows NT PDC, installing other DCs, and then migrating users from other domains into the new Windows 2000 domain. Hands-on installation usually seems a great deal easier than what the time and effort spent preparing for it would indicate. Microsoft has made installation even easier for Windows 2000 than it ever was for its predecessor,Windows NT. There are three basic steps for the Windows 2000 Active Directory domain installation: 1. Run the Windows 2000 Server installation command. (You have the option of running WINNT from a DOS prompt, booting directly into the installation from the CD-ROM, or running WINNT32 from a 32bit Windows operating system.) 2. Configure DNS as a client to another DNS server or as a service on the Windows 2000 Server. 3. Run the Active Directory Installation Wizard. The installation of a Windows 2000 Server consists of the simple task of running the WINNT command with the correct switches and parameters.The installation of Active Directory occurs after server installation, using the Active Directory Installation Wizard (Dcpromo.exe). DNS is required for Active Directory, so if it is not detected on the network at the time of the Active Directory installation, the Active Directory Installation Wizard prompts to install or configure the service on the Windows 2000 Server.This is a critical juncture

www.syngress.com

Implementing a Domain • Chapter 9

during your installation process. Active Directory will not install if it cannot locate other DCs in the forest, or if it cannot locate itself if it is the first DC in the forest. If DNS is configured as a client, the installer must ensure that the domain’s DNS name is registered in the DNS tables before installing the Active Directory domain. Dynamic updates should be turned on for the DC to register itself. If DNS is configured as a DNS server on the DC, the DNS tables must include the domain name, and dynamic updates must be turned on so that the DNS entries can be created for the Active Directory domain. After installing a DC, the hierarchical structure within that single domain can be created, populated, and managed.This is done by creating organizational units (OUs), creating objects within Active Directory, and establishing a group policy system to enable role-based administration.

Installing DNS DNS makes Active Directory function, so the first thing you need to know is how to verify that DNS is working, and how to install Windows 2000 DNS if it is not already on the network. Once DNS is installed, you can configure it to meet your network’s needs. After some Domain Controllers (DCs) are installed, you can integrate DNS zones into Active Directory, configure them with Dynamic DNS (DDNS), and take advantage of Secure Dynamic Updates.

Verifying Compatibility You must have at least one DNS server that supports Service Resource Records (SRV RRs) before you begin installing DCs. If you have an existing DNS server, you need to verify that it will support SRV RRs before you move forward with the Active Directory installation.You can check Microsoft’s Web site for a compatibility tool called Dcdiag.exe. DCDiag is a command-line tool that you can use to query the DNS servers and conclude whether your DNS servers are compatible.This tool can be downloaded from http://download.microsoft.com/ download/win2000platform/Update/5.0.2195.2103/NT5/EN-US/dcdiag.exe. You can use Active Directory with third-party DNS servers, or with the native Windows 2000 DNS service.The following servers can be used, but do not feel limited to this list. If a DNS server does not fall in this list but still supports SRV RRs as described in RFC 2052, it may be compatible:

www.syngress.com

277

278

Chapter 9 • Implementing a Domain ■

UNIX BIND 4.9.7

■

UNIX BIND 8.1.2

■

UNIX BIND 8.2

■

Windows NT 4.0 (only with Service Pack 4 or later)

■

Windows 2000 DNS

Windows 2000 DNS is highly recommended for a variety of reasons. Neither Bind 4.9.7 nor the Windows NT 4.0 with Service Pack 4 and later support DDNS. DDNS makes it possible for a server or client to register its own IP address and host name on the DNS server, including all of the different types of RRs, of which there are several per DC. Because the DCs have so many RRs in a complex list, it becomes tedious and confusing to add these RRs manually for each DC. If the DC simply registers its own RRs using DDNS, then there is a lot less work for installers and network administrators.You should validate your functional requirements for DNS through testing before implementing DNS. Another feature of Windows 2000 DNS is the support for WINS.Windows NT DNS also supports WINS, but none of the UNIX BIND versions do. If you have a network that is being upgraded from Windows NT, then you will want to use either WINS or DNS with WINS location while the network is being upgraded. Windows 2000 DNS supports other features that may be desirable for your environment: ■

Secure Dynamic Updates via Active Directory integrated zones If you are using DDNS and you have created an Active Directory integrated zone, then updates to the zone are secured.You can use Secure Dynamic Updates only if you have Windows 2000 DNS services running on Active Directory Domain Controllers.

■

Incremental Zone Transfer (IXFR) In a standard DNS configuration, the DNS server that is primary, or authoritative, for the zone will dump-copy the entire zone file to all secondary DNS servers.To avoid this bandwidth-intensive copy procedure, an Incremental Zone Transfer was developed to simply copy the updates that have occurred in the zone. Both Windows 2000 DNS and UNIX Bind 8.2 support IXFR.

■

Unicode characters Only Windows 2000 DNS servers support UTF8 character encoding for DNS names.This extends the standard naming conventions of a–z, A–Z, and 0–9 characters.

www.syngress.com

Implementing a Domain • Chapter 9

Windows 2000 DNS Installation Windows 2000 DNS is not installed automatically as part of the Windows 2000 Server operating system.You can select to install DNS during the installation procedure, or you can add the DNS service later.To add the service later: 1. Logon to the Windows 2000 server as an Administrator or equivalent. 2. Open the Control Panel. 3. Open the Add/Remove Programs. 4. Click Add/Remove Windows Components. 5. Select Networking Services under the Components list. 6. Click Details. 7. Check the box for Domain Name System (DNS) and click OK. 8. Click Next and insert the CD-ROM for your Windows 2000 Server software, or type in the path to the installation files, if prompted. 9. Click Finish after the DNS software files have been copied.

Delegating a Subdomain There are always compromises when organizations implement a project. During the design phase, the design team may have decided to retain the existing DNS system without verifying its compatibility with Active Directory. Or, the design team may have decided to keep an incompatible DNS service on the network. Regardless of the reasons for incompatible DNS servers remaining on the network, they will affect the domain namespace design for Active Directory.This is done by delegating a subdomain. Delegating a subdomain is simply taking the existing DNS namespace, such as syngress.com, and creating a new namespace below it, such as corp.syngress.com, then assigning that subdomain to an Active Directory domain.You will not be able to use the syngress.com namespace for the Active Directory domain. Plus, all domains that are added as subdomains in the same domain tree in the forest must be subdomains to corp.syngress.com.While the incompatible DNS servers remain functioning on the network with the zone for syngress.com, new Windows 2000 DNS servers are given authority over the corp.syngress.com zone. Other domains that are below the corp.syngress.com domain, or in other trees in the forest, can also have their DNS namespaces placed in Windows 2000 DNS zones.

www.syngress.com

279

280

Chapter 9 • Implementing a Domain

To delegate a subdomain, you should configure the new Windows 2000 DNS server to use the original DNS server as a forwarder, which will handle all recursive lookups outside the Windows 2000 DNS server’s own zones. If any query is received by the Windows 2000 DNS server outside its own zones, the Windows 2000 DNS server will forward the query to the DNS servers listed as Forwarders. To configure this: 1. Logon to the Windows 2000 DNS server as an Administrator or equivalent. 2. Click Start | Programs | Administrative Tools | DNS. 3. Right-click on your Windows 2000 DNS server’s name. 4. Select Properties from the pop-up menu. 5. Click the Forwarders tab. 6. Check the box for Enable Forwarders. 7. Type the IP address of the DNS server that will receive forwarded queries. 8. Click the Add button. If there is more than one DNS server to add, add them now. 9. Click OK and close the dialog box. You will also need to remove any information that marks the Windows 2000 DNS server as a root server. Root servers do not forward queries.When a Windows 2000 DNS server is configured and it doesn’t detect other DNS servers on the network, then it automatically will designate itself as a root server.To remove this information: 1. From within the DNS management console, expand your DNS server by clicking on the plus sign (+) to its left. 2. Expand the Forward Lookup Zones by clicking the plus sign (+) to its left. 3. Locate the zone that is named with a dot (.) and delete it. (Click on it to select the zone and press the Delete key on your keyboard.) 4. Click OK to confirm. Now, you can create the zone for the subdomain.Then, configure that zone to support dynamic updates.When your first domain controller is installed into

www.syngress.com

Implementing a Domain • Chapter 9

the subdomain, it automatically will register itself in the zone and add all the applicable RRs.

Configuring DNS If the server does not have DNS installed or configured on it, it will not have Active Directory installed either, because Active Directory depends on locating a DNS server.To configure DNS before running the Active Directory Wizard: 1. Either select Start | Programs | Administrative Tools | DNS, or from the Windows 2000 Configure Your Server screen, select the Networking option in the left-hand pane.When it expands, select DNS, and click the Manage DNS option in the right-hand pane that appears. 2. Select the server on which you will be configuring DNS. 3. Click the Action menu. 4. Choose the Configure the Server option. 5. The Configure DNS Server Wizard appears with a Welcome screen. Click Next. 6. If this server will be a root server for DNS, select the first DNS server on the network as shown in Figure 9.1. If DNS is already installed and configured on the network, select the second option. Figure 9.1 DNS Root Server

www.syngress.com

281

282

Chapter 9 • Implementing a Domain

7. The Configure DNS Server Wizard will prompt you to create a Forward Lookup Zone. If Active Directory is installed, then you will be able to use the Active Directory-integrated option. However, if the server is a stand-alone or member server and you attempt to create a Forward Lookup Zone, you will see that the Active Directory Integrated option is grayed out, as shown in Figure 9.2. Not to worry, simply select the second option to create a Standard Primary for now, and click Next. Figure 9.2 Active Directory Integration Not Available as a StandAlone DNS Server

8. The Configure DNS Server Wizard will provide a Summary page. If you need to make changes, you can click Back. If not, click Finish to close the wizard screen.

About Zones The DNS namespace can be divided up into zones. Each zone stores information about a DNS domain and is the source of information for that domain. A zone can include information about subdomains, or a new zone can be created for the subdomain.When a subdomain is contained in a new zone, the parent domain’s zone must still contain a few records, called name server (NS) records, to be able to delegate information to that new zone. Zones can be fault tolerant by creating secondary servers for them. Any time a zone is replicated to a secondary server, that replication is considered a zone transfer. A forward lookup zone is the most common zone type.This type of zone represents a query by a client based on the DNS name of another computer that www.syngress.com

Implementing a Domain • Chapter 9

is stored as an address (A) RR.The DNS server will respond to a forward lookup with an IP address. A reverse lookup zone is used to find the DNS name of a computer with a certain IP address. It is the same as a forward lookup, but in reverse.The client will submit a query with an IP address and the DNS server will respond with the host name of that computer. Dynamic updates function in a similar fashion to DHCP addresses.The dynamic updates self-register DNS names on a DNS server without requiring an Administrator to set the DNS name and address.This is similar to DCHP, which applies updates to the workstation without requiring an Administrator to set the IP address. In both cases, from the user’s perspective, it is a transparent process. In fact, the two work quite well together.When a DNS server supports dynamic updates, clients can register and update their own A RRs with the server.With DHCP, for example, a client can receive an IP address and register it with the A RR on the DNS server. If the client does not renew the DHCP lease and is granted a new IP address the next time it accesses the network, it can update the A RR on the DNS server with its new IP address.This functionality is especially helpful for companies with active intranets published on users’ computers. Until dynamic updates are enabled on the network, dynamic addressing via DHCP would make parts of the intranet difficult, if not impossible, to access and manage because the DNS servers would need to be updated each time a new address was granted to a computer. Dynamic updates must be supported by the client as well as the server if the client is to be able to register its DNS name. Legacy Windows 9x and Windows NT 4 clients currently do not support this functionality.There is a DS Client that can be installed to overcome this problem, however.To manage the Windows NT 4 servers that may remain on the network, it is recommended to list their DNS names statically until they are retired, upgraded, or replaced by Windows 2000 Servers. Windows 2000 clients will attempt to register A RRs dynamically for their IP addresses.This process can be forced by entering the command ipconfig /registerdns from the client.The DHCP service will register the IP address dynamically on the Windows 2000 client. Scavenging is a new option within the Microsoft Windows 2000 DNS service. It enables the automatic management of RRs.What the scavenging system does is set a timestamp on all RRs.Then the DNS service attempts to refresh the record at a set interval called the no-refresh interval. If the RR cannot be refreshed, the DNS service will wait a second period of time, called the refresh interval, and if the record is not refreshed during that second interval, the DNS will scavenge the www.syngress.com

283

284

Chapter 9 • Implementing a Domain

record.These intervals can be set within the MS DNS Microsoft Management Console (MMC) for a server by selecting the server, clicking the Action menu, and selecting the Set Aging/Scavenging for all zones option. Or, a zone can have its own unique aging and scavenging properties.To do this, select the zone and then click the Action menu and select Properties. On the General tab, click Aging to see the screen similar to Figure 9.3. Figure 9.3 Zone Aging/Scavenging Properties Window

Service Resource Record Registration SRV RRs are not created the same as a standard A RR.To create an A RR, the Administrator would simply add a new computer to the zone by right-clicking on the zone and selecting New Host. But to create an SRV RR, the Administrator must select Other New Records.This prompts a dialog box that allows the Administrator to select from a list of RR types, as shown in Figure 9.4.The Service Location record is actually an SRV RR. After selecting the Service Location option, a dialog appears for selecting the SRV RR properties.

Installing Domains in Active Directory The first domain in the Active Directory forest is the root domain.This domain is special, not only because it automatically is given all the Flexible Single Master Operations (FSMO) roles until you move them at a later time, but also because it is the test bed for your installation routines. As you add more domains to the forest, you will become more proficient at the process.The first domain, though, is where you cut your teeth. www.syngress.com

Implementing a Domain • Chapter 9

Figure 9.4 SRV RR Creation

Active Directory Sizer Tool If your design did not incorporate server sizing, you should investigate your capacity requirements before installing. Summing up all the objects that you should have in each domain in the Global Catalog, and determining the resulting capacity requirements for your domain controllers is difficult. If you want to avoid the hard road, you can download the Active Directory Sizer Tool from www.microsoft.com/windows2000/techinfo/reskit/tools/new/adsizer-o.asp. The Adsizer.exe tool not only estimates the hardware you will need (CPU, bandwidth, and storage capacity) on a particular domain’s DCs, but it will even present recommendations for the number of DCs and Global Catalog servers for each domain in each site.This recommendation is based on the information that you input into the tool.You can profile your organization and change parameters to test different scenarios, if you need. Keep in mind that Adsizer does not know your business objectives, so if the tool’s recommendations are not what you expected, it could be due to the business requirements that you have designed into your Active Directory plans.

The First Domain Controller The first DC in Active Directory receives the honor of being the DC for the root domain of the first forest. In other words, the installation of Active Directory on the first DC is the same thing as the installation of the root domain. Performing the installation of the DC requires that you know something about it.Table 9.1 lists the types of information needed to install the first Windows 2000 DC. www.syngress.com

285

286

Chapter 9 • Implementing a Domain

Table 9.1 Information Required for Windows 2000 Installation Server Information

Example

Domain name Server DNS name Server NetBIOS name Partition and size File system System directory Name of license owner Organization of license owner Language Keyboard License mode (per seat or per server) Administrator’s password Time zone

Root.com Server.root.com Server C: and 2 GB NTFS \WINNT M.Y. Name My Org English U.S. Per seat Hx346xqmz3 Arizona GMT -7

Before you install DNS, you must have a static IP address assigned to the server. If you selected all the defaults during the server installation, then you will automatically be using a DHCP address on the server.You must change this to a static address: 1. Log on to the server as an Administrator or equivalent. 2. Open the Control Panel. 3. Open Network and Dial-up Connections. 4. Right-click the network connection where you want to assign the IP address, likely named Local Area Connection. 5. Click Properties in the pop-up menu. 6. Click Internet Protocol (TCP/IP). 7. Click Properties. 8. Type in the appropriate IP address, subnet mask, and gateway addresses where indicated. 9. Click the Advanced button. 10. Click the DNS tab.

www.syngress.com

Implementing a Domain • Chapter 9

11. Select Append primary and connection specific DNS suffixes. 12. Check the box for Append parent suffixes of the primary DNS suffix. 13. Check the box for Register this connection’s addresses in DNS. 14. Enter the DNS Server’s own IP address is in the Addresses for DNS servers area.You should remove all other IP addresses and make certain that the forwarder is configured for the server. 15. Click OK to close the dialog, then click OK to accept the changes to TCP/IP. 16. Click OK to close the connection properties dialog. When logging on to the Windows 2000 Server for the first time, you will see a new screen as shown in Figure 9.5.You will continue to see this same dialog thereafter, unless you’ve configured the screen to no longer appear.This wizard has been designed to provide a single interface to assist in configuring Windows 2000 Server. Figure 9.5 Configuring Windows 2000 Server for the First Time

This screen also prompts you to complete the Windows 2000 Server setup. When you click Finish Setup, a new screen appears that displays the Add/ Remove Programs utility from Control Panel, shown in Figure 9.6. In fact, the original screen remains available for you to return to. As you browse through its contents, you will realize that it is simply a single compilation of all the utilities www.syngress.com

287

288

Chapter 9 • Implementing a Domain

that are useful during the first installation of a new Windows 2000 Server. All of these items can be accessed through the Control Panel, the Administrative Tools, or through the command-line interface.This console utility was developed to simplify the Administrator’s tasks for configuring any new Windows 2000 Server. Figure 9.6 The Add/Remove Programs Panel

Configuring & Implementing… Automating Installation for Windows 2000 If you have multiple servers to install that have identical hardware configuration, you can create a setup file to automate the installation of each of them. Automated installation is a function that Windows 2000 inherited from Windows NT. An automated installation will reduce the deployment time for multiple machines, but it buys little time for just a few of them because of the setup file development time involved. One benefit that is worth the extra time is that all the servers deployed with the same setup file will have the identical configuration. In order to automate a Windows 2000 installation, you will need: ■

The WINNT.exe program

■

A network share that includes a copy of the files that are on the Windows 2000 CD-ROM

■

An answer file that you create Continued

www.syngress.com

Implementing a Domain • Chapter 9

To run the automated installation, you need to boot the server to a DOS prompt and run the command winnt /u:answer.txt /s:. The Windows 2000 source share is the network directory that contains the installation files, including Windows 2000 files from the CD-ROM, new device drivers, and any additional files that you want to copy. The structure of the Windows 2000 source files for an Intel server would be: \I386 Windows 2000 source directory \i386\$oem$ All OEM files \i386\$oem$\Textmode txtsetup.oem, scsi, and HAL files \i386\$oem$\$$ Maps to %systemroot% \i386\$oem$\$1 Maps to %systemdrive% \i386\$oem$\ Plug-and-play drivers \i386\$oem$\ Maps to a drive on the computer You can create an answer file using the Setup Manager tool. Setup Manager will also create the network share for the Windows 2000 source files. The answer file is a plain text file that can also be created and edited in any text editor, such as Notepad.

Active Directory Wizard Windows 2000 Server installs automatically as a standalone server, unless an upgrade has been performed on a legacy NT primary or backup domain controller (BDC).When an upgrade is performed, the Active Directory Wizard begins automatically.The Active Directory Wizard is available from the Configure Windows 2000 Server screen under Active Directory. The Active Directory database can be placed on an NTFS disk partition only. If the server’s file system is not NTFS, it will need to be converted to NTFS before Active Directory will install.To convert the file system quickly, the command CONVERT /FS:NTFS can be executed from the command prompt.The next time the server boots, it will convert the file system to NTFS. To execute the Active Directory Wizard, select Active Directory from the navigation bar in the Configure Windows 2000 screen, which will take you to the page displayed in Figure 9.7.This page will not only lead you to the Active www.syngress.com

289

290

Chapter 9 • Implementing a Domain

Directory Wizard, but also offers you links to more information about DCs, domains, and forests. If you prefer, you can click Start | Run and type Dcpromo in the dialog box, then click OK to execute the Active Directory Wizard directly. Figure 9.7 Active Directory Screen

The first screen of the wizard is a Welcome screen. Click Next to continue. The Domain Controller Type page appears asking you to select whether this will be the first DC in a new domain, or a DC in an existing domain. Since this is the first DC, select that option. After clicking Next, the Create Tree or Child Domain window appears, as shown in Figure 9.8.This allows you to select whether this is the first domain in a tree, or if it is a child domain. Since this is a DC for a root domain, select the Create a new domain tree option. The Create or Join Forest page appears, which will allow you to create a new forest, or to place this domain tree in an existing forest. For a forest root domain, create a new forest.The Active Directory Wizard displays its DNS component in the next screen. It will detect that DNS is not running on the current computer and will ask to configure the client or to install this server as a DNS server. At this point, if you want the installation to proceed smoothly, click the Start button and manually configure either the DNS client or the DNS server. If you are configuring the server, make certain to configure the zones to accept dynamic updates, or manually input the RRs.You will need to configure the DNS client to use the server’s own IP address if it is the DNS server.Then, when

www.syngress.com

Implementing a Domain • Chapter 9

you have completed these tasks, go back to the Active Directory Wizard and click the Back button.Then click Next again and hopefully you will not see this dialog screen again. If you do see the screen shown in Figure 9.9, the server has not discovered itself or been able to register itself in DNS.This may be due either to a misconfiguration, or there is a disconnection somewhere in the network. Figure 9.8 The Create Domain Tree or Child Domain Window

Figure 9.9 Active Directory Depends on DNS

The RRs that a DC will register are the following. In this example, we are assuming that the server is named DC1.corp.syngress.com, with an IP address of 10.10.204.5: Dc1.corp.syngress.com. A 10.10.204.5 _ldap._tcp.corp.syngress.com. SRV 0 0 389 dc1.corp.syngress.com

www.syngress.com

291

292

Chapter 9 • Implementing a Domain _kerberos._tcp.corp.syngress.com. SRV 0 0 88 dc1.corp.syngress.com _ldap._tcp.dc._msdcs.corp.syngress.com. SRV 0 0 389 dc1.corp.syngress.com _kerberos._tcp.dc. msdcs.corp.syngress.com. SRV 0 0 88 dc1.corp.syngress.com

Every DC will have similar RRs. If a query is executed against DNS looking for _ldap._tcp.dc._msdcs.corp.syngress.com, then the response will include all the names and IP address locations for each DC in the corp.syngress.com domain. If you look through your DNS console, you may notice that there are other records registered in the zone for a DC. Each DC runs the NetLogon service. That service will register SRV records in DNS based on the server’s capabilities. These SRV RRs are listed in Table 9.2, and are using DC1.corp.syngress.com as the name of the DC, SITE as the name of the site, and syngress.com as the Forest name because syngress.com is its root domain. GUID represents a Globally Unique Identifier (GUID) for a domain even though that GUID will be a lengthy series of letters and numbers separated by dashes. Table 9.2 SRV RRs Registered by NetLogon SRV RR

Which Servers Register This RR

Used for

_ldap._tcp.corp.syngress.com

All DCs and servers Finding an LDAP server _ldap._tcp.SITE._sites.corp.syngress All DCs Finding an LDAP .com server in a particular site _ldap._tcp.dc._msdcs.corp.syngress All DCs Finding a DC in a .com particular domain _ldap._tcp.SITE._sites.dc._msdcs.corp All DCs Finding a DC in a .syngress.com particular domain and site _ldap._tcp.pdc._msdcs.corp Finding the PDC or Only PDC or PDC .syngress.com PDC emulator emulator _ldap._tcp.gc._msdcs.syngress.com All Global Catalog Finding a Global Catalog server in servers the forest Continued

www.syngress.com

Implementing a Domain • Chapter 9

Table 9.2 Continued SRV RR

Which Servers Register This RR

Used for

_ldap._tcp.SITE._sites.gc._msdcs .syngress.com

All Global Catalog Finding a Global servers Catalog server for a particular site _gc._tcp.syngress.com An LDAP server Finding a Global serving a GC server Catalog server _gc._tcp.SITE._sites.syngress.com An LDAP server Finding a Global serving a GC server Catalog server in a particular site _ldap._tcp.GUID.domains._msdcs All DCs Finding a domain .syngress.com using a GUID—used only if the domain name has been changed _kerberos._tcp.corp.syngress.com Finding a Kerberos All servers with Key Distribution Kerberos Center (KDC) in the domain _kerberos._udp.corp.syngress.com Finding a KDC in All servers with the domain using Kerberos UDP _kerberos._tcp.SITE._sites.corp Finding a KDC in All servers with .syngress.com the domain and site Kerberos _kerberos._tcp.dc._msdcs.corp Finding a KDC in All DCs with .syngress.com the domain Kerberos _kerberos._tcp.SITE._sites.dc._msdcs All DCs with Finding a DC with .corp.syngress.com KDC in the domain Kerberos and site _kpasswd._tcp.corp.syngress.com Finding a KDC that All servers with changes passwords Kerberos on Kerberos in the domain _kpasswd._udp.corp.syngress.com Finding a KDC that All servers with changes passwords Kerberos on Kerberos in the domain using UDP

www.syngress.com

293

294

Chapter 9 • Implementing a Domain

Before going further with the Active Directory Wizard, a DNS server that is locatable on the network must have the new domain’s DNS name registered as a zone.That DNS server must be authoritative for the new domain as well.The new DC’s RRs must be in the zone already, or the zone must accept dynamic updates. The new domain being created will need a DNS name. Unlike Windows NT, this name is not a NetBIOS name such as MYDOMAIN, but a true DNS name such as mydomain.com.The wizard dialog that appears after prompting for the DNS configuration establishes the DNS name for the domain, as shown in Figure 9.10. Figure 9.10 Establishing the New DNS Domain Name

Even though the domain will have a DNS name, it will also have a NetBIOS name for compatibility with legacy domains.The following screen prompts for the NetBIOS name.This does not have the same format as the DNS name, nor does it have to have the same name. For example, if the domain’s DNS name is mydomain.com, the NetBIOS name could be something totally unrelated to the DNS name, such as CAPNKIRK. Even though this is a capability for backward compatibility, using a similar name for both the DNS and NetBIOS names will make the domain easier for users to use. For example, a DNS name will end with a .com (or .edu, or .gov, or .local, etc.), and a company named My Domain Inc. may use mydomain.com as the DNS name; then the name MYDOMAIN can be the NetBIOS name for the same domain.Type the NetBIOS name and click Next to access the following wizard screen.

www.syngress.com

Implementing a Domain • Chapter 9

You are next prompted to select the location for the Active Directory database and logging files. Make sure that the location has enough space for growth of the directory. For optimal performance and to be able to recover the server, these two files should not be in their default locations, but on separate partitions of separate physical disks.The default locations for these files are on the system partition within the WINNT directory, as shown in Figure 9.11. Figure 9.11 Default Locations for Active Directory Database and Log Files

The next wizard dialog lets you select a folder for the system volume.The system volume is a folder that is replicated to every DC. SYSVOL contains the directory service information that must be replicated. Because of the replication, the SYSVOL directory must be placed on an NTFS 5.0 partition. Information that must be replicated for the Active Directory includes the files necessary to enable logon.Traditionally, the NETLOGON share handles this. Logon still is handled by NETLOGON, but now that NETLOGON folder is a subdirectory of SYSVOL, which means that it will be replicated with the Active Directory system information and will enable logon.The folder properties showing the NETLOGON share location are depicted in Figure 9.12. Group policy templates and information are also replicated by being placed within SYSVOL since they are required by all DCs when applying group policy.The default folder is the WINNT\SYSVOL directory. Like the database and log files, it is optimal to make sure that this folder is on a partition that will have enough space for growth, which may not be the default folder in the system partition. After clicking Next, the Active Directory Wizard will ask whether this is a mixed domain that uses Windows NT 4 RAS (Remote Access Service) servers. The issue is related to security. In order to use Windows NT 4 RAS servers, www.syngress.com

295

296

Chapter 9 • Implementing a Domain

permissions must be less secure. Select the option that makes sense for your network, and click Next. Figure 9.12 NETLOGON Properties Screen

The following dialog will provide the Administrator password to be used when restoring the Directory Services.This is a different password than the server’s local Administrator account, which means that the password can be the same or may be different. Make sure that the password is available for use in case of a disaster. Click Next.

Configuring & Implementing… Active Directory Recovery Console Directory Service Restore mode is applicable only to Windows 2000 DCs for restoring the Active Directory service and SYSVOL directory. Restore mode is a command-line console that can be used to ■

Start or stop services

■

Format a hard drive

■

Copy or view files on the server’s NTFS drives Continued

www.syngress.com

Implementing a Domain • Chapter 9

■

Repair the system by copying a file from a floppy or other drive

■

Reconfigure a service that is preventing the system from starting

If the Recovery Console has been installed, it is available from the list of operating systems in the startup of the computer. If it has not been installed, you can run it from the Windows 2000 Setup program on the CD-ROM. This will function only if the server can boot from the CD-ROM. To install the Recovery Console as a startup option for Windows 2000: 1. Start Windows 2000 Server and log on as Administrator. 2. Click Start | Run and type CMD in the box to open a command prompt. 3. Make sure that the Windows 2000 Server CD is in the drive, or that the CD’s contents are available on a network share. 4. At the command prompt, change to the drive that contains the I386 directory. 5. From the I386 or ALPHA directory, type WINNT32 /CMDCONS. 6. The first dialog will allow you to bail out of the install by clicking No, or continue by clicking Yes. Click Yes to continue. 7. After files are copied, a final dialog screen appears stating that the console has been installed. Click OK to close the screen. 8. To run the Recovery Console, restart the server and select the Recovery Console option from the list of operating system options in the Boot menu. The wizard will display a summary page. Review this page to ensure that the options selected are the ones required for your installation. If the options are not correct, this is the last chance to click Back to change those options. If they are correct, click Next and… wait. The Active Directory Wizard will take a considerable amount of time to install Active Directory Services, and even longer if installing a DC that is not the first in the forest, and must replicate to an existing, populated Active Directory.

www.syngress.com

297

298

Chapter 9 • Implementing a Domain

Integrating DNS into Active Directory Today, the only way to integrate DNS with Active Directory is to implement the Microsoft Windows 2000 DNS service on a Windows 2000 Server that is also a DC. After the zone has been configured as an Active Directory integrated zone, the DC will store the DNS zone into the local Active Directory partition.The zone then can be automatically replicated through Active Directory replication to all other DCs that are simultaneously DNS servers.When DNS is integrated in Active Directory, there are some immediate benefits: ■

It can coexist with other DNS servers.

■

It automatically supports DHCP, and no DHCP-integration testing is required.

■

It will support Multi-Master replication of the DNS within Active Directory.

■

It will be able to scavenge stale records and keep the DNS database up to date.

If the Windows 2000 Server DNS service is implemented exclusively on the network, it will add the additional capability for using the Unicode extended character set. (Briefly, Unicode is a character set that is based on 16 bits of information. Compared to standard 7- or 8-bit ASCII or 8-bit EBCDIC, which have 128 or 256 characters, the Unicode character set can have up to 65,536 characters.This enables it to encompass most of the world’s languages in one set of characters.) Additionally, the Windows 2000 Server DNS supports all the requirements for Active Directory such as Service Resource Records (SRV RRs) and dynamic updates.

NOTE When there is an extensive number (more than 400 for root zones or 800 otherwise) of DCs in a domain, errors may be generated for registration of A and NS records in an Active Directory integrated zone. These errors are due to Active Directory’s limitation of 800 values that are associated with a single object. As an Active Directory integrated zone, DNS names are dnsNode objects in Active Directory, and DNS records are dnsRecord attributes for dnsNodes. You can apply Service Pack 2 or later to fix this issue.

www.syngress.com

Implementing a Domain • Chapter 9

Active Directory Integrated Zones As stated previously, an Active Directory integrated zone can be created only when the DNS server is also an Active Directory domain controller.The only requirement is that both DNS and Active Directory are installed on the same server. It does not matter if you install Active Directory after configuring DNS on a server or before—you can still create Active Directory Integrated zones.To create an Active Directory Integrated zone, perform the following steps: 1. Enter the DNS Management Console by clicking Start | Programs | Administrative Tools | DNS. Alternatively, you can access it from the Windows 2000 Configure Your Server screen, by selecting the Networking option in the left-hand pane and when it expands, select DNS, and click the Manage DNS option in the right-hand pane that appears. 2. Once in the DNS MMC, click the plus sign (+) next to the server to which you are adding the zone and expand it. 3. Select the Forward Lookup Zones folder below the server. 4. Click the Action menu, and click New Zone. 5. The New Zone Wizard will display a Welcome screen. Click Next. 6. The Zone Type screen will appear. Select the Active Directory-integrated option. (This will be grayed out if Active Directory is not installed.) Click Next. 7. Type the name of the zone, such as myzone.com or myzone.mydomain.com. Click Next. 8. The New Zone Wizard will display a Summary page. If the summary is correct, click Finish. If not, click Back and change the options. You can change a zone back from an Active Directory integrated zone to a Primary or Secondary zone. Once an Active Directory zone is created, a dnsNode object is created to represent the zone.The dnsRecord attributes are created for each DNS record added into the zone.These objects are then replicated following the standard site replication process.

www.syngress.com

299

300

Chapter 9 • Implementing a Domain

Managing Objects in Active Directory A Network Administrator will probably spend a lot of time managing objects in Active Directory. Each time a new person is hired, every time new Windows 2000 Professional PCs are installed, whenever someone is promoted, and whenever someone moves to a different office, a corresponding change must be made to objects in Active Directory.

Creating Organizational Units Once the domain is created, begin configuring it by adding organizational units (OUs).You only need to create the first DC before executing this step.The hierarchy within the domain consists of nested OUs. OUs are constructed in the Active Directory Users and Computers MMC. After creating your OU tree, each new DC automatically will replicate the OU hierarchy when it is installed. Creating OUs is a privileged task, so the user who will execute this should be logged on as an Administrator, or belong to a group with explicit permissions, or have been granted explicit permissions to do so.You can use the Delegation of Administration Wizard to grant a group or user account the rights required to create OUs.The following procedure is used to create OUs: 1. To invoke the Active Directory Users and Computers MMC, click Start | Programs | Administrative Tools | Active Directory Users and Computers. 2. Click the domain or OU in which you will be placing the new OU. 3. Click the Action menu. 4. Click New. 5. Select Organizational Unit, as depicted in Figure 9.13. Note that you can also right-click the parent object, select New from the pop-up menu, and select Organizational Unit from there to get the same result. 6. The New object dialog will appear. Make sure that the destination for the OU is correct by checking the Create in: statement at the top of the dialog.Type a name in the box for the OU and click OK. The OU will appear below its parent object in the left-hand pane of the window. As new OUs are created, the left-hand pane will develop a hierarchical structure as shown in Figure 9.14.This hierarchy is shown in the left-hand pane of the Active Directory Users and Computers MMC. As in most standard www.syngress.com

Implementing a Domain • Chapter 9

Microsoft consoles, you simply need to click the plus sign (+)to the left of any container to expand it, thus exposing the containers nested within it. If you click on the container to select it, its contents will appear in the right-hand pane of the console. Figure 9.13 Creating a New OU

Figure 9.14 Hierarchical OUs

Managing User Accounts If a person is hired at the company, the Administrator must create a user account in Active Directory. User accounts, as well as group accounts and computer accounts, provide the majority of the contents of the OUs an administrator constructs.To create a user account: www.syngress.com

301

302

Chapter 9 • Implementing a Domain

1. In the Active Directory Users and Computers console, right-click the OU, select New, and then select the User option. 2. The New Object-User dialog, as shown in Figure 9.15, will appear. Figure 9.15 New Object-User Dialog

3. Complete the user’s name and logon id boxes, then click Next. 4. Set the password, select the password options in the following dialog, and click Next. 5. Accept the confirmation dialog and the user account will be created and will appear in the OU that was selected originally. The New User Wizard will complete all the necessary information for the user account to be usable on the network. However, to enable the user to access resources and to store relevant information about that user, the New User Wizard is not enough.To make changes to the user’s information, right-click the user account object and select Properties from the pop-up menu.The User Account Properties dialog is displayed as in Figure 9.16. When a user moves to a different department, not only will user account information such as group membership need to be changed, but it is likely that the user account will need to be moved into a different OU.To move a user account from one OU to another, it is a simple matter of right-clicking the user account and selecting Move, then selecting the destination container from the resulting dialog.

www.syngress.com

Implementing a Domain • Chapter 9

Figure 9.16 User Properties

Managing Groups Creating a group in Active Directory is the same process as creating a user or an OU. Right-click on the OU that will contain the group, click New, and then click Group. In the New Object-Group dialog box shown in Figure 9.17, type the name of the group, select the Group Scope and the Group Type.The Group Scope establishes where the group can be seen and the types of objects that can be within it.These are listed in Table 9.3.The Group Type Security sets whether the group can be used for the assignment of permissions to other network resources, which is why it does not cross over into another domain tree. Distribution is a standard group type that is used for nonsecurity-related tasks. Distribution groups are used primarily by Exchange Server 2000 for sending e-mail to a group. In former versions of Exchange Server, this type of group was called a Distribution List. If you are not using Exchange Server 2000, or do not plan to integrate Active Directory with other directory services used for electronic messaging, then you will primarily use the Security Group Type.

www.syngress.com

303

304

Chapter 9 • Implementing a Domain

Figure 9.17 New Group

Table 9.3 Group Scope Group Scope

Group Type

Where Seen

Content Objects

Domain Local

Security Distribution

Domain

Global

Security Distribution Distribution

Domain Tree

Users Global groups Universal groups Users Global groups Users Global groups Universal groups

Universal

Forest

Configuring & Implementing… How Native Mode Affects Groups Although universal groups are restricted to distribution in the mixedmode domains, they are not so restricted in a native-mode domain. Universal groups can be security principals in a native-mode domain. The reason they are restricted in mixed mode is for backward compatibility to NT 4 BDCs, since they cannot be understood as security principals in the BDC’s copy of the SAM. Not only that, but in native mode, both a domain Local group and a Global group can be elevated to Universal group status through their Continued

www.syngress.com

Implementing a Domain • Chapter 9

properties. Once the configuration has changed, however, the group cannot be changed back—once Universal, always Universal. Best practices for groups are to avoid using Universal groups as much as possible. The main reason for this is that Universal groups are placed into the GC along with the entire listing of their contents. This is necessary in order to publish the group to the entire forest of domains, and the GC is the only database (or index) that connects the forest’s multiple domain contents.

There are two ways to add users to groups. One is from the Group’s Properties.The other is from the User Account Properties.To add a user to a group from the Group’s Properties, right-click the group and select Properties. Click the Members tab and then click Add. Use the dialog box to find the user to add to the group and then click Add. To add a user to a group from the User account properties, right-click the user and select Add to Group.This can be used for multiple users at a single time.

Nesting Groups Nested groups cannot be used in mixed domains; that is, those domains that include Windows NT 3.51 and Windows NT 4.0 DCs and member servers.They can run only in domains that are in native mode. A nested group is one that is a member of another group. By nesting groups, the child group automatically inherits the permissions of the parent group, plus it can have its own additional permissions. Nesting groups makes it easier to manage them, but only if they are carefully planned. To create a nested group, start with the parent group and follow these steps: 1. Right-click the parent group. 2. Select Properties from the pop-up menu. 3. Click the Members tab. 4. Click Add and navigate the hierarchy to the child group. 5. Select the group and click Add.The group should appear in the Members window.

www.syngress.com

305

306

Chapter 9 • Implementing a Domain

Managing Computers When a new computer is added to the network, it has a corresponding computer object in Active Directory.Windows 2000 PCs are capable of adding themselves to the Active Directory domain, as long as the installer has an Administrative password. In many cases, it is preferable not to give out the Administrative name and password for this purpose, but simply to create the computer account prior to its installation.To create the computer account: 1. Right-click on the destination container, and select New. 2. Select Computer from the pop-up menu.The first screen that appears is shown in Figure 9.18. Figure 9.18 New Object-Computer Dialog

3. Complete the computer name. 4. If the computer is a Windows 3.x,Windows 95/98,Windows NT 3.5x, or Windows NT 4.0 system, check the box to Allow pre-Windows 2000 computers to use this account. 5. Click Next. 6. The second screen allows the Administrator to mark this computer as a managed PC and to set a GUID (Globally Unique Identifier) for it. If it will be managed, complete this information. If not, do not check the box stating that this is a managed PC. 7. Click Next to see the summary page. 8. Click Finish to add the computer to the network. www.syngress.com

Implementing a Domain • Chapter 9

If the computer is designated as a managed PC, the Administrator can invoke the Computer Management MMC from the Active Directory Users and Computers console.To do this, the Administrator simply needs to right-click on the computer object and select Manage from the pop-up menu, as shown in Figure 9.19.This action will invoke the console shown in Figure 9.20. Figure 9.19 Invoking Computer Management

Figure 9.20 Computer Management MMC Console

www.syngress.com

307

308

Chapter 9 • Implementing a Domain

Common Object Management With ever-changing network environments, objects will move around Active Directory—following their real counterparts around the network. Objects will be renamed and deleted, too. No amount of planning will prevent changes affecting the network on a daily basis. Moving an object is as simple as right-clicking it and selecting Move from the popup menu.This will produce the Move dialog with the Active Directory hierarchy available to be navigated to the destination container. Renaming an object is just as simple. Right-click the object and select Rename.This does not produce a dialog box, but lets the Administrator type the new name of the object directly into the window. There are two ways of deleting an object.You can click on the object in the right-pane window and then press Delete on the keyboard, or you can rightclick on the object and select Delete. Both of these actions will result in a Delete Confirmation box. All of these processes occur within a single domain in a single forest. If you have object management tasks that extend beyond the domain or forest confines, you may need to use a third-party utility to do so. Active Directory Migration Tool (ADMT) can be used to manage objects at this level.

Role-Based Administration Administrative roles are useful for enterprises that have a distributed network management structure with different levels of access required for the Administrators. For example, distributed network management is used by a business that establishes a single group to have access to full administrative rights to a domain, a second group to have the administrative rights to add, delete, and change user accounts, and a third group to reset passwords. Distributed network management is implemented in Active Directory through created roles for Administrators, or role-based administration.

Microsoft Management Console Up to this point, you have used several utilities that use the Microsoft Management Console shell—such as DNS Management, Computer Management, and Active Directory Users and Computers. Microsoft created the Microsoft Management Console (MMC) to be a better tool with which to administer Windows 2000 Servers. It was developed to simplify administration www.syngress.com

Implementing a Domain • Chapter 9

through the use of a consistent interface. Microsoft is expected to continue the development of MMC and extend its capabilities to be usable by third-party software tools. The interesting thing about the MMC is that it is not the management application itself. Instead, the MMC provides User Interface (UI) for the administrative application.The snap-in is the administrative tool.The snap-in will also create menu items, pop-up menus, and drag-and-drop actions that are specific to that administrative tool. Extensions provide even further capabilities to a snap-in. Windows 2000 Server provides a set of preconfigured MMC consoles. More are added when Windows 2000 Server additional components are installed. MMC consoles appear under the Administrative Tools menu when you click Start | Programs | Administrative Tools. MMC can run in two modes: ■

User mode

■

Author mode

User mode limits the functionality of the MMC so that its configuration cannot be saved. It also prevents the user from adding or removing snap-ins. Author mode lets the user do everything including adding and removing snapins, creating a new window, viewing all portions of the console tree and saving the console’s configuration. An administrator can create a custom MMC to incorporate all the utilities needed for specific tasks.Then, the administrator can save that MMC in User mode and distribute it to the group of people who will use the MMC in the future. User mode will prevent that group of people from changing the utilities included in the custom console. For example, an organization may extend the ability to change passwords to their Help Desk. Perhaps they want to allow this ability for all users in two of their three domains, but do not want to allow them even to browse the third domain.The network administrator can create a custom MMC that exposes the two domains’ Active Directory Users and Computers snap-ins and then save that custom console in User mode. After distributing the console to the Help Desk, they can use the console to change passwords without anyone changing the console’s configuration.

Administrative Roles In order to economize, most large enterprises create a tiered structure for administration. A three-tiered structure might resemble Table 9.4. www.syngress.com

309

310

Chapter 9 • Implementing a Domain

Table 9.4 Tiered Support Structure Tier Level

Support Experience

First tier Second tier

Minimal Mid-level

Third tier

Example

Help Desk: Reset passwords Desk-side support: Adds, deletes, changes user accounts and computer accounts, install member servers Highly Network Design and Engineering: Manages the experienced site topology, hierarchical structure, and advanced troubleshooting

Obviously, an enterprise would not want their first tier to have the ability to change the way the MMC worked. It is probable that they would not want the second tier to have this ability either.Therefore, they should ensure that those administrative roles are restricted to user mode for the MMC.The way that this is done is through applying a group policy. For those organizations that wish to restrict some MMC consoles to user mode and allow others to be in author mode, it can be done. Individual snap-ins can be restricted via group policy.

www.syngress.com

Implementing a Domain • Chapter 9

Summary When the first domain controller (DC) is installed on a network, so also is the first domain in the first forest of Active Directory.The DC is the source of Active Directory management. Installing a DC is a two-step process: 1. Installing Windows 2000 Server. 2. Installing the Active Directory service. The process of installing Windows 2000 Server will create a member server. The Windows 2000 Server is functional as a member server with a local database of user accounts and groups that can access and use it. However, to use the Active Directory functionality, the member server must join an Active Directory domain or become a DC for an Active Directory domain. To install the Active Directory service, the installer can invoke the Active Directory Wizard from the Configure Your Server screen that starts when the server starts.The Active Directory Wizard guides the installer through the options for installing Active Directory.The information required for installing the Active Directory Service includes the DNS information for the computer and its domain. DNS is required by Active Directory. DCs must be configured as DNS clients, or they must provide the DNS service itself. Configuring DNS as a service is a simple matter of starting the DNS administrative tool, selecting the local computer, and selecting Configure this server from the Action menu. If Active Directory is not installed on the local computer, however, the DNS service cannot create Active Directory-integrated zones. If the Windows 2000 Server is a DC, and is running the DNS service, it can create Active Directory-integrated zones and bring the following benefits to the network: ■

It can coexist with other DNS Servers.

■

It automatically supports DHCP, and no DHCP-integration testing is required.

■

It will support Multi-Master replication of the DNS within Active Directory.

■

It will be able to scavenge stale records and keep the DNS database up to date.

The DNS console application is started by clicking Start | Programs | Administrative Tools | DNS.The first task is to create a DNS zone.The

www.syngress.com

311

312

Chapter 9 • Implementing a Domain

second task is to create the resource records (RRs), both address records (A RRs) and service location records (SRV RRs). The majority of the Active Directory management will occur in Active Directory Users and Computers console. In this console, the organizational units (OUs) can be created in a hierarchical structure. New users, computers, and groups can be created within the OUs and then moved, renamed, and deleted as needed. Most actions can be executed by right-clicking the object and selecting the appropriate action item, or by manipulating the object’s properties.

Solution Fast Track Installing DNS  If you have existing DNS on your network, you must verify its compati-

bility if you intend to use it.  You can install Windows 2000 DNS as part of the Windows 2000 Server

installation, or you can add the DNS service later through the Control Panel Add/Remove Programs icon.  One design for DNS may involve delegating a subdomain to a Windows

2000 DNS server.You must configure forwarders and may need to remove root server information.

Installing Domains in Active Directory  DNS must be installed and configured before installing Active Directory

on a DC.  You may download the Adsizer tool to establish the DC’s capacity

requirements pertaining to storage, bandwidth, and CPU.  The Active Directory Wizard, or Dcpromo, is used to install domain

controllers.

Integrating DNS into Active Directory  You must have DNS running on a DC in order to integrate DNS in

Active Directory.

www.syngress.com

Implementing a Domain • Chapter 9

 After an Active Directory integrated zone is created, dnsNode objects

are added to the domain database representing the zone. dnsRecord attributes are added to the dnsNode object for each resource record in the zone.  You can change a zone to an Active Directory integrated zone, or

change it back to a Primary or Secondary zone as needed.

Managing Objects in Active Directory  You can create OUs to construct your OU hierarchy as soon as the first

DC is installed into a domain. As each new DC is installed, it automatically will receive the OU hierarchy you created.  User, group and computer objects can be migrated or added to the

domain to populate the OU structure.  You can move objects around the hierarchy as needed, using the Active

Directory Users and Computers MMC.

Role-Based Administration  The Microsoft Management Console is a standard shell with snap-ins

that creates a consistent interface to managing the network.  You can add different snap-ins to create a custom console to the MMC,

then save it in User Mode to prevent the console from being changed.  You can delegate administrative responsibilities according to the roles

that people hold in the network using the Delegation of Administration Wizard.

www.syngress.com

313

314

Chapter 9 • Implementing a Domain

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: Will running the Active Directory Sizer tool take the place of using a design team or network designer to decide how many DCs and domains to use?

A: Not really.The Active Directory Sizer tool will make recommendations for design configuration, but you need to balance those recommendations against your business objectives to see if they will meet your needs.You may want to use the Active Directory Sizer tool as a checkpoint or to test scenarios, to see if there are any design points that were not considered.

Q: We use a DNS server that supports SRV RRs, but does not support Dynamic Updates.Will delegating a subdomain and using Windows 2000 DNS bypass the need to register each DC’s RRs?

A: Yes. If you delegate a subdomain to a Windows 2000 DNS server, and you implement DDNS on the new subdomain’s zone, then you will not need to register RRs for each DC.

Q: We have multiple DNS servers on UNIX machines in our network.We want to use the Multi-Master replication of Active Directory-integrated DNS. Can we keep the existing servers?

A: No.They will need to be migrated to Windows 2000 DNS. In order to have Active Directory-integrated DNS, DNS must be running on Active Directory servers.This, in turn, requires that Microsoft’s Windows 2000 DNS service must be running.

Q: Our plan is to create a nested set of groups.We want to keep some Windows NT 4.0 domain controllers (DCs) for the first six months after installing the Windows 2000 Servers with Active Directory.Will we be able to use the nested groups right away?

www.syngress.com

Implementing a Domain • Chapter 9

A: No. Active Directory must be running in native mode, as opposed to mixed mode, in order for nested groups to work.That means that the Windows NT 4.0 DCs will need to be migrated before using nested groups.

Q: How do you switch a domain from mixed mode to native mode? A: Click Start | Programs | Administrative Tools | Active Directory Domains and Trusts. Right-click on the domain and select Properties. The General tab should be the first screen shown. Click Change Mode on the General tab page. Click Yes to confirm. Either click Apply or OK to change the mode.This exercise must be repeated on each DC in the Active Directory domain and is irreversible once changed.

www.syngress.com

315

Chapter 10

Building Trees and Forests

Solutions in this chapter: ■

Understanding the Characteristics of an Active Directory Forest

■

Implementing the Forest Structure

■

Right-Sizing the Active Directory Storage Space

■

Managing the Forest

 Summary  Solutions Fast Track  Frequently Asked Questions

317

318

Chapter 10 • Building Trees and Forests

Introduction When you have installed at least one domain, then your forest is established. Installing a single domain is the first part of Active Directory implementation.The next step is to add more domains to the forest and ensure that each domain tree is installed in the correct order.The Domain Name System (DNS) namespace is the core of Active Directory and care must be taken in its implementation. Each time a new domain controller (DC) is installed, it must be installed into a domain—either a new domain in the forest or an existing domain. If it is installed into a new domain, the new domain must be in an existing tree in an existing forest, must form a new tree in an existing forest, or must form a new tree in a new forest.There are a lot of options for domain configurations.These should all be decided before you begin installing the server.Your design should designate which domains will be placed in the forest, where they fit in a domain tree, and how many DCs will be placed in the domain. The forest is the largest holder of a schema, configuration, and Global Catalog. It is the ultimate division for an enterprise. If you need two schemas, you must have two forests.The same goes for Global Catalogs. Building a forest can be as simple as installing a single domain with a single DNS namespace, or it can be as complex as installing multiple domain trees with multiple child domains and namespaces among them. A forest is a collection of domain trees that do not have to form a contiguous DNS namespace. For example, one tree may have the root.com namespace and another tree may have the corp.com namespace. Each tree can consist of multiple domains, but they must all share the same namespace.The domains that appear in the root.com tree may be root.com, trunk.root.com, branch.root.com, bark.root.com, and leaf.branch.root.com.This is depicted in Figure 10.1. The forest is created with the installation of the root domain’s first DC.When installing a new Windows 2000 Server as a DC, the Windows 2000 operating system is installed first, and then you must install Active Directory by running the Active Directory Wizard.The Active Directory Wizard is the application used for promoting the server to a DC. It prompts the installer for information about: ■

Which forest to join or whether to create a new forest

■

Whether to join an existing domain or create a new domain

■

Whether a new domain will be in an existing domain tree or the root of a new domain tree

www.syngress.com

Building Trees and Forests • Chapter 10

The command line for the Active Directory Wizard is Dcpromo.exe.You can also access the Active Directory Wizard from the Configure Your Server dialog screen that appears when you first log on to a Windows 2000 Server. Figure 10.1 Active Directory Forest Kerberos Transitive Trust

root.com

branch.root.com

corp.com

bark.root.com

trunk.root.com

leaf.branch.root.com

Understanding the Characteristics of an Active Directory Forest The forest is a collection of domain trees with multiple namespaces that share a common schema, configuration, and Global Catalog.Technically, a forest can exist as a single domain with a single namespace. In essence, the Active Directory forest lets an organization use domain names that are not part of the same DNS namespace to work seamlessly together. For example, a forest could contain a domain tree with the root.com namespace and another domain tree with the tree.com namespace.There can be as many namespaces as needed in a forest.

www.syngress.com

319

320

Chapter 10 • Building Trees and Forests

Common Schema Each forest shares a common schema.The schema is the list of all the object types, called object classes, which can exist in Active Directory.The schema defines the type of objects through an object class, and further defines the type of attributes that each object class can have. Since it is possible to extend the schema by adding object classes or attributes to existing object classes, the schema is not necessarily going to be identical between two different forests. However, within the forest, the schema is replicated throughout the forest, and all object classes and attributes will be available at any point in the forest. The Active Directory Services Interface (ADSI) is an Application Program Interface (API) used for integrating other programs with Active Directory. Programmers can use ADSI to read information about classes and attributes from the schema, as well as set that information. All of the Active Directory schema information is stored within the schema partition. It contains objects named classSchema and attributeSchema.These objects are the definition of classes and attributes.The partition is replicated to every DC in the forest to ensure that all domain partitions can contain the same types of objects and attributes.

Common Configuration The configuration for a forest is a naming context container object of which every DC in the forest contains a copy. Information that must be applied to the entire forest is stored in the configuration container object.The configuration container is used to generate the replication topology because it contains data about the underlying network infrastructure.

Global Catalog Each forest has a single Global Catalog that contains information about each object within it.The Global Catalog is basically an index of the Active Directory database. It has a partial replica of all forest-contained objects.The Global Catalog has a larger scope than that of the domain since it will cover the entire forest. A Global Catalog server processes all UPN (user principal name) logons for a single forest. When users query Active Directory, or simply log on, they may not be aware of which domain the results of their query or even their own logon ID belongs.

www.syngress.com

Building Trees and Forests • Chapter 10

The Global Catalog provides the means for consolidating enough information about objects to respond to queries and UPN logons.The Global Catalog is a partition of its own. It contains copies of parts of the information within the domains that make up the forest.This enables it to act as a guide to Active Directory, and to find information anywhere it may exist. Global Catalog servers are DCs that have been given the role of a Global Catalog server.They contain the replica for their own domain partition, in addition to the Global Catalog partition. Some DCs are also Global Catalog servers for the forest.The first DC installed into a forest will become the forest’s first Global Catalog server. All other DCs must be designated specifically as Global Catalog servers. When a DC processes the logon request and needs to find Universal group memberships, it queries a Global Catalog DC. If a Global Catalog server is not available when a domain controller tries its query, the logon is rejected completely to guard against security blunders. For example, if a user GARY has group membership in the Universal group, NONPAYROLL, which denies access to a resource share for SALARY.xls, and the Global Catalog server cannot be contacted, GARY potentially would have access to SALARY.xls if he is allowed to log on. Instead, the DC will reject GARY’s logon request until a Global Catalog server can be reached. The impact of this tactic is at the design level.The most logical place to put Global Catalog servers is one in each site. Because sites are groups of well-connected IP subnets, and because well connected implies LAN connections, it follows that there would be fewer network failures within a site than between sites that are implied to be WAN connections. If a site does span a WAN connection, even if it is a high-bandwidth link, the network designer may want to place a Global Catalog server on each side of that link. Global Catalog DCs generate more replication traffic than regular DCs because they are replicating the Global Catalog as well as the contents of the Active Directory domain.The Global Catalog contains a read-only, partial copy of the Active Directory database for every other domain in the forest. DCs already have a read-write, complete copy of their own domain’s Active Directory database. Keep in mind the following Global Catalog rules: ■

The Global Catalog includes only a single forest’s set of objects for users to browse. If users need to access objects in another forest, they must know which domain in that other forest to query.

www.syngress.com

321

322

Chapter 10 • Building Trees and Forests ■

Query traffic is generated to Global Catalog servers, when users browse the entire network or use search commands to find network resources.

■

The settings in the schema will determine whether an attribute is available within the Global Catalog. If it is not, users will not be able to see it.

Contiguous Namespace Domain trees are a set of domains that have a contiguous namespace.The forest can have multiple domain trees. A contiguous namespace is a set of DNS names that have the same root namespace. As shown in Figure 10.2, the contiguous namespace is hierarchical. A forest can have multiple domain trees, but contains only a single root domain.The first domain installed into a forest, regardless of the number of different namespaces, will always be the root of the forest. Each domain tree will have a root DNS namespace, but that does not designate that domain as a root of the forest. Figure 10.2 Hierarchical Namespace

root.com

trunk.root.com

branch.root.com

leaf.trunk.root.com

twig.branch.root.com

www.syngress.com

bud.branch.root.com

Building Trees and Forests • Chapter 10

Trust Relationships Legacy Windows NT domains enabled access to each other’s users via trust relationships.These trust relationships were explicitly set between domains. Not only that, but trusts were one-way.That is, domain A trusted domain B in a single trust, but domain B did not trust domain A unless a second trust was established. Not only were trusts one-way, but they were nontransitive.That is, when domain A trusted domain B, and domain B trusted domain C, then domain A did not automatically trust domain C.This system had limitations that Active Directory fixed.

Transitive Bidirectional Trust Active Directory trust relationships are different from the legacy NT domain trusts. First of all, within a forest, the trust relationships are created automatically. They are bidirectional and transitive. If a forest contains domain A, domain B, and domain C, then domain A trusts both domain B and domain C, and they both trust domain A and each other, as illustrated in Figure 10.3. Each domain contained in a single Active Directory forest trusts all other domains through these bidirectional, transitive trust relationships.This provides the means for users and groups to be recognized by other domains in the forest, so that rights to objects can be granted to them. The Active Directory forest contains multiple domain trees that are connected via a transitive, bidirectional Kerberos trust relationship. Child domains always have Kerberos transitive trusts between themselves and their parent domain. A forest always contains entire domain trees.The domain tree cannot be split between multiple forests. Figure 10.3 Transitive Trusts in Active Directory Forests

siti

w ve T

Tran

Domain B

ust y Tr a W o-

Domain A

Tran s

Implicit trust because of the transitive trusts already established

itive

Two -

Way Trus t

Domain C

www.syngress.com

323

324

Chapter 10 • Building Trees and Forests

Kerberos version 5 is the protocol used for authentication and trust relationships in Active Directory. Kerberos uses a mutual authentication method, so that the identities of both domains in a trust relationship are verified. Kerberos can be used to create a trust relationship with a UNIX-based Kerberos realm, but the resulting trust relationship is neither transitive nor bidirectional. In fact, all trusts that are with any entity external to the Active Directory forest (such as with a legacy Windows NT domain, a Kerberos realm, or a Windows 2000 domain in a different forest) are nontransitive and unidirectional. When migrating from a legacy NT domain to an Active Directory domain structure, there will be changes in the way that the domains trust each other. Before migrating NT domains to Active Directory, the Network Administrator should review the existing trust relationships and make sure to note any trust relationships that should not exist after migration. By default, domains that are migrated to the Active Directory forest will connect to each other through transitive trusts. Any domains that are not moved into the new forest will require explicit, nontransitive trust relationships to be created between themselves and any new domains within the forest. However, any upgraded domains will retain their existing trust relationships as nontransitive one-way trusts. Because of the way that trust relationships work during migration, a legacy NT domain structure that uses a Master domain model or Multi-Master domain model will require that the Master domains are migrated to Windows 2000 first as root domains, or the root of a new domain tree. Resource domains should be migrated to Windows 2000 after all Master domains have completely been migrated. Resource domains are best migrated as child domains of already migrated Master domains.You can approach Multi-Master domain models in two ways, since the new forest will have only one root domain: ■

You can consolidate the domains before upgrading using a migration tool such as Active Directory Migration Tool (ADMT).

■

You can upgrade the root domain and then migrate the contents of the other master domains to the new Windows 2000 root domain using ADMT.

Trusts That Cross Forests Within a forest, there is no need for establishing trusts because of the Kerberos transitive two-way trusts. However, sometimes users in one forest need to access resources in another. Or during migration, users may need to access resources in www.syngress.com

Building Trees and Forests • Chapter 10

a legacy NT domain. For example, the XYC Corporation has two forests that were created for the sole purpose of separating the global catalogs, schemas, and configurations. One forest is dedicated to a lab environment and the second forest is dedicated to the production network.When Administrators are working in the lab environment, they still need to access their corporate e-mail and manage the production forest domain.They will be able to perform their job functions if they are able to establish a domain trust relationship.

Trust Utilities There are two tools that are useful for handling trust relationships in Windows 2000: ■

NETDOM

■

Active Directory Domains and Trusts Management Console

NETDOM is a command-line tool found in the Windows 2000 Resource Kit that can list existing domain trust relationships, establish new trust relationships, and manage machine accounts in a domain. Establishing a trust relationship with NETDOM can be executed with the following command: NETDOM /DOMAIN:RESOURCE MASTER MASTERDOMAIN PASSWORD /TRUST

This command will establish a one-way trust in which the domain named RESOURCE trusts the domain named MASTERDOMAIN. It can be used across forests, or between legacy NT domains and Windows 2000 domains. If you want to find out more about the options available with NETDOM, just type NETDOM /? on the command line.This will display Help for NETDOM switches.

Configuring & Implementing… NETDOM Command-line programs such as NETDOM are confusing at first because they do not usually have easily understood help options. However, these programs are a blessing when you need to automate procedures to happen after hours or without user input. If you do need to get help for NETDOM, just type NETDOM HELP at the command line. Continued

www.syngress.com

325

326

Chapter 10 • Building Trees and Forests

There are five major commands: NETDOM BDC, NETDOM MASTER, NETDOM MEMBER, NETDOM QUERY, and NETDOM RESOURCE. Each of these commands has a group of options that affect how they work. In general, the options are: ■

/Domain:domainname The command is executed on the PDC or DC of the domain listed.

■

/User:domain\user The command uses this user account.

■

/Password:password The command uses this password for the user account.

■

/noverbose The command does not display much text on the screen.

The syntax of the commands is as follows: ■

NETDOM [/options] BDC [\\BDC] [/Command]

■

NETDOM [/options] MASTER [masterdomain] [password] [/command]

■

NETDOM [/options] MEMBER [\\member] [ /command]

■

NETDOM [/options] RESOURCE [resourcedomain] [password] [/command]

NETDOM QUERY is unique—it has a single option, /noverbose, and all you need to type at the command prompt is NETDOM QUERY \\computername, where computername is the name of the DC for which you want to list trust relationships. Notice that at the end of each of the NETDOM commands other than NETDOM QUERY ends in /command. The available commands for this are as follows: ■

/Add Adds a machine account.

■

/Delete Deletes the machine account.

■

/Query Finds out domain information.

■

/Fullsync Starts a full synchronization of the domain.

■

/Partialsync Starts a synchronization with the PDC.

■

/Trust Available only with the NETDOM RESOURCE and NETDOM MASTER commands. This command establishes the trust relationship for the domains.

■

/joindomain Available only with the NETDOM MEMBER command. It joins the member to a domain. Continued

www.syngress.com

Building Trees and Forests • Chapter 10

■

/joinworkgroup Available only with the NETDOM MEMBER command. It joins the member to a workgroup.

One of the ways to use the NETDOM command is when migrating servers to Windows 2000. For example, GRAY Corp. decides to restructure domains when deploying Windows 2000. Each new Active Directory domain is a new domain name deployed on new servers. The old servers in the legacy domains are to remain on the network until each legacy domain has been completely migrated to a new Active Directory domain. The Network Administrator needs to join each of 5000 Windows NT 4.0 Workstations and Windows 2000 Professional computers to the new Active Directory domains. The Network Administrator decides to create a login script for each group of migrated clients rather than go to each desktop and run through the domain joining process, and rather than giving an administrative password to users and walking them through the process. The Network Administrator edits the login script in the old domain to add the line: NETDOM /Domain:newdomain /User:newdomain\admin / Password:password /Noverbose MEMBER /JOINDOMAIN. This line will join the computer for which the login script is executing, to the domain named NEWDOMAIN. It will use the Admin account in the NEWDOMAIN, but will not display any text on the screen due to the /Noverbose command. Even so, using the Admin account and password in a script is not recommended because security can be breached simply by a user viewing the login script if it is in a noncompiled format. Once the computer has joined the new domain, it will have a new login script and it will not attempt to join the domain again.

The Active Directory Domains and Trusts management console is the main utility that Network Administrators will use to manage trust relationships and, oddly enough, the UPN suffix for the forest.The default UPN suffix is that of the forest’s root domain’s DNS name.This is where they would establish a trust between two domains in two separate forests.The steps to take in establishing the trust relationship are as follows: 1. Click Start | Programs | Administrative Tools | Active Directory Domains and Trusts.You will see the console shown in Figure 10.4. 2. Right-click the domain to which a trust will be added. www.syngress.com

327

328

Chapter 10 • Building Trees and Forests

Figure 10.4 Active Directory Domains and Trusts Management Console

3. Select the Properties option from the pop-up menu. 4. Click the Trusts tab.The resulting screen will resemble Figure 10.5. Figure 10.5 Establishing Trusts for Domains

5. If the domain that you are editing is the resource domain, click Add under Domains trusted by this domain. If this domain will be the Master, click Add under Domains that trust this domain. www.syngress.com

Building Trees and Forests • Chapter 10

6. Select the appropriate domain and click OK. 7. Repeat this action on the other domain to establish the trust. Both sides of the trust must be established or the trust is invalid.

Implementing the Forest Structure Before you implement your first domain, or any domain thereafter, you should already have a forest plan in order.There are some general design principals to keep in mind when planning forests: ■

Incorporate areas in the forest plan that will enable growth of the organization.

■

Design as simple a structure as possible to reduce administrative overhead.

■

Understand the incremental bandwidth overhead that is incurred when implementing multiple forests.

■

Keep all domains that are allowed to trust each other within a forest.

■

Refer to the existing network configuration and documentation to support decisions about the forest structure.

The primary purpose of the forest plan is to determine how many forests are required for the network. Since each forest can contain multiple domains, a single forest structure is typically sufficient for any enterprise network.The situations in which multiple forests should be created are those in which there must be separate schemas or GCs, or in which there should be absolute division in administrative authority. For example, in a corporation that implements Windows 2000 and Active Directory to support the Internet and also implements it for the internal, private enterprise network, it may be necessary to separate the private forest from the Internet forest so that the private Global Catalog is not available publicly. Another example is when a company implements a lab network in which various technical scenarios are tested before being implemented on the production network. If changes to the schema need to be tested before being deployed, they must be tested on a separate forest or else the changes will be made enterprise-wide automatically through the Multi-Master replication of Windows 2000.The advantage to having a separate lab network is that most labs are confined to a single geographical area, and many do not share the same cabling and infrastructure that is used on a production network.When a lab is constructed this way, a separate www.syngress.com

329

330

Chapter 10 • Building Trees and Forests

forest for a lab will not impact traffic on the network to any great degree. A final reason that an organization may decide to have multiple forests is when there is a clear separation of administrative authority. In this case, a company may have two clearly separate business units that use completely separate administrative groups and change management methods. Although administration is best delegated through OUs or even through separate domains, it may become necessary to have separate forests for each of the administrative units. When multiple forests do exist to separate schemas or GCs, there is an impact to administration. Either a trust relationship must exist between the forests and Administrators granted administrative authority in both forests, or separate Administrator accounts must be created for each Administrator who must manage both forests. Administrators must also become aware of the impact they may have on the network within any particular forest.This means that they must work well with each other and make each other aware of large changes planned for Active Directory.When there are multiple forests, they must be able to identify which forest will be changed. For instance, rapidly performing moves, adds, and changes on objects within the forest creates a large amount of replication of the Global Catalog (which contains a partial copy of every forest object) among DCs forestwide.This can prevent users from logging on to the network, or from being able to access network resources. Additionally, every change to the schema or to the configuration container, and additions or removals of entire domains, has a forestwide consequence. Multiple forests impact how users work, too. If users remain within a single forest, they can browse or query the Global Catalog to find resources.The Global Catalog makes the forest structure transparent to users.When a user must access a network resource that exists in a different forest, that resource will not be found in the Global Catalog since it is not shared. In this case, the user must know about the other domain where the resource exists. Not only that, but there must be a trust between the domain where the resource exists and the domain where the user exists.This type of a trust is an explicit, one-way, nontransitive trust. Basically, it is the same type of trust relationship upon which legacy Windows NT domains relied. Because it is a one-way trust, the direction of the trust matters.The rule of thumb is that a domain that contains a resource must trust the domain that contains the user account, as illustrated in Figure 10.6. Multiple forests will affect how users log on as well. A UPN using the format [email protected] can be applied to a single forest only. If there are multiple forests, one will use the UPN of [email protected], and the other will use www.syngress.com

Building Trees and Forests • Chapter 10

the UPN of [email protected]. UPNs are stored in the Global Catalog and must be unique within the enterprise network. Figure 10.6 Multiple Forests with Interdomain Trust Relationships

One-Way Nontransitive Trust

Network Resource

root.com tree.com users.com leaf.tree.com

branch.root.com User Account

Forests do not share information well outside of themselves. Administrators will have additional work with moves, adds, and changes to objects when there are multiple forests. A user account or other Active Directory object cannot be moved between forests. Instead the objects must be cloned using a utility such as ClonePrincipal, or migrated with a utility such as LDIFDE.exe, or manually created. Regardless of which method is used, a copy of the object remains in the original domain until it is deleted manually. Domains cannot be moved between forests, and forests cannot be merged or split. A DNS namespace cannot be split between two forests, either. Finally, using multiple forests means that data cannot use the same replication topology. If multiple forests are used, data must be replicated manually and updated between them, which increases the administrative overhead for that network.

The Domain Tree Structure The domain tree is a set of domains that are arranged in a hierarchical structure due to their DNS names.The forest can have multiple domain trees. Each domain in a domain tree is separate from the parent and child domains. A domain tree makes use of a single DNS namespace, enabling multiple domains to exist within it.This reduces the need for registering several DNS namespaces. For www.syngress.com

331

332

Chapter 10 • Building Trees and Forests

example, a company named XYZ can have seven domains in their forest, but needs to register only a single DNS namespace if all the domains are within that namespace, such as xyz.com, one.xyz.com, two.xyz.com, three.xyz.com, four.xyz.com, five.xyz.com, and six.xyz.com, as illustrated in Figure 10.7. Figure 10.7 Wide and Flat Domain Tree Structure

xyz.com

one.xyz.com

six.xyz.com two.xyz.com

five.xyz.com

three.xyz.com

four.xyz.com

The domain tree can be wide and flat as depicted in Figure 10.7.The domain tree can also be tall, with multiple subdomains, as shown in Figure 10.8.The configuration of a domain tree is entirely up to the network designer since the Kerberos, two-way transitive trusts essentially make a domain tree into a group of domains that completely trust each other and trust all other domains within their designated forest. Each domain in the Active Directory forest defines a partition of the forest’s database.The partition is a subset of a larger database that is distributed to multiple DCs.This method of partitioning makes Active Directory scalable from small to extremely large enterprise networks.There is also a benefit found in having redundant replicas of the domain partitions when multiple DCs exist for each domain. A DC can contain only a copy of the database partition for its own domain. That means that copies of different domain database partitions cannot be contained on a single Windows 2000 Server. However, the forest configuration and schema are hosted by all DCs throughout the forest. www.syngress.com

Building Trees and Forests • Chapter 10

Figure 10.8 Tall Domain Tree Structure

xyz.com

one.xyz.com

sub.one.xyz.com

two.xyz.com

sub.two.xyz.com

ab.sub.two.xyz.com

cd.sub.two.xyz.com

Adding a Child Domain Child domains are installed with the first DC of the child domain in a domain tree.When that child domain is formed, Active Directory creates a two-way transitive Kerberos trust automatically between it and the parent domain. Schema and configuration data for the forest are copied from the parent domain to the new child DC. The relationship of a parent domain to a child domain is strictly one of the DNS subdomain name and trust relationship. For example, a parent domain in a domain tree would be PARENT.COM.The child domain would be CHILD.PARENT.COM.The trust relationship is bidirectional and transitive. www.syngress.com

333

334

Chapter 10 • Building Trees and Forests

An Administrator in PARENT.COM does not have administrative authority in CHILD.PARENT.COM. Instead, the Administrator in PARENT.COM must be granted administrative authority to CHILD.PARENT.COM. Likewise, group policies set in PARENT.COM are not applicable to CHILD.PARENT.COM. There is no domain-level inheritance of rights, authorities, or Group Policies. Another change to Active Directory occurs with a new child domain—a new replication partition is created. More about replication can be found in Chapter 11, “Implementing Sites.”

WARNING You cannot add a child domain before you add the parent domain to the forest. You must begin with the parent domain, follow with its child domains, and then follow that with its grandchild domains. If you try to add the parent after the child, the domain tree will not be recognized, resulting in errors.

Right-Sizing the Active Directory Storage Space Each DC contains a copy of the Active Directory Store for the domain. Some of the DCs are also Global Catalog servers.They contain a copy of the Global Catalog for the entire forest. Other DCs have a copy of the forest configuration. Determining the size requirements for DCs is somewhat of an art form.

NOTE You can check your DC size requirements using the Active Directory Sizer tool. You can download this tool from Microsoft’s Web site at www.microsoft.com/windows2000/techinfo/reskit/tools/new/adsizer-o.asp.

One thing to remember is that the Active Directory Store does not automatically shrink in size when its objects are deleted; it typically stays the same size or grows. If space within the store is freed up, it remains available for new objects

www.syngress.com

Building Trees and Forests • Chapter 10

and properties to fill. Space is freed up when objects are deleted, but not immediately. Deleting an object creates a tombstone.The tombstone marks the record for deletion, but does not delete it immediately.The tombstone is replicated to the other DCs.The tombstone has a lifetime value, known as a tombstone lifetime, to it. When the object reaches the lifetime value, it is physically deleted from the Active Directory Store. The ADSIEdit utility is used to view or change the tombstone lifetime value. ADSIEdit is a Resource Kit utility that has access to the inner workings of Active Directory. It is comparable to the regedit utility that has access to the Windows 2000 registry.When starting the ADSIEdit utility, most likely it will not be in the area of the registry that accesses the tombstone lifetime.To access the configuration container, right-click on the domain and select Settings as illustrated in Figure 10.9.Then select the Configuration container. Figure 10.9 Accessing the Configuration Container in ADSIEDIT

Once the Configuration container is visible in the left pane, navigate through CN=Configuration | CN=Services | CN=Windows NT | CN=Directory Service, as shown in Figure 10.10. Right-click on Directory Service and select Properties from the pop-up menu.The Properties dialog will appear as shown in Figure 10.11. Under the Select which properties to view drop-down list, select tombstoneLifetime. To change the value, type a number in the Edit Attribute box, and click Set.

www.syngress.com

335

336

Chapter 10 • Building Trees and Forests

Figure 10.10 Navigating to the Directory Service Container.

Figure 10.11 Directory Service Properties and tombstoneLifetime Value

Garbage collection is the process used to free up space. It deletes expired tombstones and defragments the Active Directory database. Each DC runs garbage collection independently of the others, and the default 12-hour value can www.syngress.com

Building Trees and Forests • Chapter 10

be changed in the ADSIEdit Resource Kit utility in the same place that tombstone values are changed in the Directory Service Properties dialog.To change the garbage collection period, select garbageCollPeriod from the drop-down list and place a number in the Edit Attribute box, which is shown in Figure 10.12. Garbage collection frees up space in the database, but does not reduce the size of the database. Figure 10.12 Changing the Garbage Collection Interval

In order to truly reduce the size of the Active Directory Store, use NTDSUtil. NTDSUtil.exe is an offline defragmentation utility. After it is executed, the Active Directory database will reduce in size. NTDSUtil requires that the server be taken down from the network to run, and should be used sparingly. Security principals such as user objects and groups use approximately 3.5KB of space in the database. Nonsecurity principals, such as an OU object, use about 1KB of space each.When sizing the database, count the number of security principals and multiply by 3.5, count the number of nonsecurity principals, and add the two figures. Divide this sum by 1000 to receive the number of MBs. Add approximately 1000MBs for the base size of the store.Then double the final amount to account for growth.To find what is needed for the entire server hard drive, add the amount required for Windows 2000 Server, the amount needed for applications, and additional space for growth. If there are 100,000 security principals and 20,000 nonsecurity principals, the result will be 370,000KB, or 370MB. Added to the 1000MB, the result is

www.syngress.com

337

338

Chapter 10 • Building Trees and Forests

1370MB. Double this for growth and the minimum size reserved for the Active Directory Store would be 2.7 GB.

NOTE The optimal storage system for a Windows 2000 DC is a hardware-based RAID drive using RAID 5. Such a RAID system would be able to recover from a hard drive failure while the server was still running and providing services to the network. Although RAID 5 is recommended for speed and redundancy, it certainly is not a requirement. If using regular hard drives, however, performance on a DC is best if the system, database, and log files for Active Directory are placed on separate hard drives. When these files are on separate hard drives, they can be written to simultaneously, thus increasing performance. Not only is this helpful with speed, but this will enable a faster recovery if one of the hard drives happens to fail, since log files will assist in rebuilding the database to a current state.

Managing the Forest The most obvious place to manage the forest is within the Active Directory Domains and Trusts management console, shown in Figure 10.13.This console, found in the Administrative Tools menu on a Windows 2000 DC, displays all of the domain trees in the forest and can view, change, or create any trust relationships that exist outside the forest.The forest’s UPN format is also configured in this console. There are many other utilities that can manage the forest aside from the Active Directory Domains and Trusts console. One of these utilities is MOVETREE.exe.This utility is found in the Windows 2000 Resource Kit utilities. It is used to move objects within one domain to another domain, as long as both domains exist in the same forest. Objects that are domain-specific, such as domain Global groups or Local groups, cannot be moved by the MoveTree utility. If MoveTree executes a move for the OU that contains these groups, then the groups remain behind in a container called LostAndFound in the domain. Some things are not objects within the domain, but are domain-specific data that exists within Active Directory.This includes logon scripts, policies, and profiles.These will not be moved by MoveTree either. www.syngress.com

Building Trees and Forests • Chapter 10

Figure 10.13 Domains and Trusts Management Console

MoveTree is a command-line utility that can execute in batch mode. One of the switches for MoveTree is /check.This switch runs MoveTree but does not complete the move of the objects. Instead, it verifies that it will work. If MoveTree /check executes without errors, then the same command will be successful in /start mode. For example, if moving a user from one.xyz.com to two.xyz.com, the MoveTree command to check would be: Movetree /check /s server1.one.xyz.com /d server2.two.xyz.com /sdn cn=user,cn=users,dc=one,dc=xyz,dc=com /ddn cn=user,cn=users,dc=two,dc=xyz,dc=com

If the command does not report any errors, the MoveTree command that can execute the move is: Movetree /start /s server1.one.xyz.com /d server2.two.xyz.com /sdn cn=user,cn=users,dc=one,dc=xyz,dc=com /ddn cn=user,cn=users,dc=two,dc=xyz,dc=com

Another utility can be used to move objects outside a domain to any domain. The Lightweight Directory Access Protocol (LDAP) is a standard supported by the Active Directory Service. LDAP is an open standard supported by many different directory services.This makes it an ideal interchange point between two different directories, or even between two different forests. www.syngress.com

339

340

Chapter 10 • Building Trees and Forests

LDIFDE.exe is an LDAP Data Interchange Format utility included with Windows 2000. It can export and import objects in Active Directory using the LDAP protocol.The process to export objects from the current domain using LDIFDE, which can be found in the WINNT\SYSTEM32 directory, is as follows: 1. Log on to a DC in the domain from which you want to export objects, as a user with Administrative authority. 2. Open a command prompt window (Start | Run | cmd). 3. Type ldifde –f filename.ldf and press Enter. The screen should look like Figure 10.14. Figure 10.14 LDIFDE

The resulting file is a plain text listing of the objects in Active Directory. It will include records that look like the following user account object: dn: CN=my self,OU=Sales,OU=All Users,DC=melissacraft,DC=com changetype: add accountExpires: 9223372036854775807 badPasswordTime: 0 badPwdCount: 0 codePage: 0 cn: my self countryCode: 0 displayName: my self dSCorePropagationData: 19990816040611.0Z dSCorePropagationData: 16010101000001.0Z givenName: my

www.syngress.com

Building Trees and Forests • Chapter 10 instanceType: 4 lastLogoff: 0 lastLogon: 0 logonCount: 0 distinguishedName: CN=my self,OU=Sales,OU=All Users,DC=melissacraft,DC=com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=melissacraft,DC=com objectClass: user objectGUID:: SxvF1yYMEkmBBksImyTCqQ== objectSid:: AQUAAAAAAAUVAAAAiqcyPyPz9mP4n7R0dQQAAA== primaryGroupID: 513 pwdLastSet: 125781260326329120 name: my self sAMAccountName: myself sAMAccountType: 805306368 sn: self userAccountControl: 512 userPrincipalName: [email protected] uSNChanged: 2084 uSNCreated: 2077 whenChanged: 19990803035352.0Z whenCreated: 19990803035334.0Z

The LDIFDE command used to import objects is: ldifde –i –f

LDIFDE can be used to perform mass changes across all objects in a particular OU or across an entire domain.The LDIFDE command has extensive capabilities for managing Active Directory. Since LDIFDE is a command-line tool, it can be executed in batch mode.To find out what options are available, type LDIFDE /? |more at the command prompt.

www.syngress.com

341

342

Chapter 10 • Building Trees and Forests

Summary An Active Directory forest is a collection of one or more domains using one or more DNS namespaces. Each domain within a forest shares a common configuration, schema, and global catalog.The Configuration container and schema is replicated to every domain controller (DC) in the forest.The Global Catalog is a partial copy of every object in each domain that belongs to the forest. Domain trees within a forest use a contiguous DNS namespace. A top-level domain in the domain tree would have the DNS name parent.com, and directly below it the child domain would have the DNS name child.parent.com. Each domain within a forest is connected to others via a two-way transitive trust relationship.This results in each domain trusting every other domain within a forest. When planning a forest, the main decision is whether or not the network will have multiple forests. Multiple forests are necessary if there is a reason to have ■

Separate schemas

■

Separate configuration

■

Separate Global Catalog

■

Completely separated administration

There is some impact in having multiple forests on the network. Additional bandwidth is required for replication of a separate Global Catalog and Active Directory databases. Users are affected in how they work across forests.The resource domain must trust the domain that the user belongs to in order for the user to access the resource. If the resource domain is in a different forest, then the Administrator must establish that trust explicitly.Trusts between forests are oneway and nontransitive. A user must know which domain the resource belongs to and must be able to query that domain directly. Creating a domain tree in a forest is simply the process of adding new child domains using subdomains of the same DNS namespace.The tree can be wide and flat, or tall. When a new DC is added to manage a new domain, its storage space should be adequate to support the objects that will exist in Active Directory. Storage requirements are larger for DCs that contain a copy of the Global Catalog because they will have two databases on them. Several utilities are used to manage the Active Directory forest:

www.syngress.com

Building Trees and Forests • Chapter 10 ■

NETDOM is used for domain trust management.

■

NTDSUtil is used to defragment the Active Directory database while the DC is offline.

■

ADSIEdit provides the ability to edit specific internal parameters of Active Directory.

■

Active Directory Domains and Trusts offers a graphical view of all the domains within a forest and enables trust relationship management.

■

LDIFDE is used to import and export objects from an Active Directory domain.

■

ClonePrincipal is used to clone objects from a domain.

■

MOVETREE is used to move objects from one domain within a forest to another domain within the same forest.

Solutions Fast Track Understanding the Characteristics of an Active Directory Forest  A forest has a common schema, configuration, and Global Catalog.

Every DC in the forest contains an identical copy of the schema and configuration. Special Global Catalog servers contain a copy of the Global Catalog partition.  The schema is a partition that contains classObject and classAttribute

objects to define the types of objects and attributes that are allowed to be placed in Active Directory.  The Global Catalog is a partition that contains a partial copy of objects

in all domains, enabling it to act as an index. Users can easily locate objects through queries without knowing the domain to which those objects belong because the queries are handled by the Global Catalog.  Transitive, bidirectional trust relationships are created automatically in

the forest between domains.

www.syngress.com

343

344

Chapter 10 • Building Trees and Forests

Implementing the Forest Structure  Don’t implement a forest until you have completed your forest plan,

indicating the number of forests in your network and their root domains.  Plan domain tree structures around namespaces.When implementing the

domain trees, you must install the namespace root domains and follow with child domains, and after that, grandchild domains.  When a child domain is added, a Kerberos trust is created automatically

between itself and its parent domain.

Right-Sizing the Active Directory Storage Space  When an object is deleted from Active Directory, its space is not recov-

ered. Instead, a tombstone is created to mark the object for deletion.  ADSIEdit, a Resource Kit utility, can be used to change the tombstone

values.  Garbage collection is the process of cleaning up Active Directory

domain partitions in order to reclaim space.

Managing the Forest  Managing the processes that occur between domains occurs in the

Active Directory Domains and Trusts MMC.  Forest management includes the ability to set the user principle name

(UPN) for the forest.  MOVETREE is a Resource Kit utility that can move objects between

domains in the same forest.  LDIFDE is a Resource Kit utility that can migrate objects from other

LDAP-compatible directories.

www.syngress.com

Building Trees and Forests • Chapter 10

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: What commands do I use in creating a child domain if the parent domain is already installed in the forest?

A: You need only run Dcpromo on a Windows 2000 Server and select the options to join an existing forest, to create a new domain, and then to join an existing domain tree as a new child domain.The DNS name of the child domain will be in the format of child.parent.com.

Q: I am concerned about the extra traffic that multiple forests can have on wide area network (WAN) links. However, I want to have a separate forest for my lab network, which is confined to a single room.Will creating two forests, one that is confined to that room and another that is used for production, cause significant WAN bandwidth consumption?

A: No. In the situation described, the lab forest would not span any WAN links and would have no effect on the bandwidth utilized across the WAN.

Q: I have a group of people in CORAZON.COM who must access a printer in New York that is in the CARTA.COM domain in a different forest.Which domain must trust the other in order for the users to be able to print?

A: CARTA.COM must trust CORAZON.COM. Resource domains must always trust the account domain in order for the users to access the resources.

Q: We want to move the domain Global groups from one domain to another in the same forest.What is the best utility to use, ClonePrincipal or MoveTree?

A: ClonePrincipal can clone security principals, such as users and groups, from one domain into another. MoveTree cannot move domain-specific objects such as domain Global groups.

www.syngress.com

345

Chapter 11

Implementing Sites

Solutions in this chapter: ■

Creating Site Components

■

Implementing a Site Structure in Active Directory

■

Replication Utilities

■

Understanding Time Synchronization

 Summary  Solutions Fast Track  Frequently Asked Questions

347

348

Chapter 11 • Implementing Sites

Introduction The site topology should reflect the physical network topology existing in an internetwork.The infrastructure system of network connections is one of the ever-changing aspects of any network. Likewise, the site topology will constantly be changing. When implementing sites, you will be using the Active Directory Sites and Services MMC.This console will help manage both intrasite replication and intersite replication.To access this console, click Start | Programs | Administrative Tools and click on Active Directory Sites and Services.

Creating Site Components Before looking at what to do when creating a site component, consider what happens if you do not create site components.With the installation of the first Domain Controller (DC), a single default site, named Default-First-Site-Name, is generated. If you make no configuration changes whatsoever, then every DC installed into the forest thereafter is added to the same default site.This site does not differentiate between locations of DCs, so a DC that is sitting in Cairo, Egypt is as likely to be queried by a person sitting in Sydney, Australia as another DC sitting in Denver, Colorado. Queries and logons by users are not the only processes that will occur without concern for location. Replication will take place and attempt a 15-minute convergence interval between every DC in the default site, even if there are slow and expensive wide area network (WAN) links between DCs in different geographic locations.The result is an excessive amount of traffic with no regard to bandwidth utilization or performance. The concept of sites was developed to head off traffic problems related to unmanaged site replication and nonlocal logons and queries.

Creating Sites One of the first tasks you should perform after installing the first DC in the forest is to generate your site topology. If you establish the site topology first, then subsequent DC installations will automatically be placed in the correct sites and logon and query traffic will immediately be localized according to IP subnets. A site is, by definition, a collection of well-connected IP subnets. It is defined as an object in Active Directory. “Well-connected” means that IP subnets within a site are able to move traffic quickly among themselves.These IP subnets should all be connected to each other; there should not be any segments that separate www.syngress.com

Implementing Sites • Chapter 11

these IP subnets from each other.There should not be any WAN links among the segments, either, except in certain instances—such as when there are very few users across the link, or when the link has a great deal of available bandwidth. Sites provide the means for traffic to be localized.When clients execute queries or authenticate to Active Directory, their queries and logons are directed to Global Catalog servers and DCs within their own site.The client’s machine knows which site it is in by matching its own IP address to the IP subnets included in the sites.This process reduces latency for client queries and logons. When DCs replicate updates, they will do so more often within a site than they will between sites.The replication traffic within a site is uncompressed and frequent, triggered whenever updates take place.The replication traffic between sites is compressed and scheduled to use less network bandwidth. You create a site within the Active Directory Sites and Services Microsoft Management Console.This MMC is depicted in Figure 11.1. Figure 11.1 Active Directory Sites and Services MMC

Right-click on the Sites container and select New Site from the pop-up menu. It doesn’t matter if you right-click on the Sites container in the left pane or the right pane.You will be prompted to type a name for the new site, and then select a Site Link to associate it with.You can create all your sites and associate them to the DefaultIPSiteLink to begin, as shown in Figure 11.2, then create Site Links and change the associations of the sites to the actual Site Links with which they should belong.

www.syngress.com

349

350

Chapter 11 • Implementing Sites

Figure 11.2 New Sites Are Assigned to a Site Link at Creation

Creating Connection Objects The connection object is used as a logical pull of replication data.This object sits below the NTDS Settings object, which is beneath the destination server.The connection object refers to the server from which it is pulling replication data. A connection object is unidirectional and inbound only. If you want to have data replicate between two DCs in both directions, you must create two connection objects.The connection object can be created in two ways: 1. The Knowledge Consistency Checker (KCC) will generate connection objects automatically when it calculates the replication topology. 2. A network administrator can create connection objects manually. A network administrator creates sites, Site Links, and Site Link Bridges, and then assigns the Site Links with availability and replication frequency, as well as cost of the links.The KCC has enough knowledge about the replication topology to create appropriate connection objects.The KCC will always create more connection objects within a site than it will between sites.This is primarily to reduce latency within the site.Within the site, the KCC uses an algorithm that has a goal of a 15-minute convergence in a complex series of interconnected replication rings consisting of four servers or less. Between sites, the KCC simply enables enough connection objects to be able to replicate updates according to the frequency the administrator has configured.

www.syngress.com

Implementing Sites • Chapter 11

One reason that you may wish to create a connection object is to establish a replication schedule. Each connection object is associated with a replication schedule, so you can configure replication with a manually created connection object.The KCC may create a connection object, but it will refresh its connection objects periodically, so you cannot depend upon a KCC connection object being able to retain your schedule. However, the KCC will not delete any manually created connection objects. To create a connection object, navigate to the NTDS Settings object below your destination server (the DC that will receive the replication updates). Rightclick and select New Connection Object from the pop-up menu.

Creating IP Subnets In order for the site topology to function seamlessly, create IP subnet objects for each IP subnet in your network that has either Active Directory DCs or clients on it. As part of the IP Subnet creation, you will be prompted to apply the subnet to a site, so it is best to have your sites established before creating IP subnets.To create a new IP subnet: 1. Open the Active Directory Sites and Services console. 2. Navigate below the Sites container to the Subnets container. 3. Right-click on the Subnets container. 4. Select New Subnet, as shown in Figure 11.3. Figure 11.3 Creating an IP Subnet

www.syngress.com

351

352

Chapter 11 • Implementing Sites

5. In the New IP Subnet dialog box, type an address contained within the subnet and its subnet mask, then select a site to assign the IP subnet to, as shown in Figure 11.4. Figure 11.4 Assigning an IP Subnet to a Site

6. Click OK to complete. If you have created IP subnets and want to reassign them to another site, you may do so by right-clicking the subnet and selecting Properties from the popup menu.Then select the new site from the drop-down box. If you wish to add further information regarding the IP subnet, click the Location tab and type the geographic location of the IP subnet.This may be helpful if you have multiple geographic locations participating in a single logical site.

Creating Site Links The Site Link objects in the Active Directory Sites and Services represent logical connections (not physical connections) between their participating sites. Essentially, a Site Link object states that all of its sites can communicate with any of the other sites in it at a uniform cost. Since many networks are built with physical “cloud” connections, where multiple locations hook into the same wide area network (WAN) connection provider’s network and participate at the same rate of speed, you can easily create a single Site Link object for all the participating sites in the cloud.This may or may not work for point-to-point connections, in which a single WAN connection www.syngress.com

Implementing Sites • Chapter 11

links two locations together, and another point-to-point connection links one of those locations with yet another location. Can they all communicate at the same cost? Yes, if you go through a single WAN link. No, if you start at one site, go through a WAN link, hop through an intervening site, then through another WAN link to the destination site. In this case, you should not include all the sites in the Site Link object. Instead, you should have a Site Link representing each point-to-point WAN connection. Each Site Link has the following characteristics: ■

A Site Link object is assigned a cost, which represents the expense of sending messages across the Site Link.Traffic shows a preference for the Site Link with the lower cost.The KCC connection objects include a frequency attribute that is inversely proportional to the cost of the Site Links the connections cross. For example, if the cost of the link is 0, frequency is as often as every quarter hour, but if the cost of the link is 5, the frequency may be every hour and a half.

■

Each Site Link object has an associated schedule of availability. If you do not want replication traffic to be transmitted between Site A and Site B during 3:00 P.M. and 5:00 P.M. on Fridays when your company uses the associated WAN link between those locations to upload data to the bank, then you can schedule the Site links that include both Site A and Site B to be unavailable during that time.

■

Each Site Link object has an associated frequency.This is a number that is between 15 minutes and 10080 minutes (equivalent to one week). Whenever the frequency period has passed, the other site is checked for updates to Active Directory.

■

Each Site Link is associated to either IP or SMTP transport. In almost all cases, the transport should be IP.The only time that SMTP should be used is if there is no domain partition traffic crossing the Site Link (i.e., that there are no DCs from the same domain in both sites), because SMTP supports replication of only the schema, the configuration, and the Global Catalog.

To create a Site Link object: 1. In the Active Directory Sites and Services MMC, click the plus sign (+) next to Sites to expand it. 2. Click the plus sign (+) next to Inter-Site Transports to expand it. www.syngress.com

353

354

Chapter 11 • Implementing Sites

3. Right-click the IP container. 4. Select New Site Link from the pop-up menu as shown in Figure 11.5. Figure 11.5 Creating a New Site Link Object

5. In the New Object—Site Link object, type a name to identify the Site Link. 6. Click on each site that will participate in the Site Link and click the Add button, as shown in Figure 11.6. Figure 11.6 Adding Sites to a Site Link Object

7. When all the sites have been added, click OK to close the dialog. www.syngress.com

Implementing Sites • Chapter 11

You can change the attributes of the Site Link, such as the cost and availability, by right-clicking the Site Link and selecting Properties from the pop-up menu.Then make your changes and click OK.

Creating Site Link Bridges A Site Link Bridge is a set of Site Links that have been connected so that data can transmit between the various sites, even if they are not directly connected. A Site Link Bridge object contains at least two Site Link objects, and all of the Site Link objects must have at least one site in common.The result is that the Site Link Bridge enables transitive communication to take place between sites, through intervening sites. For example, you may have three sites—A, B, and C.You can have a Site Link for A to B connectivity and another Site Link for B to C connectivity. In order to have replication take place directly between DCs in Site A and DCs in Site C, you can create a Site Link Bridge that includes the AB and BC Site Link objects. When you create a Site Link Bridge, the costs of the participating Site Links are added.Therefore, if the cost of Site Link AB is 3 and the cost of Site Link BC is 5, then the cost of Site Link Bridge is 8.You do not configure this cost; it is figured automatically, based on the costs of the participating Site Link objects. Therefore, if you change the cost of a Site Link object, any Site Link Bridges that include the Site Link will immediately reflect the cost change. If you are comfortable with replication taking place between Sites A and B, and then replication taking place between Sites B and C, without any direct communication between Sites A and C, then you do not need a Site Link Bridge.This type of replication will take longer because an update from Site A must first populate Site B before it is updated on site C. To create a Site Link Bridge: 1. In the Active Directory Sites and Services, click the plus sign (+) to expand the Sites container. 2. Click the plus sign (+) to expand the Inter-site Transport container. 3. Right-click the IP node and select New Site Link Bridge from the pop-up menu. 4. In the New Object—Site Link Bridge dialog shown in Figure 11.7, select all the participating Site Links and click the Add button. 5. Click OK to close the dialog.

www.syngress.com

355

356

Chapter 11 • Implementing Sites

Figure 11.7 Creating a New Site Link Bridge

The Knowledge Consistency Checker The Knowledge Consistency Checker (KCC) is both a blessing and a curse. Each DC runs a KCC service. Every 15 minutes the KCC checks the replication topology and refreshes it. It will create new Connection objects and destroy the existing ones based on the information in the Active Directory Sites and Services. It’s automatic, and stays current with the site topology.You don’t really need to pay a lot of attention to managing sites.That’s the blessing part. Here’s the curse:When you want to create a frequency schedule of replication on a Connection Object, you will lose it if it is a Connection object that the KCC created. So, to take advantage of the scheduling aspect of connections, you must create Connection Objects and manually configure them. For intrasite replication, the KCC attempts to establish at least two connection objects to each DC.This means that if one DC becomes unavailable, there is redundancy in the connection objects to ensure that data can still be replicated from another DC.

Implementing a Site Structure in Active Directory Implementing sites is accomplished through the Active Directory Sites and Services management console found in Administrative Tools. Since the first DC in the forest automatically created the Default-First-Site-Name site, then the www.syngress.com

Implementing Sites • Chapter 11

console will display this site. After that first DC is installed, the entire site structure can be created before installing any other domains and DCs. The best way to illustrate how to configure a site structure according to the physical network infrastructure is to use a sample network infrastructure as a model.The following examples use Bland Blinds as an example organization with the network infrastructure and designed site structure shown in Figure 11.8. Figure 11.8 Bland Blinds’ Network Infrastructure

LA

London

Phoenix

T1

Network Infrastructure Site Link Bridge: LA-LON

Site Link: PHX-LON

Site Link: LA-PHX

IP Subnet: 10.10.10.0

la1.blandblinds.com Site: LA

phx1.blandblinds.com Site: PHX

IP Subnet: 10.10.9.0

IP Subnet: 10.10.4.0

lon1.blandblinds.uk Site: LON

10.10.1.0 la2.blandblinds.com

phx2.blandblinds.com

The first task is to rename the Default-First-Site-Name. Since the first DC installed is la1.blandblinds.com, then the site name should change to LA. In the Active Directory Sites and Services console, right-click Default-First-SiteName and select Rename from the pop-up menu.Then change the name to LA. Next we can create the PHX and LON sites. In the Active Directory Sites and Services Console, right-click the Sites container and select New Site.Type the name for PHX, and select a Site Link—DEFAULTIPSITELINK is fine for

www.syngress.com

357

358

Chapter 11 • Implementing Sites

now; we will edit the Site Links later.Then click OK.You should see a dialog similar to the one shown in Figure 11.9. Click OK to bypass it. Repeat this procedure for the LON site. Figure 11.9 Create an Active Directory Site

The next step is to add the correct IP subnets to the site. Even though the Default-First-Site-Name was used as the LA site, it will not have any IP subnets assigned to it. Right-click the Subnets container and select New Subnet. In the LA site, one of the subnets is 10.10.10.0. Although it is not listed here, the subnet mask is 255.255.255.0. In the New Object-Subnet dialog shown in Figure 11.10, type the address and subnet mask, click on LA in the Site Name box, and click OK. Figure 11.10 Create an IP Subnet Object

The name will build as you type in the subnet mask; it is merely a different notation for subnetting that commonly is used for Variable Length Subnet Masking (VLSM).The /24 represents the number of bits assigned to the subnet www.syngress.com

Implementing Sites • Chapter 11

mask.To generate the remaining IP subnet objects, repeat this process and assign the subnets to the appropriate sites.The final IP subnet set for Bland Blinds should resemble those shown in Figure 11.11. Figure 11.11 Resulting IP Subnets for Bland Blinds

After assigning the IP subnets to the sites, the next task is to create the two Site Links: LA-PHX and PHX-LON.We will assume that the links are approximately equal in bandwidth availability, and that they are IP Site Links with a cost of 7 and a replication frequency of 60 minutes. (Please note that these figures were arbitrarily selected for this scenario.) To create a Site Link, in the Active Directory Sites and Services console, expand the Sites container and then expand the Inter-Site Transports container. Right-click the IP container and select New Site Link. In the dialog box, select the LA site and the PHX site, and click Add to incorporate them into the Site Link. At the top of this dialog box, name the Site Link LA-PHX as shown in Figure 11.12, and then click OK. Repeat this process for the second link. Figure 11.12 Site Link Creation

www.syngress.com

359

360

Chapter 11 • Implementing Sites

To change the cost and frequency of each Site Link, double-click them to display the Properties, as shown in Figure 11.13. Change the Cost from the default value to 7.Then change the value of the frequency from the default value to 60. Click OK to complete the configuration, and repeat for the other Site Link object. Figure 11.13 Site Link Configuration

Figure 11.14 Site Link Bridge Creation

www.syngress.com

Implementing Sites • Chapter 11

Now that Site Link objects are configured, the Site Link Bridge from LA to London can be created.This is a nearly identical process to creating a Site Link. In the same IP container below the Inter-Site Transports container, right-click the IP container and select New Site Link Bridge. In the resulting dialog, similar to that shown in Figure 11.14, select each of the new Site Link objects in the left-hand pane and click Add to move them to the right pane. Give the Site Link Bridge a name, and click OK.

Replication Utilities Once replication has been configured, how can an Administrator verify that it works? Microsoft provides utilities to monitor and manage the replication for Active Directory.

Replication Monitor The replication monitor (REPLMON) is provided with the Windows 2000 Resource Kit utilities to view the replication topologies and monitor the traffic. It is a graphical tool that uses icons to represent server roles, such as a globe to designate a GC server, and their status, such as a red X to indicate a replica that is out of date.The Administrator can select which DCs to monitor by selecting the Edit menu and the Add Site/Server option. This utility enables the Administrator to specify the naming contexts and sites, and then track each naming context’s replication traffic for each DC by creating log files. Statistics are placed in the log files for each replication partner and each replication topology (e.g., naming context level). Administrators should use the replication monitor after establishing the site structure to verify that it is working. If testing various site structures, which is entirely possible given the fact that sites are easily moved, changed, or deleted, Administrators can use this tool to validate the best replication topology set for their environment. Replication monitor also serves as a troubleshooting tool. If there are persistent errors with replication, or if there are bandwidth utilization concerns, the replication monitor can provide the statistics.The replication monitor can be used to recalculate the replication topology by triggering the KCC. Additionally, if a naming context appears to be out of sync on separate DCs, the replication monitor can be used to force synchronization.

www.syngress.com

361

362

Chapter 11 • Implementing Sites

Replication Administrator Replication Administrator (REPADMIN) is a command-line tool included with Windows 2000 Server used to diagnose replication problems between DCs.This tool can provide the same functions as replication monitor; as a command-line tool it is less intuitive, although it can produce some very precise results.

DSASTAT Although not specifically geared toward replication or sites, the DSASTAT command-line tool included with Windows 2000 Server can help diagnose problems with naming contexts.This tool would be used if there were no obvious source of problems from the replication monitor log files. DSASTAT compares naming contexts on different DCs. Additional statistics regarding the Active Directory store capacity, at a granular level, can further detect divergence of replicas.

Understanding Time Synchronization Time synchronization is an important subject in distributed databases. One reason is that most distributed databases use a last-write date and timestamp to determine which change should be considered final when there are conflicts. If, for example, a change is made on a replica in New York at 3:08 P.M., and another change is made on a replica in Los Angeles at 12:09 P.M. (which would be exactly one minute after the New York change given the time zones), the change that would “win” during replication would be the change made in Los Angeles. However, if the DC’s time clock had drifted to 12:07 P.M., the New York change would win. A change to a user object that was made in error at one site and then corrected on the other site could be the difference between that user being able to log on the next day or not.This is not the best situation, especially if that user happens to be a vice president of a corporation, which that user always seems to be when these types of glitches occur. So how does time synchronization work with Active Directory? The goal of time synchronization is to eliminate the consequence of drifting computer clocks and to enable a common time for all participants on the internetwork. Common time does not necessarily refer to correct time, such as that which the atomic clock can provide. Rather, a common time is simply the same designated date and time upon which all computers agree. Keep in mind the following factors that are looked at by Active Directory when evaluating a conflict in replicated data: www.syngress.com

Implementing Sites • Chapter 11

1. The version number of an attribute has changed. If a user’s password is changed in two locations (once by the user, once by the Admin), the attribute’s version number is incremented by 1 on that DC.The change with the highest version number wins during a conflict. 2. If the version numbers are equal, such as when the changes are made within two different sites, then the change timestamp is evaluated. 3. If the timestamps are equal, then the Globally Unique IDs (GUIDs) of the originating write Directory Service Agents (DSAs) are evaluated. Active Directory reaches this goal through the W32TIME service running on Windows 2000 Servers. A simple command, NET START W32TIME, will start the service, which is implemented as SNTP (described in RFC 1769 and available on each Windows 2000 Server or Professional machine).The service designates two types of machines: ■

Time servers

■

Time clients

The first installed DC acts as a primary SNTP server. Other DCs are also time servers for all time clients.Time servers implement synchronization between sites when Active Directory replication initiates a connection between DCs. If the time server is pointing to another Active Directory-based time server, the time source can be validated, but this cannot happen if pointing to a standard SNTP time server. Time clients contact the time servers at logon.There is a five-minute difference in time allowed by Kerberos.Time is checked in eight-hour intervals after logon to verify time compliance. If the time client’s clock is off, it will adjust its clock to match the time server’s clock, log the change into its event log, and cut the interval check to every four hours. The legacy NET TIME command is still available, but is not the same as the SNTP-compliant W32TIME service. However, NET TIME can use NTP services.

www.syngress.com

363

364

Chapter 11 • Implementing Sites

Summary A site is defined as a set of IP subnets that have a high amount of bandwidth available between them.The purpose of a site is to localize traffic from queries, authentication, and replication. Replication is the process of synchronizing all the copies, or replicas, of the distributed Active Directory database. Queries and authentication traffic are generated at the will of clients. Replication traffic occurs actively and frequently within a site, but can be managed through intervals and scheduled availability between sites. Because of the nature of replication traffic, sites typically define a single geographic location. When planning a site structure, make sure to place at least one domain controller (DC) and at least one Global Catalog (GC) server (they can be the same server) in each site.The configuration that will have the least amount of traffic between sites is that where sites and domains are in a one-to-one correspondence.This ensures a minimum of intersite and intrasite traffic, making this an optimum topology. The replication topology is the configuration of the physical flow of information between DCs. Each naming context (schema, configuration, and domain) has a separate replication topology. Replication traffic increases when sites span two or more domains.The Knowledge Consistency Checker (KCC) generates the replication topology within a site by creating a bidirectional ring for each naming context. Each direction in the ring is represented by a one-way connection object that can be found below each DC. The replication topology between sites can be created manually by an Administrator.The Active Directory Sites and Services console is used to create the replication topology.Within it: ■

Sites are created and assigned to a transport type, currently IP or SMTP.

■

IP subnets are created and assigned to sites.

■

Site Links are created to connect those sites that have actual network connections between them.

■

Site Link Bridges are created to connect sites by hopping over sites in common when two sites do not have network connections between them.

■

Servers can be moved into sites, or if installed after the site has been assigned IP subnets, they will install into the site that contains their IP subnet.

www.syngress.com

Implementing Sites • Chapter 11

Three utilities can assist in managing replication traffic: ■

Replication Monitor—REPLMON

■

Replication Administrator—REPADMIN

■

DSASTAT

These tools are capable of monitoring traffic on selected DCs, as well as forcing a replication synchronization and other troubleshooting options. Time synchronization has an impact on replication in that if all Active Directory DCs do not agree on a common time, then updates may be applied out of order, resulting in possible logon failures and other access problems.Time synchronization is handled through the W32Time service, which is an SNTPcompliant time service.There are both time servers and time clients in this service.Time servers synchronize on a common time setting.Time clients check with time servers at logon to validate their time. If a time client is not synchronized, it will update its clock and log the event.

Solution Fast Track Creating Site Components  You configure site components in the Active Directory Sites and

Services MMC.  Connection objects either are generated automatically by the

Knowledge Consistency Checker (KCC) or configured manually by the administrator.  Site Link objects enable Connection objects to be created between DCs

in the participating sites.  Site Link Bridge objects consist of two or more Site Link objects, all

with at least one site in common, so that transitive traffic can take place.

Implementing a Site Structure in Active Directory  You should configure your site structure to mirror the network

infrastructure that physically exists on your network.

www.syngress.com

365

366

Chapter 11 • Implementing Sites

 You can rename the Default-First-Site-Name to a name of an actual site

you will be using in your Active Directory.  When creating Site objects, select the DefaultIPSiteLink.Then, after you

have created the Site Link objects for your network, associate the Site objects to the appropriate Site Link objects.

Replication Utilities  REPLMON is a Windows 2000 Resource Kit utility that you can use to

monitor replication traffic.  REPADMIN is a command-line utility that you use to diagnose

problems with replication.  Although DSASTAT is not geared specifically towards replication, it can

help diagnose replication problems that are based in naming context issues.

Understanding Time Synchronization  Time synchronization is important to ensuring that updates to Active

Directory are applied in the order that they were actually executed.  Conflicts in replicated updates are evaluated based on the version

number of the attribute, the timestamp, and the GUID of the Directory Service Agent where the change was made.  The W32TIME service runs time synchronization on all Windows 2000

Servers.

www.syngress.com

Implementing Sites • Chapter 11

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: I would like to test three different site topologies on a production network. Can I do this, or must I select one and stay with it?

A: Sites easily are created and changed as needed.They were developed that way to incorporate growth and change within an organization.Therefore, any number of site topologies can be tested before selecting the optimal version. This, however, does not apply to a domain structure, since domains cannot be merged, split, or easily deleted.

Q: We have three sites—site A is in Phoenix, site B is in Mexico City, and site C is in Vancouver. Both Mexico City and Vancouver have WAN links to Phoenix. Since there is no network connection between Mexico City and Vancouver, how do we enable replication between those two sites?

A: This can be enabled by a Site Link Bridge. A Site Link Bridge is generated by connecting at least two Site Links that have at least one site in common. It duplicates a multihop routing system for the replication traffic.

Q: We want to limit the number of servers that can send replication traffic between two sites. Can we?

A: Yes. Designate each of the servers that is allowed to transmit replication traffic as a bridgehead server.

Q: We do not want to use the automatically generated intrasite replication topology. Can we delete and create some different connection objects without the KCC reconfiguring them later?

A: Yes.The KCC will not change or delete any connection objects that were created manually by an Administrator.To reduce the cost of administration for replication, use the KCC-generated site topology.Whenever a manually generated connection object is created, an Administrator would be required to

www.syngress.com

367

368

Chapter 11 • Implementing Sites

analyze each change to the site’s configuration (such as a new DC) and make appropriate changes to the connection objects.

Q: We would like to use a third-party time service that is SNTP-compliant. Is this possible?

A: Yes, an SNTP-compliant time source can be used as the primary time server with the W32Time service.

Q: How can you filter group policy for a group of users that exists in an organizational unit (OU) with other users so only the first group receives the group policy and the rest do not?

A: When you want to apply a group policy object to a group of users that exists within an OU and it is not feasible to move that group into its own OU, you can rely on applying rights to filter the group policy.To filter a group policy for a select group, edit the properties of the group policy object. Click the Security tab, then remove the Authenticated Users group from the ACL. Add the selected group and make sure to grant the Read and Apply Group Policy rights.This will provide an effective filter.

Q: Where are my group policy objects? They don’t appear as objects within their applied containers?

A: Group policy objects are stored in two places: in the GPT folder below SYSVOL on each replicated DC’s hard drive, and within the System\Policies container in Active Directory.The System container is not available by default in the Active Directory Users and Computers console.To view the System container and the Policies subcontainer, you can select Advanced Features from the View menu of the Active Directory Users and Computers console.

www.syngress.com

Chapter 12

Implementing Active Directory: A Case Study

Solutions in this chapter: ■

Implementing DNS

■

Implementing the First Domain Controller

■

Establishing the OUs

■

Setting Up Sites

 Summary  Solutions Fast Track  Frequently Asked Questions

369

370

Chapter 12 • Implementing Active Directory: A Case Study

Introduction Having a design and a plan for Active Directory and implementing it are two different types of skills. Designing requires you to be creative and imagine the future state of your network environment with Active Directory in it. Implementing that design requires you to be familiar with the Windows 2000 interface, and be able to execute commands that configure Active Directory to function as you wish. In this chapter, you will be provided with an exemplary organization’s Active Directory design, and then will walk through its implementation.

Case Study Overview TravelToppers, Inc. is a travel agency.With the impact of the Internet, TravelToppers has added travel insurance, traveler’s checks, credit cards, and an online travel community service to its service offerings to maintain a competitive advantage.TravelToppers has the following business objectives for its Active Directory project: ■

To increase the revenue from the online travel community, a directory service is required for handling online logons to subscription services.

■

Currently multiple network operating systems (NOS) are used by the different business units.To reduce costs, a single NOS is required, and all systems should be streamlined.

■

Business partners have asked that integration with travel providers, airlines, hotels, and frequent flyer programs be increased by exchanging user logon information to connect databases.This type of integration will reduce costs for both TravelToppers and their partners.

Forest Plan TravelToppers has planned for a single forest that will incorporate domains for the Internet as well as production domains.This is in response to the need to streamline the network.The root domain of the forest is travel.local. Figure 12.1 shows the forest plan.

DNS and Domain Plan TravelToppers’ DNS namespace is planned using travel.local as the root namespace for a domain tree used specifically for production domains. A lab uses the name lab.local. In addition,TravelToppers has two Internet domain names: one for the www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

online community, named traveltoppers.com, and another for the credit card company called toppercredit.com, which will not be incorporated in the forest. The Internet domain name for the insurance subsidiary is ins.traveltoppers.com, and for the traveler’s checks subsidiary is checks.traveltoppers.com. Partners have their own domain in partner.traveltoppers.com.The domain plan appears as shown in Figure 12.2. Figure 12.1 TravelToppers’ Forest Plan

travel.local

travel.local Forest

Figure 12.2 Domain Plan

travel.local traveltoppers.com

ins.traveltoppers.com

checks.traveltoppers.com

lab.local

partners.traveltoppers.com

In order to keep with the streamlined systems business objective, all DNS servers will be Windows 2000 DNS servers.Traveltoppers uses a Webhosting company for all the traveltoppers.com domain tree domains.The lab.local and www.syngress.com

371

372

Chapter 12 • Implementing Active Directory: A Case Study

travel.local domains are located on the production network.The DNS plan is to create a zone for the entire traveltoppers.com namespace, including subdomains, placing two DNS servers, one primary zone and a secondary zone on the Webhosting network, and a secondary zone on the TravelToppers production network.The lab.local domain will have a single DNS server running on a domain controller (DC) to test an Active Directory integrated zone.The traveltoppers .com domain name will be hosted on two DNS servers, one with a primary zone and the other with a secondary zone, as shown in Figure 12.3. Figure 12.3 DNS Servers and Zones AD Integrated DNS Server lab.local

Primary DNS Server travel.local

Secondary DNS Server travel.local

traveltoppers Network

Secondary DNS Server traveltoppers.com checks.traveltoppers.com ins.traveltoppers.com partner.traveltoppers.com Firewall

Secondary DNS Server traveltoppers.com checks.traveltoppers.com ins.traveltoppers.com partner.traveltoppers.com

Webhosting Company Primary DNS Server traveltoppers.com checks.traveltoppers.com ins.traveltoppers.com partner.traveltoppers.com

www.syngress.com

Internet

Implementing Active Directory: A Case Study • Chapter 12

Organizational Units The Webhosting company is responsible for designing the organizational units (OUs) for the domains within the traveltoppers.com domain tree.The following OU design is intended for the travel.local domain. TravelToppers has a centralized administrative staff, so they have created two top-level OUs, one for the network and the other for the administrative staff and their own computers.There is no need for any hidden OUs.The next level of OUs below the main network OU is split into three to represent three main business units: Human Resources,Travel, and Accounting.The Travel OU has four nested OUs to represent the four types of users in that group: Managers, Clerical,Travel Agents, and Telecommuters. Each of these users will receive a different group policy. Figure 12.4 illustrates the OU configuration. Figure 12.4 OU Plan travel.local

Admins

AllNet Policy

AllNet

HR

Account

HR Policy

Accounting Policy

Travel

Managers

Clerical

Telecommute

Agents

Mgr Policy

Clerical Policy

Telecom Policy

Agent Policy

Site Topology Plan Because TravelToppers uses a Webhosting company for its Internet domains, there must be a site that represents the Webhosting company. In addition,TravelToppers

www.syngress.com

373

374

Chapter 12 • Implementing Active Directory: A Case Study

has two major locations with more than 500 users each. One is headquarters in New York, and the other is the London office in England. All other locations are small offices of no more than five people each with dial-up communications and no servers.They all dial in to the TravelToppers headquarters. All sites are connected to the same WAN provider network, and can participate in a single site link. Figure 12.5 depicts the resulting site topology. Figure 12.5 Site Topology London

Site Link

Webhost

HQ

Table 12.1 lists the server placements in each of the sites. Table 12.1 Site and Server Placement Site

Server Name

Server Type

Services

Webhost Webhost

DC1.traveltoppers.com DC2.traveltoppers.com

Domain controller Domain controller

Webhost Webhost Webhost Webhost

DC3.partner.traveltoppers.com DC4.partner.traveltoppers.com DC5.ins.traveltoppers.com DC6.ins.traveltoppers.com

Domain Domain Domain Domain

DNS Global catalog DNS

controller controller controller controller

IIS Continued

www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

Table 12.1 Continued Site

Server Name

Server Type

Services

Webhost

DC7.check.traveltoppers.com

Domain controller

Global catalog

Webhost HQ HQ

DC8.check.traveltoppers.com DNS1.travel.local DC9.travel.local

Domain controller Server Domain controller

HQ

DC10.travel.local

Domain controller

London

DC11.travel.local

Domain controller

London

DC12.travel.local

Domain controller

DNS Global catalog FSMO roles DNS Global catalog Global catalog DNS

Implementing DNS Unlike a design plan, you do not attempt implementation of a forest before implementing a domain. It’s actually the opposite: you must establish your DNS zones, build a domain, configure your OUs and sites, and then build domain trees. Before you know it, you have a complete forest. In the TravelToppers network, the DNS implementation begins with migrating from the existing DNS servers to the future DNS servers.The fact that TravelToppers uses a Webhosting company changes the standard processes that a company would follow.TravelToppers must ensure that their own DNS infrastructure will mesh with that of the Webhosting company. In this case, the Webhosting company uses a form of DNS that is incompatible with Active Directory.The migration process for the Webhosting company is to move the existing DNS zone containing the traveltoppers.com, ins.traveltoppers.com, check.traveltoppers.com, and partner.traveltoppers.com DNS names to the new DCs being installed.The following process is used: 1. The zone is cleaned up, so that it includes only active records for the Web servers running the traveltoppers.com and subdomains’Web sites. 2. The Webhosting company installs a Windows 2000 member server with the name DC1.traveltoppers.com. www.syngress.com

375

376

Chapter 12 • Implementing Active Directory: A Case Study

3. This server is configured as a DNS server and secondary to an existing zone on the Webhosting company’s DNS server. 4. A zone transfer is executed to copy the contents of the zone to DC1.traveltoppers.com. 5. DC1.traveltoppers.com is reconfigured to become primary for the zone. 6. The zone is removed from the Webhosting company’s DNS server. 7. DC1.traveltoppers.com is configured to use the Webhosting company’s DNS server for forwarding, and to enable dynamic updates on the zone. 8. DC3.partner.traveltoppers.com is installed as a member server and configured as a DNS server secondary to the zone. 9. A zone transfer is executed to copy the contents of the zone to DC3.partner.traveltoppers.com, and the server is configured with the appropriate forwarders. This is not the only DNS server for the TravelToppers network.There are two servers for the production network, with a secondary zone for the traveltoppers.com domain, and a DNS server for the lab.The lab intends to test Active Directory integrated zones; therefore, it must install and configure DNS on a Windows 2000 server and then promote that same server to a DC.The following tasks establish the production DNS servers for the travel.local domain: 1. A Windows 2000 member server is installed and named DNS1.travel .local. 2. DNS1.travel.local is configured as a DNS server with a secondary zone for the traveltoppers.com zone. 3. DNS1.travel.local is also configured with a primary zone for travel.local. The travel.local domain is new to the network and has no records. 4. The new zone is configured to use dynamic updates, and the server is configured with forwarders to the Webhosting company’s DNS servers. 5. Another Windows 2000 member server is installed named DC10.travel .local. 6. This server is configured with a secondary zone for the travel.local zone, along with the appropriate forwarder. 7. In the lab, a Windows 2000 server is installed, and configured as a DNS server for the lab.local domain.This zone is configured with dynamic updates.The lab does not use any DNS forwarders. www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

Implementing the First Domain Controller Since the travel.local domain is the root of the forest, it must be the first domain installed in the forest. An existing Windows NT domain includes all the TravelToppers end users.The first thing that must be done is to upgrade the Windows NT primary domain controller (PDC). A problem exists, however, because the PDC does not have compatible hardware for Windows 2000. TravelToppers decides to use new hardware for the server that will become DC9.travel.local.They consider some different options for migrating the domain: ■

Install a new Windows 2000 DC and use a migration tool to migrate the users and computers.

■

Promote a BDC with compatible hardware to PDC, and then upgrade the new PDC. After bringing the new DC9.travel.local DC up, capture the FSMO roles and take the first DC off the network.

■

Install DC9.travel.local as a Windows NT 4.0 BDC, and then promote it to PDC. Upgrade it to a Windows 2000 DC.

Migrating The first option in the list is migration. If TravelToppers elected to use this method for their first DC, they would need to select a migration tool, such as the Active Directory Migration Tool (ADMT), or a third-party migration tool from the many offered by FastLane, a subsidiary of Quest Software, NetIQ, Mission Critical, and others.The advantage of using a migration tool is that user and computer objects in multiple domains can be merged into a single domain or split into multiple domains. Another advantage of using a migration tool is that TravelTopppers retains security identifier (SID) information as it relates to the users’ former access control lists (ACLs).They would also need to follow this procedure: 1. Install a new Windows 2000 server on the new server hardware. 2. Configure the server as a DNS client to DNS1.travel.local. 3. Promote the server to a domain controller, selecting a new domain, a new domain tree, and new forest. Provide the DNS name as DC9.travel.local, and NetBIOS name of DC9. 4. Update the server with Windows 2000’s latest service pack. www.syngress.com

377

378

Chapter 12 • Implementing Active Directory: A Case Study

5. Build the OUs on the server so that migration can place user and computer accounts in their final locations. 6. Obtain a computer to use as a management console, making certain that it has the correct operating system required by the migration tool. Install the migration tool on this computer. 7. Depending on the tool selected, there may be a need to create a trust relationship between the new travel.local domain and the legacy TRAVEL domain.The trust relationship is a unidirectional, nontransitive trust. 8. The console computer must be able to communicate with both the new Windows 2000 DC and the legacy domain’s PDC. 9. TravelToppers must back up the information on the legacy domain’s PDC and BDCs. 10. At this point, they can start the tool on the console computer.They can connect to the legacy domain and select the user and computer accounts to migrate.They also can connect to the target Windows 2000 domain and select the location of the OU to which the accounts will be migrated.They can test the migration process, if the tool offers a migration testing capability. 11. Finally, the TravelToppers group can execute the migration process.

Upgrading Of the two upgrade options,TravelToppers decides to use the two-step upgrade process for new server hardware. Using an inplace upgrade method,TravelToppers cannot expect to merge their domain with another domain during the process or split it into multiple domains. However, they can use a migration tool to do these things at a later time.TravelToppers determines that an inplace upgrade is the least risky process to use, ensuring an accurate migration of user and computer accounts to the new Windows 2000 domain, and with less processes to follow (no need to capture FSMO roles or retire a DC from the domain).They take the following steps: 1. Install Windows NT 4.0 on the new server hardware as a BDC for the existing TRAVEL domain. 2. Update the Windows NT 4.0 BDC with the latest service pack. 3. Promote the BDC to a PDC.

www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

4. Configure the new PDC as a DNS client to the DNS1.travel.local server. 5. Synchronize the entire domain. 6. Take one of the existing BDCs offline to be used as a recovery server in case of problems. 7. Back up the new PDC and all other servers and BDCs in the domain. 8. Upgrade the new PDC to Windows 2000, which automatically kicks off Dcpromo because it is a domain controller being upgraded. 9. In Dcpromo, the installer selects to install a new domain, and that the new domain will be the top of a domain tree in a new forest.The name of the new DC is DC9.travel.local, and the NetBIOS name is DC9. 10. Update the latest Windows 2000 service pack on DC9.travel.local. Since the first DC in the forest is automatically enabled as a GC server and granted each of the FSMO roles, no further configuration is required. Note that the first DC in the forest is the only DC that is ever automatically enabled as a GC server.

Adding New Domains Once the first DC in the forest is installed, the migration plan should install or migrate existing domains following the namespace trees. For example, traveltoppers.com must be installed into the forest after the root domain (travel.local), but before its partner.traveltoppers.com subdomain. Peer domains can be installed in whatever order is desired; for example, it does not matter whether traveltoppers.com is installed before lab.local. While TravelToppers had an existing Windows NT domain in its production network, it did not use a Windows NT domain for its Web site servers.While the DNS domain name existed and Web servers were running the various traveltoppers.com and subdomain Web sites, there were no Windows NT domains.This means that each of those domains will require a fresh installation. Whenever someone installs a DC into any domain in the forest, even if the domain has never existed before, the installer must have the name and password of a user account with Enterprise Administrator privileges.TravelToppers decides to migrate or install the remaining travel.local domain controllers in the following order:

www.syngress.com

379

380

Chapter 12 • Implementing Active Directory: A Case Study

1. The DNS server DC10.travel.local is promoted to a DC using the Dcpromo program. During the promotion, it is added as a domain controller to an existing domain, travel.local. 2. DC10 is also enabled as a GC server. 3. All remaining BDCs in the headquarters office are taken offline and removed from the domain. 4. The two remaining TRAVEL domain BDCs exist in the London office. Each is upgraded to Windows 2000.The installation automatically kicks off Dcpromo to add these as DCs to the travel.local domain with the names DC11.travel.local and DC12.travel.local. 5. After upgrading these two DCs, the latest Windows 2000 service pack is installed. 6. DC11.travel.local is enabled as a GC server. 7. DC12.travel.local is configured as a DNS server with a secondary zone for travel.local and appropriate forwarders. New servers are used for the traveltoppers.com domain and all subdomains. Since new servers are used, and there are no existing users to upgrade or migrate into the domains,TravelToppers has a simple course of action: 1. DC1.traveltoppers.com is already installed as a DNS server and is updated to the latest service pack, so the only thing left to do is to run Dcpromo to create a new domain with the traveltoppers.com name in a new domain tree, joining an existing forest with the travel.local domain at the root. 2. DC2.traveltoppers.com must be installed as a new Windows 2000 server. Then, the server must be promoted to a DC using Dcpromo, to join an existing domain—traveltoppers.com. DC2.traveltoppers.com must then be updated with the latest service pack, and configured to be a GC server. 3. DC3.partner.traveltoppers.com is already installed as a DNS server and is updated to the latest service pack.Therefore, we simply need to run Dcpromo to create a new domain, partner.traveltoppers.com, which is part of an existing domain tree (traveltoppers.com) in an existing forest. 4. DC4.partner.traveltoppers.com must be installed as a new Windows 2000 server.The server is then promoted to a DC using Dcpromo to

www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

join an existing domain, partner.traveltoppers.com. DC4.partner.traveltoppers.com must then be updated with the latest service pack. 5. DC5.ins.traveltoppers.com is unique because the Webhosting company is going to use it to provide Web services.The server must be installed with Windows 2000, making certain that Internet Information Services (IIS) is installed (even though it is installed by default).Then the server is promoted with Dcpromo to be a new domain (ins.traveltoppers.com) in an existing domain tree (traveltoppers.com) and an existing forest. DC5.ins.traveltoppers.com must then be updated with the latest Windows 2000 service pack. 6. DC6.ins.traveltoppers.com must be installed as a new Windows 2000 server.Then it must be promoted to a DC using Dcpromo, to join an existing domain (ins.traveltoppers.com) in an existing forest. Afterward, DC6.ins.traveltoppers.com must be updated to the latest service pack. 7. DC7.check.traveltoppers.com must be installed as a new Windows 2000 server and promoted with Dcpromo to a DC of a new domain (check.traveltoppers.com) in an existing domain tree (traveltoppers.com) in an existing forest (travel.local).Then, DC7.check.traveltoppers.com must be enabled as a GC server and updated with the latest Windows 2000 service pack. 8. DC8.check.traveltoppers.com must be installed as a new Windows 2000 server and promoted with Dcpromo to be a DC of an existing domain (check.traveltoppers.com).Then, DC8.check.traveltoppers.com must be updated with the latest service pack.

Creating an Explicit Trust Due to one of TravelToppers’ partners having its own forest and requiring access to domain resources, the partner.traveltoppers.com domain must trust the partner’s domain insuretravel.com. Although both domains are Windows 2000 domains, they exist in separate forests.This means that the domains must have a legacy, unidirectional, nontransitive trust between them. Since partner.traveltoppers.com is offering access to its resources to the users in insuretravel.com, the partner.traveltoppers.com is the trusting domain, and insuretravel.com is the trusted domain.The administrators in each domain must enable the trust at their own end using the Active Directory Domains and Trusts console.

www.syngress.com

381

382

Chapter 12 • Implementing Active Directory: A Case Study

Establishing the OUs The OU design applies to the travel.local domain.Therefore, the TravelToppers installation team must open the Active Directory Users and Computers console and point to the travel.local domain. Once in the console, the OUs can be created. To create the top-level OUs, the administrator must right-click on the travel.local object and select New | Organizational Unit from the pop-up menu. From there, the OU dialog requires a name.The first OU is created with the name Admins, and the next OU at the same level is created with the name AllNet. Since the next level of OUs are all below AllNet, the administrator must right-click on AllNet, select New | Organizational Unit from the pop-up menu, and then provide the name of one of its nested OUs, which are HR, Account, and Travel. After each of these OUs are created, the next level of OUs needs to be added—these are all placed below the Travel OU.Therefore, the Travel OU must be right-clicked for each of its sub-OUs and New | Organizational Unit selected from the pop-up menu, and then a name applied for each of the OUs—Manager, Clerical,Telecommute, and Agents. This progression of tasks creates a set of empty nested OUs.The next task is to move the users who were upgraded, create any new users, and move the computer objects into the OU hierarchy.

Moving Upgraded Users When the PDC was promoted, the contents of the Security Account Manager (SAM) were placed in the Active Directory. By default, the user accounts are placed in a container called “Users.”The Users container is not an OU.You cannot apply group policies to it, and you cannot create nested OUs within it. It is intended to be a temporary location for upgraded objects until you can move them. When you use a migration tool, you may not need to migrate user accounts. Most migration tools allow you to select existing OUs to place migrated accounts, and some even let you create OUs as part of the migration. Organization is key to selecting and moving upgraded user accounts to their appropriate OU destinations.The SAM uses a flat file, so they will all be lumped together.You will need to know which users belong in which OUs before you begin.Then, the best method is probably to select each user account individually, determine its destination OU, and then move it. To move a user account, right-click it and select Move from the pop-up menu. Then, choose the destination OU from the dialog. In the Travel.local domain, it

www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

may be easiest to select and move the administrative accounts into the Admins OU. Then, with those accounts filtered out, the remaining users can be moved.

Creating New Users While you should have existing accounts for all your users when you start, you may need to create new user accounts.TravelToppers outsourced their Help Desk.The provider did not have access to the TravelToppers network because the administrative staff did not want to have additional administrative-level user accounts. After creating the Active Directory,TravelToppers can now add the Help Desk staff as user accounts, and then delegate the ability to change passwords. To create user accounts, they use the Active Directory Users and Computers console.They create the User objects in the AllNet OU by right-clicking on AllNet and selecting New | User from the pop-up menu. For each Help Desk associate, they input the user’s name and the logon ID, and then click OK to create the account. After creating new users for the Help Desk staff,TravelToppers creates a Help Desk Domain Local group, which is a Security group type.This is also done in the Active Directory Users and Computers console by right-clicking on AllNet and selecting New | Group from the pop-up menu. From there, the group is given a name (HelpDesk) and both group types (Security) and scope (Domain Local). To complete this process,TravelToppers runs the Delegation of Administration Wizard for the AllNet OU, and grants the rights of password administrators to the HelpDesk group.TravelToppers then only needs to add users to the HelpDesk group whenever staff members change at the Help Desk.

Adding Computer Objects With the upgrade of the PDC, the existing computer objects are automatically migrated to the Computers container.These objects should be moved to their appropriate destination OU. Given that many organizations implement a desktop migration, even a partial one, at the same time as a server upgrade, there will likely be a need early on for new computer objects. In order for a workstation to start up and use Active Directory group policies, it must exist as a member of the Active Directory forest, domain, and, for an OU-applied group policy, as a member of the OU or the hierarchy below that OU. (Local policies apply to any computer on which they are created, but are not shared among multiple computers as group policies are.) www.syngress.com

383

384

Chapter 12 • Implementing Active Directory: A Case Study

When a workstation is installed, it cannot join Active Directory without the installing user being granted the specific rights to add computer objects to the domain. However, if the object is created in the domain prior to installation, there is no problem with the workstation joining the domain as a member. To create a computer object in the domain, right-click on the destination OU and select New | Computer from the pop-up menu.Then, give the computer object a name. Names have a 14-character limitation for computer objects. An optional method for creating a computer object is to use a utility such as NETDOM.This utility can create a computer account using the command line, and is therefore very handy if you want to script an installation of a workstation and automatically join it to a destination domain. Even using NETDOM, there needs to be a user account with a password that has been delegated the right to join computer objects to the domain.

Setting Up Sites Whenever Dcpromo is executed to promote a Windows 2000 server to a DC, a Server object representing the new DC is created in Active Directory—and appears in the Active Directory Sites and Services MMC.The Server object is not the same as the Computer object, which is also created in Active Directory.The Computer object is a security principal, and the Server object refers to the Computer object. The Server object is contained within a site. In the case of a newly installed DC in a newly installed forest, this site is always Default-First-Site-Name.When Dcpromo runs, it checks to see if a site exists that contains the new server’s IP subnet. If the IP subnet exists in a site, the Server object is automatically placed in that site. If there is no IP subnet, then the Server object is placed in the default site. In order for sites to actually localize traffic geographically, and optimize Active Directory communications, the Server objects must be in their correct sites.This means that anytime a server is not in its correct site, you must move it. TravelToppers could have created all of its sites, site links, site link bridges, IP subnets and even manually created Connection objects as soon as the first DC was installed. If they had done so, the remaining DCs would have automatically populated their correct sites. However,TravelToppers installed all of its DCs prior to setting up the site topology. Until the sites are created, all the DCs for each domain exist in the Default-First-Site-Name. Replication traffic occurs between them every 15 minutes, regardless of where they are located. In addition, when a user logs on to the www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

domain or executes a query, any one of the GC servers may respond.This is not optimal. For TravelToppers to move its DCs to the correct sites, they must first create the sites.To do this, they use the Active Directory Sites and Services console. They right-click the Sites container, select New | Site and give the site a name, select the DefaultIPSiteLink and then click OK to create the site.TravelToppers uses this technique to create each of the following three sites: ■

HQ

■

London

■

Webhost

The next step is to create the IP subnets and assign them to sites.The Webhosting company has dedicated a single IP subnet to all of the TravelToppers servers. One of the servers on this subnet is at 199.5.26.2 with a subnet mask of 255.255.255.240.To create the IP subnet, they simply open the Active Directory Sites and Services console, navigate to the IP Subnets node, and right-click it.They select New | IP Subnet and input the IP address and subnet above, and then select a site to place the subnet in. In this case, the site is Webhost.TravelToppers repeats this same process for all the subnets in HQ and in London. TravelToppers then moves the DCs to their appropriate sites.They expand Default-First-Site-Name in the Active Directory Sites and Services console, and then expand its child container Servers, to see the Server objects for the DCs. They can then right-click on one server, DC1.traveltoppers.com , and select Move from the pop-up menu.They move DC1.traveltoppers.com to the Webhost site.This task must be repeated for each DC until all have been moved to their true sites. The site link is next on the list of items to be created. However, TravelToppers does not need to create a new site link.TravelToppers’ site topology only requires a single site link to connect all the sites. Since all the sites already use DefaultIPSiteLink, it can continue to be used as is.They may want to rename it, by right-clicking it and selecting Rename from the pop-up menu, but this is not necessary.They can also change the schedule of availability of the link, frequency of replication and cost, so that the Knowledge Consistency Checker (KCC) can institute Connection objects that will optimize replication across the site link.

www.syngress.com

385

386

Chapter 12 • Implementing Active Directory: A Case Study

Summary The implementation of an Active Directory forest is guided by the business objectives and design for its various parts. Since not every challenge can be anticipated, you may need to make decisions that affect your project’s plan. However, these decisions will rarely change your actual design. Instead, they affect the types of tasks you may execute or the order in which you do them. One of the decisions you need to make during implementation is whether to upgrade or migrate existing domains to the new domain design.You will also run into situations where you are asked to do something new for your organization, such as create a trust relationship with a partner’s domain, which you had not done with your prior network.The new technology will open up new opportunities, and you should be prepared for a few “firsts”during your implementation. Your implementation will begin with establishing the Domain Name System (DNS) servers. After that, you will install the first domain controller (DC) in the root domain of your forest.This may be a new domain, or an upgraded one from a legacy Windows NT domain.Your next step is to add all the remaining DCs to that domain, and then begin adding or upgrading domains into the forest, one DC at a time. Once the DCs have been installed, you can begin creating the OU hierarchy in each domain.You will then move user accounts and computer objects into the new hierarchy. Site creation can be performed as soon as the first DC is installed, or after the entire forest of domains is ready. If sites are created after the DCs are installed, then the DCs’ associated Server objects must be moved to the correct sites. Once the DCs are placed in their correct sites, Active Directory traffic is optimized.

Solutions Fast Track Implementing DNS  Before installing the first domain controller in the forest, you should

install any DNS servers and create the zones that will be used by Active Directory.  If a DNS server is not compatible with Active Directory, a replacement

DNS server or an upgrade to the DNS server software must be used. An

www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

incompatible DNS server can still be used as a forwarder, or for parent zones.  You cannot create an Active Directory integrated zone unless the DNS

server is also a DC.

Implementing the First Domain Controller  Even when intending to use the same set of user objects, you can choose

between using a migration method or upgrading the domain.  When upgrading a Windows NT domain to Active Directory, you must

start with the PDC.  You can install entirely new domains as subdomains of any domain in

Active Directory.These should mirror your domain plan for your forest.  If you need to access resources that exist outside the forest, you must

create an explicit trust between the domain in your forest and the domain outside the forest, so that users can access resources.

Establishing the OUs  You create OUs in the Active Directory Users and Computers console,

by right-clicking on the parent object, whether that is the domain object or a parent OU, and selecting New | Organizational Unit from the pop-up menu.  Migration utilities, such as the Active Directory Migration Tool

(ADMT), can create new OUs as part of the process of migrating users from a legacy domain to a Windows 2000 Active Directory domain.  The Users container is not an OU, but a holder for upgraded user

accounts.

Setting Up Sites  If you create sites, site links, site link bridges, and IP subnets immediately

following the installation of the first DC, the DCs that follow should automatically populate the site that contains their own IP subnet.

www.syngress.com

387

388

Chapter 12 • Implementing Active Directory: A Case Study

 If Dcpromo does not detect a site with the new DC’s IP subnet, it will

place the new DC in the default site.  You should establish the cost, frequency, and availability schedule for a

site link in order to fully optimize traffic across it.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: How do you keep people from installing new domains in your forest? A: You should be careful with the user accounts that exist in your Enterprise Admins group. In addition, you might want to create a special user account for installers that is disabled except when you expect to have a new DC installed.

Q: We are upgrading an existing domain and wonder if we should bother with the ADMT tool.What method is best?

A: Upgrades are sometimes more difficult than creating new servers from scratch. If you install a fresh server, you don’t have any worries about any inherited defects from past applications that were installed, legacy registry keys, and so forth. Looking at it from that perspective, the migration is probably a better method. On the other hand, if all you need to do is upgrade your existing domains to Active Directory without any other changes, the upgrade method is simplest.

Q: I’ve tried to upgrade a server in my Windows NT domain, and while Windows 2000 is running fine on it, I can’t get Dcpromo to promote it to a DC. I get an error that states that my domain is not an Active Directory domain.What should I do?

www.syngress.com

Implementing Active Directory: A Case Study • Chapter 12

A: You need to upgrade the PDC first. If you try to upgrade a BDC or a member server to Windows 2000 while the PDC remains a Windows NT machine, then you will receive this error when running Dcpromo.

Q: Can you use the upgrade process to merge or split domains? I’d like to pull half the users from one domain and put them into another.

A: No, you cannot do this during the upgrade.You can use a migration utility to do so either before or after you upgrade the domain.

Q: Which console is used for creating OUs and sites? A: Actually, there are two consoles that you will use, because these are two different processes.You will create OUs in the Active Directory Users and Computers console, which is also where you will create users and computer objects.You will create sites in the Active Directory Sites and Services console.

www.syngress.com

389

Part IV

Managing Active Directory

Chapter 13

Intellimirror

Solutions in this chapter: ■

What Are Group Policies?

■

Group Policy Information Storage and Settings

■

Designing a Group Policy Strategy

■

Implementing a Group Policy Strategy

■

Deploying Applications with Group Policies

■

Understanding Security

 Summary  Solutions Fast Track  Frequently Asked Questions 393

394

Chapter 13 • Intellimirror

Introduction When Microsoft released Windows 95 in August 1995, a new feature called system policies introduced a slick new way to manage Windows 95 computers and their users across a network.This functionality was included in Windows NT 4.0 when it was released later. Now, for Windows 2000, system policies have grown up to become group policies in Active Directory. Intellimirror is a Windows 2000 feature that is enabled by Active Directory using group policies.When Intellimirror is implemented, a user’s environment, even his or her personal documents, can intelligently follow the user around the network. If there is no other reason to implement Active Directory, then do it for the group policies.This is one of the most functional components of Active Directory for administrators, making user and computer settings easier to manage. Group policies are a constantly evolving administrative system.They can be used for managing computers and the end-users’ environments.You can even use them to deploy software to client workstations.This means that group policies are an effective configuration management tool. If an organization intends to use group policies to manage workstations and users on an enterprisewide basis, Windows 2000 domain controllers (DCs) should be installed and configured before creating the group policies—especially if you use group policies for installing or upgrading client workstations. In order to use the group policies attached to organizational units (OUs), domains, or sites, Active Directory must be functional. Otherwise, only local group policies can be used.

What Are Group Policies? Group policies are rules that a network administrator sets for users and/or computers on the network. Rather than a single flat file located in a file-based directory, group policies take advantage of Active Directory’s distributed database.The result is a managed user environment and desktop configuration. Group policies are stored as Group Policy Objects (GPOs) within Active Directory.The GPOs are associated with Active Directory containers, such as OUs, domains, and sites.The settings in a GPO are inherited by child containers of the container with which it is associated. For example, a user will receive the group policy settings in all the policies leading from his or her current OU up to the top-level group policy through inheritance, as shown in Figure 13.1. Multiple GPOs can be associated with the same container as well.The depth of a user’s www.syngress.com

Intellimirror • Chapter 13

location in the OU hierarchy does not affect the length of time it takes to log on. Instead, it is the number of GPOs that must be read and applied. If there is a single group policy for each OU, and a user is located five OUs deep, it will take the same amount of time for the user to log on if the user is in a top-level container that has five GPOs associated with it. Figure 13.1 Inheritance of Group Policy Objects Domain.com

DOMAIN Group Policy OU1

OUa

Amy

Amy receives Domain Group Policy and OUa Group Policy

OUa Group Policy OU2

OU2 Group Policy

OUb

OUc

Matt

Brian

Matt receives Domain Group Policy and OU2 Group Policy

Brian receives Domain Group Policy and OU2 Group Policy and OUc Group Policy

OUc Group Policy

The group policy itself is contained within a GPO in Active Directory.You can use Windows Installer to install the Adminpak.msi file from the Windows www.syngress.com

395

396

Chapter 13 • Intellimirror

2000 Server CD. Adminpak.msi provides administrators the ability to run the server administration tools from a Windows 2000 Professional workstation, rather than from a server. If you are not in front of a management console with the tools installed, but you are running Terminal Services on your servers, you also have the option of connecting a Terminal Services session and running the administrative tools remotely.The object is created in the Group Policy editor, which can be launched in three different ways: 1. From the Active Directory Users and Computers console, from the Group Policy tab on Domain and OU objects 2. From the Active Directory Sites and Services console, from the Group Policy tab on Site objects 3. As a separate management console using MMC and opening the Group Policy Editor snap-in (gpedit.msc) The Group Policy editor is shown in Figure 13.2, looking at a local policy object. Figure 13.2 Group Policy Editor

There are four containers to which group policies might be applied: ■

Local Group Policy The Local GPO exists on each Windows 2000 computer. It contains, by default, only policies regarding security.The policy is located in the %systemroot%\system32\GroupPolicy directory.

www.syngress.com

Intellimirror • Chapter 13 ■

Site Group Policy Site GPOs are linked to Site objects and can affect any object across the entire forest, since sites can span domains. Siteattached GPOs can cause unintended traffic and troubleshooting problems; therefore, it is not recommended to use Site group policy.

■

Domain Group Policy Domain GPOs are linked to a single domain and affect all user and computer objects within the domain.

■

Organizational Unit (OU) Group Policy OU GPOs are linked to a specific OU.The OU group policy will affect all objects within the OU and within any OUs nested below it in the hierarchy.

Local group policies are more difficult to manage than Active Directoryrelated group policies. Because Local group policies are machine specific, they cannot be used or managed easily across an enterprise network.

How Group Policies Are Applied When a computer boots into Active Directory, it grabs the settings in the Computer Configuration of its associated GPOs and applies them.When a user logs on, the settings in the User Configuration portion of the group policy are applied to the user’s environment. No other Active Directory objects receive group policies. Computer and user configurations are discussed in further detail later in this chapter. The order of policy application begins with legacy NT4 system policies, if any exist. If they do not, the order is: 1. Local GPO 2. Site GPO 3. Domain GPOs 4. Organizational Unit GPOs from the parent OUs down to the user’s or computer’s OU location

Refresh Interval Both the user and computer configuration settings include options for refreshing group policies.The interval can be set for 0 to 45 days. Zero essentially establishes a constant dialog from the client computer to a domain controller every seven seconds to determine whether updates to group policies have been made. Obviously, this setting can affect network bandwidth utilization.The default setting for the refresh intervals is every 90 minutes. www.syngress.com

397

398

Chapter 13 • Intellimirror

To change the refresh intervals for the computer, within the Group Policy editor, expand the Computer Configuration container, then the Administrative Templates, then System, and finally click on Group Policy in the left-hand pane. In the right-hand pane, double-click on the Global Policy Refresh Interval and establish the interval.The navigation is essentially the same for the User Refresh Interval, except that the first container to expand is User Configuration, and the item to double-click is the Global Policy Refresh Interval for Users.

Configuring & Implementing… Software Developers and Group Policy One of the ways that software developers can integrate applications into Active Directory is to take advantage of group policy features. APIs have been created to enable an application to lock sections of the registry in order to apply changes and ensure that group policies do not interrupt the process. A RefreshPolicy API enables the application to request a Group Policy Refresh. When an application integrates group policies, it may require notification that the group policies have been applied. Group policies create a message and log an event when they are applied, so an application can read the event to be assured that the policy was applied.

Blocking and Enforcing A group policy that can be inherited from a higher level can be blocked, so that it does not pass further down the hierarchy.To block a policy: 1. Right-click on the site, the domain, or the OU, and select Properties. 2. Click on the Group Policy tab. 3. Check the box at the bottom of the dialog that states Block Inheritance as illustrated in Figure 13.3. If there are conflicts between a policy setting in two different GPOs, the last GPO will override the setting applied previously.You can stop a policy from being blocked or overridden.To enforce a policy:

www.syngress.com

Intellimirror • Chapter 13

1. Right-click on the site, the domain, or the OU, and select Properties. 2. Click on the Group Policy tab. 3. Click the Options button. 4. Check the box for No Override, as depicted in Figure 13.4. Figure 13.3 Blocking Inheritance

Figure 13.4 Enforcing a Policy

As shown in Figure 13.4, a group policy can also be disabled.You should exercise this option when retiring a group policy. By disabling the policy, you still retain the option to reenable it later, should the need arise.

www.syngress.com

399

400

Chapter 13 • Intellimirror

Group Policy Information Storage and Settings GPOs store information into Active Directory and into a Group Policy Template (GPT). Active Directory storage is a Group Policy container that further contains subcontainers for user and computer information. The GPT is actually an entire folder structure stored in the SYSVOL of the Active Directory domain controllers.The GPT top-level folder is \Policies. Below that, each GPO is granted its own subfolder using its GUID (Globally Unique Identifier—a long, indecipherable string of numbers and characters) as the folder name. Below that is a GPT.INI file and further folders that are created whenever changes are made to the following: ■

Adm Additions of Administrative Templates files (.adm files).

■

Apps Application deployment files for Windows Installer advertisements (.aas files), appears as a subfolder of both User and Machine.

■

Files Contains files to be deployed to the client, appears as a subfolder of both User and Machine.

■

Machine Contains the registry.pol file for the computer configuration changes.

■

Scripts Contains all scripts for the entire group policy.

■

User Contains the registry.pol file for the user configuration changes.

Both Active Directory and the SYSVOL directory structure participate in Multi-Master replication.This ensures that the group policies are available anywhere within a global enterprise.

Administrative Templates The source settings for group policies can originate from an MMC extension, or, as is more commonly the case, an administrative template. Administrative templates consist of ASCII text files with the extension .adm.The files include the registry settings in a format of categories with subcategories.These appear to the user in a Group Policy Editor interface as a hierarchy of settings, some with default settings already selected.Windows 2000 Group Policy can use the .adm files described in Table 13.1, as well as others. It is not recommended that the legacy System Policy .adm files are loaded because they can result in persistent registry settings. Once an

www.syngress.com

Intellimirror • Chapter 13

.adm file is loaded, it can be found in the SYSVOL directory, ensuring that it will participate in Multi-Master replication as well as netlogon. Table 13.1 Administrative Templates Template

Installed by Policy Editor Default Function

System.adm

Group Policy

Default

Inetres.adm

Group Policy

Default

Winnt.adm

System Policy Not default

Windows.adm

System Policy Not default

Common.adm

System Policy Not default

Wmp.adm

Group Policy

Not default

Conf.adm

Group Policy

Not default

Shell.adm

Group Policy

Not default

This is the default administrative template and is used for Windows 2000 client workstations. This is an administrative template installed by default and is used to set Internet Explorer policies for Windows 2000 client workstations. This is a legacy system policy administrative template for Windows NT 4.0 clients This is a legacy system policy administrative template for Windows 95 and Windows 98 clients. This is a legacy system policy administrative template for the common interface items of Windows NT4, Windows 98, and Windows 95. This is a template for Windows Media Player. This is a template for NetMeeting This is a template for additional interface options under the User Configuration options.

You can create administrative templates to include registry settings that are not default selections. Software developers may include .adm files for their Windows 2000 applications. If an .adm file is included, you can take advantage of the template and establish settings for the users, and perhaps even deploy the software.

www.syngress.com

401

402

Chapter 13 • Intellimirror

To open an .adm file, start in the Group Policy editor. Expand the Computer Configuration or User Configuration container and right-click on the Administrative Templates container. Select Add/Remove templates from the pop-up menu, as shown in Figure 13.5. Click Add, and then select the .adm file that you wish to add from the dialog. If you click Remove, you can remove an .adm template. Finally, click Close. New options will appear immediately in the Group Policy editor. Figure 13.5 Adding an Administrative Template

Registry.pol While the Administrative Template files are the source for group policy settings, the actual resultant information that includes the settings you have set is saved as registry.pol files.The User settings are saved in the Policies\\ User\registry.pol file, and the Computer settings are saved in the Policies\ \Machine\registry.pol file.

Group Policy Settings There are two Settings containers in group policies: ■

Computer Configuration

■

User Configuration

www.syngress.com

Intellimirror • Chapter 13

The Computer Configuration policies can change registry settings within HKEY_LOCAL_MACHINE.The settings in the Computer Configuration policies are applied to a computer no matter who logs on to it. User Configuration policies can change registry settings within HKEY_CURRENT_USER.The User Configuration policies are applied to any computer that a user logs on to. Aside from assigning interface preferences, group policies can apply logon, logoff, startup, and shutdown scripts, distribute software, change security settings, and redirect system folder locations such as My Documents. Since the System.adm and Inetres.adm files are default templates, the following Computer and User Configuration sections discuss their default settings.

Computer Configuration The Computer Configuration settings stipulate operating system behavior. All options for the desktop, security settings, and even startup and shutdown scripts can be found in this area. Since the Computer Configuration settings are applied to a computer, regardless of who logs on to it, this policy is best applied to computers that require being locked down to protect local data or applications from being misused. The Computer Configuration portion of group policies includes a profusion of security settings, as shown in Figure 13.6.This is by design, since these policies are applied to individual computers. An example of a computer that can benefit from computer security policies would be a kiosk computer that is placed for public use.The kiosk needs to be secured, regardless of the user logged on, since anyone can log on.

User Configuration The User Configuration settings are similar to the Computer Configuration settings.These are user-specific settings that follow a user around a network wherever that user may log on. Many of these settings are similar in content to the Computer Configuration set, but there are many more settings for the interface in the User Configuration set, as shown in Figure 13.7.This enables the same interface to appear wherever a user may choose to log on, which is desirable especially for roving users. Scripts exhibit the reasons behind the selection of a setting to be placed under the computer configuration as opposed to the user configuration. Script settings for users are different from those for computers.Whereas a computer’s settings include startup and shutdown scripts, which run automatically for a computer regardless of

www.syngress.com

403

404

Chapter 13 • Intellimirror

whether anyone has logged on, the user settings include logon and logoff scripts. Logon and logoff scripts occur only when a user accesses the network. Figure 13.6 Computer Configuration Security Settings

Figure 13.7 User Configuration Interface Settings

www.syngress.com

Intellimirror • Chapter 13

Designing a Group Policy Strategy Group policies should be taken into consideration when designing an OU structure.The placement of machines and users in the OU structure will determine how many group policies are required, and the number of group policies affects the user’s experience of logging in. For example, FrigidMidgets is a small-sized refrigerator rental service that is located in seven cities with large universities across the United States.There is a sales group, a service group, and a collections group in the FrigidMidgets company. All of the sales group must have identically configured computer and security settings. If the network administrator designs an OU structure that places seven cities at the top, with three nested OUs for Sales, Service, and Collections in each of those seven top-layer OUs, then there will be seven identical group policies in each of the Sales containers, along with all the additional traffic to replicate those policies. However, if the network administrator designs three toplayer OUs for Sales, Service, and Collections, there will only be one group policy for the Sales OU, and a considerably more efficient system.This example demonstrates the primary rules for designing OUs with group policies in mind: ■

Group similarly configured computers in the same OU.

■

Group users with similar requirements in the same OU.

Designing & Planning… Restructuring Domains If you have designed your Active Directory domain structure to be completely different from your Windows NT domain structure, in effect, restructuring your domains, then you should complete your domain implementation before you apply group policies. This will enable you to apply group policies to users and computers without unexpected changes to the user’s environment or the computer’s configuration. The optimal process to follow is: 1. Plan your Active Directory design, including the forest, DNS and domains, OUs, and sites. 2. Upgrade and migrate domains, as meets your namespace trees. Continued

www.syngress.com

405

406

Chapter 13 • Intellimirror

3. Restructure domains by merging, migrating, and copying user and computer accounts. 4. Create an OU hierarchy in each domain. 5. Move users and computers to their new OU. 6. Create and test group policies to match your group policy design. 7. Apply the group policy to the OU, domain, or site that should be associated with the policy. 8. When creating a group policy, do not leave parts of the policy as “Not Configured.” Instead, disable them if you want to ensure that they will not be applied.

Additionally, the fewer settings that a group policy contains, the less time it will take to download and apply that group policy to a computer.Therefore, you should take care to only establish a group policy setting that is absolutely required.The sequence of events from the time a computer is booted to the time that the final user interface is applied is illustrated in the flow chart of Figure 13.8. Multi-Master replication pledges that information will be synchronized across the entire forest of domain controllers. However, in any Multi-Master replication system there exists the potential for conflicting Group Policy settings where one setting overrides another.This typically occurs when two different administrators make contradictory modifications to the same group policy, or make a change to a lower-level group policy setting that overrides a parent group policy setting.To reduce the risk of this happening, organizations should only empower a small number of administrators to manage group policies, implement a strict delegation of administrative powers relative only to the powers required by the other administrators, and communicate all changes through a change management system.

Group Policy in WAN Environments Network environments with slow WAN links present other issues for group policy. Because of the excess time that it takes for a logon to complete when group policies are present, a slow WAN link or a RAS connection may result in exceptionally poor performance for end users. Mobile usage is constantly increasing, and while bandwidth is available in some cases, usually it is not enough for group policies to force the download of a software package or even to run a script. www.syngress.com

Intellimirror • Chapter 13

Figure 13.8 Sequence of Startup Events for Group Policies Computer Starts

Computer begins network and contacts Domain Controller

Domain Controller sends list of Group Policies that apply to the computer

Local Policy?

Yes

Computer applies Local Policy

Yes

Computer applies Site Policy

Yes

Computer applies Domain Policy

Yes

Computer applies OU Policy, and checks for further OU Policies

No

Site Policy?

No

Domain Policy?

No User logs on and repeats by checking for local policy first

No further OUs

OU Policy?

User already logged on

Interface is applied

Netlogon is capable of detecting a slow link by sending a test ping from the client to the server. If the ping returns in more than two seconds, netlogon sets a GPO_INFO_FLAG_SLOWLINK value to indicate that the connection is a slow link. A slow link is considered 500 Kbps or less. A network administrator can change this default value through the Computer Configuration\Administrative Templates\System\Logon\Slow network connection timeout for user profiles policy and the Computer Configuration\Administrative Templates\System\Group Policy\Group Policy slow link detection policy.Various group policy settings can be deactivated for that www.syngress.com

407

408

Chapter 13 • Intellimirror

particular client, but not all group policy settings.When the slow link flag is set, the following are default actions: ■

Software policy remains active and cannot be deactivated.

■

Application deployments are deactivated.

■

File deployments are deactivated.

■

Scripts are deactivated.

■

Registry-based policies remain active and cannot be deactivated.

■

Security settings are active and cannot be deactivated.

WAN environments typically implement sites to manage WAN traffic. A group policy that is linked to a Site object will be applied to every machine within that site, even if that site spans multiple domains.The site-linked group policy stays within the domain in which it was created.This means that clients will contact that one domain to apply that group policy.This can cause unnecessary traffic if the domain spans the site. Site-linked group policies should be applied sparingly, and with the traffic implications understood, so that only domains that are held entirely within a site are used as the creators of that site’s site-linked group policy.

Implementing a Group Policy Strategy You create group policies using a utility called the Group Policy editor, which is a management console that can be launched separately in the MMC or out of the Active Directory Users and Computers or Active Directory Sites and Services.

Configuring & Implementing… Using Group Policy to Secure the Management Console Active Directory and its schema are dangerous things to enable people to access and use if those users have the ability to make changes to them. Accessing Active Directory, the schema, and many other system functions in Windows 2000 is executed through a common interface: the Microsoft Management Console, or MMC. Continued

www.syngress.com

Intellimirror • Chapter 13

Group Policy contains a section for securing the Management Console, located in the User Configuration\Administrative Templates\ Windows Components\ Microsoft Management Console. It allows the administrator to effectively stop any user from using specific console applications. Sometimes, however, it is necessary to enable the viewing of a console, but the administrator may not want the user to change anything. In this case, the administrator will want to turn off the Author mode for that user in the group policy. This particular group policy setting is entitled: “Restrict the user from entering author mode.” When this policy is enabled, the user can browse any console that the administrator has left enabled, but is unable to make any changes within it, thus adding another layer of security to the network.

Configuring Group Policy Objects To create a GPO linked to a site, domain, or OU, in the Active Directory Sites and Services utility, right-click on the site container to which you are linking a group policy and select Properties, as illustrated in Figure 13.9. (Use the Active Directory Users and Computers to access the properties for domains and OUs.) Click on the Group Policy tab. Click New and type in a name for the new GPO (Figure 13.10). If you do not want to make any changes to the object, you can simply click Close. Figure 13.9 Properties of a Site

www.syngress.com

409

410

Chapter 13 • Intellimirror

Figure 13.10 New Group Policy Object

To edit the GPO, in the Group Policy tab of the Site, Domain, or OU Properties dialog, double-click the GPO.The Group Policy editor will open, ready to edit that particular GPO.The Group Policy editor has two panes.The left pane is used to navigate the hierarchy of policy containers.The right pane is used to display the contents of whichever container is selected in the left pane. Figure 13.11 displays the policies available for Users regarding group policy behavior. Figure 13.11 Group Policy Editor Contents Pane

www.syngress.com

Intellimirror • Chapter 13

To edit a particular policy, double-click the policy in the right-hand contents pane. It will display the individual policy’s properties, shown in Figure 13.12. Figure 13.12 is also an example of Group Policy usage. For example, a business called the Wire Place Company can increase sales by installing a kiosk system for prospective clients to review their wire products.The kiosks can use group policies to deploy applications, and to secure the kiosks themselves. Each kiosk automatically can log on to the system using a standard logon account in the KIOSK OU. Most of the kiosks might use slow links, at about 56 Kbps.The Wire Place administrator would probably want to ensure that all accounts within the KIOSK OU will apply the group policies regardless of the network link speed.To do this, the administrator disables the slow link detection by applying the group policy shown in Figure 13.12. Figure 13.12 Disabling Slow Link Detection

Sometimes a GPO is no longer needed; either its contents are combined with that of another GPO, or its functions are no longer used. Many organizations undergo constant change, and therefore need to remove defunct GPOs.To delete a GPO, right-click on it and select Delete from the pop-up menu shown in Figure 13.13. Alternatively, click on it and then click Delete.You may wish to disable the policy for a period of time before completely deleting it from the network.To disable a GPO, right-click on it and select Disabled from the pop-up menu.

www.syngress.com

411

412

Chapter 13 • Intellimirror

Figure 13.13 Deleting a Group Policy Object

Link a Group Policy Object to a Container You can create a GPO in an OU, domain, or site and then deploy the identical GPO elsewhere. Recreating the GPO might take a tremendous amount of time if it is a complex set of policies.The optimum solution would be to link the existing GPO to the other container, which is possible within Active Directory. To do this, right-click on the site, domain, or OU, and select Properties. Click on the Group Policy tab. Click Add. In the resulting dialog box, click the All tab. All of the GPOs for the entire domain will appear, as shown in Figure 13.14. Select the GPO that you want to use and click OK.The linked group policy will be added to the bottom of the list of group policies for that container. If you want the group policy to be processed prior to the others, select the group policy and then click Up. GPOs cannot be moved outside of the domain in which they were created; instead, they can only be linked.This will force the users in a linked domain to contact a domain controller in a different domain to access the group policy, which in turn may cause undesirable network conditions. If not carefully managed, linked GPOs can cause significant network traffic. Administrators might need to find out which containers a Group Policy is linked to when they need to troubleshoot the group policy, or when they intend to delete the group policy.The way to go about this is to open the GPO in the Group Policy editor and right-click on the root container of the group policy. Then select Properties from the pop-up menu, as depicted in Figure 13.15. www.syngress.com

Intellimirror • Chapter 13

Figure 13.14 All Group Policies for a Domain

Figure 13.15 Group Policy Root Container Properties

The Properties dialog for the GPO will appear. Click on the Links tab for the dialog.Then, click Find Now. All of the containers to which the group policy is linked will appear in the dialog, as shown in Figure 13.16.

Adding Scripts There are four types of scripts that can be configured in the group policy. Startup and shutdown scripts are found in the Computer Configuration container. Logon and logoff scripts are found in the User Configuration container.

www.syngress.com

413

414

Chapter 13 • Intellimirror

Figure 13.16 Linked Containers for a Group Policy Object

Logon scripts are the most commonly used scripts.They organize a user’s environment once that user has logged on to the network. A logon script, however, is somewhat user specific. If a computer requires a certain setting, regardless of which user is logged on, then every logon script has to identify that computer and add that setting just in case a user of that logon script happens to log on to that particular computer.To better manage this requirement, computer startup scripts are provided. Both logoff and shutdown scripts are methods of cleaning up an environment. Additionally, other information can be captured. For instance,Testme.com is an international testing facility.They execute timed tests via computer terminals at testing centers, and practice tests over the Internet.Testme.com delivers its practice tests through a Terminal Server window, and then provides results via Web pages.When the student logs off the Terminal Server window,Testme.com must capture the results of the test, reset the application, and capture the time that the student was logged on.Testme.com can use a logoff script to manage this effort.

NOTE All scripts can use any of the Windows Scripting Host (WSH) scripting tools, including batch files, VBScript and JScript. Any script can be written with the new Extensible Markup Language (XML) Windows Script file. To find out more about WSH, see Microsoft’s Web site.

www.syngress.com

Intellimirror • Chapter 13

To establish scripts under a GPO, they must first be copied into the Netlogon share of an Active Directory domain controller along with any dependent files. After the scripts are copied, edit the GPO in the Group Policy editor. For Startup or shutdown scripts, navigate down the left pane from Computer Configuration | Windows Settings | Scripts(Startup/Shutdown) and double-click either the Startup or the Shutdown script in the right-hand contents pane. For Logon or logoff scripts, navigate down the left pane from User Configuration | Windows Settings | Scripts (Logon/Logoff) and doubleclick either the Logon or the Logoff script in the right-hand contents pane. The script’s Properties page will appear, as shown in Figure 13.17. Click Add. A small dialog box will appear to prompt for the script’s name and any parameters required by it. After completing this dialog, click OK to save the script into the group policy. Figure 13.17 Script Properties

Even though they use the same name of “logon script,” the group policy logon script is not related to the standard logon script that is part of the user’s profile.This means that a user can end up executing two logon scripts, if there is one in the profile and another in the group policy.You can also create multiple scripts for startup, shutdown, logon, or logoff group policies.They will execute in the order that they appear in the Script Properties dialog.The group policy scripts execute in the following order: 1. Startup At computer startup, after network connections are initialized. www.syngress.com

415

416

Chapter 13 • Intellimirror

2. Logon At user logon. 3. Logoff At user logoff. 4. Shutdown At computer shutdown, before the network connections are deleted. When you create scripts, you should thoroughly test them before applying a group policy to users.

Deploying Applications with Group Policies Deploying applications with group policies requires that the software use the Windows Installer packages. Many applications include a Windows Installer package. If the application does not have one, it will need to be produced. After this is completed, a software distribution point containing the package and all required files must be established along with the rights that each user must have to be able to access and install the software. Once the network has been prepared, the application can be deployed to end users.There are two basic options for software deployment: ■

Assign the application

■

Publish the application

The difference between assigning and publishing is that an assigned application appears as an advertised application on desktops or Start menus and appears to the user as able to be used, even if it has not been installed yet. If the user selects the application icon, it will install itself the first time.The assigned application cannot be deleted. By contrast, publishing an application enables the user to use Add/Remove Programs and see that application in the list of available programs. The user can remove the published application at any time. To define software installation for a user, open the Group Policy administrator and navigate under User Configuration to Software Settings, and then to Software Installation. Right-click on Software Installation and select Properties from the pop-up menu. Select the General tab, if it is not already selected.This screen will let you establish standard settings for all future settings. To create an individual package, you should right-click on Software Installation and select New | Package. If you set the Default Package Location in the Software Installation properties, you will be automatically taken to a software www.syngress.com

Intellimirror • Chapter 13

distribution point. If not, then you must browse to a software distribution point and select a Windows Installer Package, which has a file extension of .msi.

Configuring & Implementing… Best Practices for Assigned Applications Deployment Windows 2000 Group Policy makes it easy to deploy software. However, sometimes errors can cause significant damage, usually in the form of downtime for end users, if software is not tested before being deployed to a production network. Always use a lab and test each software application on the same type of hardware to which the application will be deployed. Also, make sure to apply assigned applications only to the group policy for Computer Configuration Software Installation, so that roving users do not accidentally install software on other workstations.

After selecting the package, you will be shown the dialog depicted in Figure 13.18.The dialog allows you to select whether to publish, assign, or configure advanced published or assigned features. Publishing an application means that it is available for installation via the Add/Remove Programs icon in Control Panel or by opening a file that has an extension that is associated with that particular application. Assigning an application means that the application automatically appears on the user’s system and is not optional. If you want to explore the assignment or publishing options, select the Advanced option, which will lead to the Properties of the new package. Figure 13.18 Deploy Software Dialog

www.syngress.com

417

418

Chapter 13 • Intellimirror

When you create a package for an application, you should not assign it to more than one group policy. In addition, you should not assign or publish an application to both sections (User node and Computer node) of a group policy. You can reduce your network bandwidth utilization if you use Distributed File System (Dfs) in conjunction with your software installation group policies. You can use Dfs to build a redundant store for files across your network.Then, you can build a sharepoint for software installation using a single path to point to the installation files.When a group policy is applied, it will be applied from a close server. In addition, the redundancy of the file storage will ensure that a single server failure will not affect your normal operations for software installation via group policies. The following dialog allows you to select the details regarding the software installation.There are multiple tabs to the dialog, which are described in Table 13.2. Table 13.2 Software Installation Options Dialog Tab

Option

Function

General

Name

General

Product Information

General

Support Information

Deployment

Deployment Type

Deployment

Deployment Options

Deployment

Installation user interface options

Deployment

Advanced button

The name that the user will see when given this software option. Software information taken from the package file. Support information taken from the package file. Published (optional) or assigned (not optional). Auto-installation when the application’s associated file extension is activated. Uninstallation of the application after the management scope expires. Whether to display this application in the Control Panel Add/Remove Programs. Basic—provides a minimum display of the installation progress. Maximum—provides display of all installation dialogs and screens. Whether to install the application if its language is different from that of the target workstation. Continued

www.syngress.com

Intellimirror • Chapter 13

Table 13.2 Continued Dialog Tab

Option

Function

Whether to install an X86 application on Alpha workstations. Whether to enforce removal of other installations of the same product if the group policy did not install it. Diagnostics for the deployment of the app, including product code, script location, and number of times it has been deployed. Upgrades Packages that this Upgrades applications selected from package will upgrade previously installed GPO software installations. Upgrades Packages in current Any applications that will upgrade this GPO that will upgrade application. this package Categories Selected categories A listing of the available categories that this package will appear under in the Add/Remove Programs. Modifications Modifications A list of the transforms files that script the installer package to work in a specific manner. Typically, these files have a .mst extension. Security Permissions box Description of the default object permissions for this group policy.

All of these options can be changed after a software installation package has been added by double-clicking the package or by right-clicking it and selecting Properties.This dialog is shown in Figure 13.19. To remove a software package, right-click on the package and select All Tasks | Remove.The Remove Software dialog shown in Figure 13.20 will appear.You have the option of uninstalling the software from all users’ desktops, or simply preventing future installations. Regardless of which option you select, the package will be removed from the contents of the Software Installation node.

www.syngress.com

419

420

Chapter 13 • Intellimirror

Figure 13.19 Software Package Options

Figure 13.20 Removing a Software Package

Folder Redirection Folder redirection is the transparent relocation of a user’s special folders from a Windows 2000 machine to a network server. For example, the Start menu and My Documents folders can be relocated onto a server for a user who roams from one PC to another on the network.When the user moves from PC to PC, the Start menu is always the same and the My Documents folder always contains that particular user’s files. If roaming user profiles are enabled for that user, only the network path to My Documents is required to be part of the profile, rather than the folder itself.This significantly reduces the amount of data that crosses the wire when a user roams. Storage of data on servers will allow it to be backed up when the server is backed up, whereas such data is not normally backed up when it resides on a local hard drive. If you implement a disk quota in addition to redirecting these folders, you can place limits on the amount of data a user stores in them.The folders that can be relocated are: www.syngress.com

Intellimirror • Chapter 13 ■

Application Data

■

Desktop

■

My Documents

■

My Documents/My Pictures

■

Start menu

Offline folders are available to users even when the users are not connected to the network.This is useful when redirecting folders to a network share, and enabling a local copy for the user if the user travels with a laptop computer. Offline folders are local synchronized copies of files and folders that exist on the network. Using offline folders enables users to work even when they are not connected to the network, and ensures that the files are always the latest versions. When a user has made changes to an offline file, the user synchronizes after reconnecting to the network. If there are conflicts to the data, the user is given the choice of selecting his or her own file, the current file on the network, or saving both versions. A user must select the folders that he or she wants to use as Offline Folders.This is done through My Computer or My Network Places.The user can click on the selected folder and then select Make Available Offline from the File menu. To redirect a folder, in the Group Policy editor, navigate to User Configuration | Windows Settings | Folder Redirection. Select one of the folders to redirect; for example, My Documents. Right-click on the folder and select Properties from the pop-up menu.There are three options for redirecting a folder: ■

No administrative policy specified (default) Folders are not redirected.

■

Basic Redirecting every user to the same network location.

■

Advanced Using groups to select the same network location for each group designated, although that location can be different from group to group

Obviously, using either the Basic or Advanced option does not give the granular control that is generally desired for files in the My Documents folder.To gain a granular control, you can incorporate the parameter %USERNAME% in the UNC name for the folder location. For example, if you wanted to place the My Documents folder into the \\myserver\myshare\myfolder location with a www.syngress.com

421

422

Chapter 13 • Intellimirror

different subdirectory for each user, then you would use \\myserver\myshare\ myfolder\%username%\My Documents. The Settings tab for folder properties allows further configuration, as illustrated in Figure 13.21.There is an option to grant the user exclusive rights to the folder. (You would only want to select this option if you individualize the folder location.) You can select an automatic migration of the contents of the local My Documents folder to the network location. Finally, you can specify how to handle the data in the folder when the policy is finally removed. Figure 13.21 Folder Redirection Properties

Disk quotas can be enabled for computers.When using a disk quota in addition to redirecting folders, you will want to apply the disk quota to the server that holds the special folders. Disk quotas are dependent upon using NTFS on the computer.To set a disk quota, navigate to Computer Configuration | Administrative Templates | System | Disk Quotas.You will want to enable the following policies to establish a disk quota: ■

Enable disk quotas (this will allow a disk quota to be set even if a previously applied group policy denies it).

■

Enforce disk quota limit (when this is not enabled, the user is warned about the limit; when enabled, the user is stopped from adding files).

■

Default quota limit and warning level (this policy lets you set the disk quota limit and a warning level).

www.syngress.com

Intellimirror • Chapter 13

Keeping Groups from Growing Over Time One of the challenges with managing a network is to keep administrative groups from growing too large. For example, Joe might leave for a conference out of town.While Joe is away, he might have Susan take over his duties.To grant Susan access, the administrator adds her account to all of Joe’s groups.When Joe returns, no one thinks to remove Susan from the groups. Multiple occurrences such as these make groups grow, and too many people end up with more rights than are actually needed. Group Policy has a way to keep groups from growing too large. By adding groups to the computer configuration group policy, any computer that the group policy applies to will re-set permissions according to the group policy, even if changes have been made to that group through the Active Directory Users and Computers console.This does not prevent changes to the groups while the computer is up. Instead, it cleans up those changes after the computer reboots.The next time the computer is booted, it will apply the group policy and remove any extra entries. To use restricted groups, open a GPO and navigate to Computer Configuration | Windows Settings | Security Settings | Restricted Groups. Add groups to the Restricted Groups node by right-clicking the Restricted Groups node and selecting New group. After adding the groups, configure their appropriate user list. After applying the group policy to a set of computers, only changing the group policy will change the list of users in those groups. It is recommended to use this only with sensitive groups to keep them from growing over time. GPOs are not the only features in Windows 2000 that can create restricted groups.The Domain Security Policy console can establish restricted groups to be applied domainwide, as well. For example, you may have granted the capability for users in the Development business unit to add themselves to groups for testing an application that is Active Directory integrated via ADSI. However, you also want to ensure that these users do not add themselves to the Enterprise Administrators or Schema Administrators groups.Therefore, you can use the Domain Security Policy console to restrict the Enterprise Administrators and Schema Administrators groups to the selected administrators who should be granted membership.The development group can test against every group except those two from that point on.

www.syngress.com

423

424

Chapter 13 • Intellimirror

Troubleshooting Group Policies There are three issues with group policies that need troubleshooting: ■

The policy does not execute.

■

The policy does not execute the way that was expected.

■

Logging on takes a really long time.

Policy that Does Not Execute If a user can log on to the network, access files, applications, and printers, but the group policy doesn’t execute, there can be problems that the group policy intended to fix. For example, the group policy may restrict that user from adding programs to the computer, which affects your licensing management and exposes your company to possible fines if you are audited.Therefore, you should always ensure that group policies are executing properly.When the policy does not execute, it is usually a problem with the Access Control Entry, or multiple group policies that conflict with each other, or that part of the policy has been disabled. When the user does not have an Access Control Entry (ACE) directing a GPO to be applied, then the group policy is skipped completely.To check on the ACEs for a GPO: 1. Right-click on the OU or domain container in Active Directory Users and Computers (or right-click on the selected Site in the Active Directory Sites and Services console). 2. Select Properties from the pop-up menu. 3. Click on the Group Policy tab. 4. Click once on the policy that is not executing to select it. 5. Click Properties. 6. Click the Security tab. 7. Select the group or the user account from the list in the upper box and review the rights assigned in the lower box. 8. To see a more detailed view, click Advanced. 9. Make sure that the user or a group to which the user belongs has the Read right and Apply Group Policy right. In addition, make sure that no group to which the user belongs has been denied rights to either of these rights. www.syngress.com

Intellimirror • Chapter 13

If the user has multiple group policies applied, then some may conflict with others and the result is that the last one that applies usually overrides all previously applied policies. A group policy does not override previously applied group policies if the No Override feature has been checked on one of the upper-level group policies. Upper level can be one of the policies in the list applied to that container, or a group policy that has been applied to a parent container.The best method is to start with the group policy that did not execute correctly, and ensure that it is configured correctly.Then work backward to the top of the tree until all the policies have been reviewed.This would be in the order of OU, Parent OUs, Domain, Site, and then the Local Group Policy.To check them, click on the group policy, then click Options and make sure that the No Override check box is clear. Finally, if a policy has been disabled, it will not execute.To see if a group policy has been disabled, select it and then click Options. Make sure that the Disabled check box is clear.To see if part of the policy has been disabled, select the group policy and then click Properties. On the General tab, make sure that the check boxes for disabling either the User or the Computer portion of the policy have not been disabled.

A Policy that Executes in the Wrong Way A policy may execute in an unexpected manner for a couple of reasons. It could be a legacy NT 4 system policy that was applied accidentally. A good practice to follow is to not use any legacy system policies. If a group policy is created to install software and the installation does not occur correctly, it could be that the software transform file is not correct. Transform files are those that custom configure Windows Installer packages. If the transform file is not added to the Modifications tab, the plain vanilla installation of the software will proceed. If the wrong transform file is added to the Modifications tab, then errors may occur or the wrong configuration of software will be a result. It is possible that the same software application is applied to the same Group Policy software installation. If so, then the application might install in the wrong way. Make sure that an application only appears once within any GPO, or within a string of nested GPOs. If you receive a “Failed to open the Group Policy object” error, then you will need to re-check the network connection and DNS configuration.This error indicates that the policy was not located.

www.syngress.com

425

426

Chapter 13 • Intellimirror

Logging On Takes a Long Time The primary thing to do when there is an extended logon period is to reduce the number of GPOs that are applied to a user.This can be done by removing group policies, combining multiple group policies into a single group policy, or by removing the “Apply Group Policy” right from the user’s ACE. The next thing you can do is disable parts of GPOs.This is done through the Properties dialog box for the group policy. It will avoid processing the settings, even for unconfigured policies. There may be a GPO that is applied to a site, where the GPO belongs to one domain and the user belongs to another.When this happens, the user must be authenticated back to the domain controller that “owns” that particular group policy.This excess processing causes a slower logon.Where possible, remove sitelinked group policies and apply them to containers instead. If none of these tactics work, you might need to look at the site topology and whether there are enough domain controllers available to service logon requests from users.

Understanding Security Rights can only be assigned to security principals. Security principals consist of user accounts, computer accounts, and security groups. Security groups are either Domain Local groups or Global groups. (Universal groups exist only as distribution groups in mixed mode, but can be made into Security groups in Native mode.) Unlike Novell’s directory service (NDS), OUs are not security principals.You cannot assign rights to an OU and expect that those rights will be inherited by the users and groups within them. If you are an NDS administrator and would like this same functionality, you can muddle through with strategic placement and organization of Global groups.The system is to create a Global group within each OU, and name it accordingly.Then include all the users and groups within that OU as members of the Global group. In addition, add the Global groups of the next-level-down OUs.This nesting system will permit rights to flow down through the tree. Assign rights to these OU Global groups as though assigning them to the OU itself.The only thing that is not achieved with this system is the ability to block inheritance. An example of this system is shown in Figure 13.22.

www.syngress.com

Intellimirror • Chapter 13

Figure 13.22 Nesting Global Groups to Flow Rights Down the Active Directory Hierarchy example.com

ServerA ShareA

ShareB Members: WestGG, EastGG Rights: Read to ServerA\ShareA OU-Corp

CorpGG Members: UserA Rights: Write to ServerA\ShareA Nested Rights: Read to ServerA\ShareA OU-West

WestGG UserA has both read and write rights to ServerA\ShareA UserA

OU-East

EastGG

Members: EastSalesGG, UserB Rights: Full Control to ServerA\ShareB Nested Rights: Read to ServerA\ShareA

UserB has read rights to ServerA\ShareA and full control of ServerA\ShareB UserB

OU-Sales

Members: UserC Rights: Write to ServerA\ShareA Nested Rights: Read to ServerA\ShareA, and full control to ServerA\ShareB EastSalesGG UserC has both read and write rights to ServerA\ ShareA, and has full control of ServerA\ShareB UserC

Groups There are three types of groups available for Active Directory: Domain Local, Global, and Universal. Of these types, several default groups are provided automatically within the Users container in each domain.These are shown in Figure 13.23 www.syngress.com

427

428

Chapter 13 • Intellimirror

along with their descriptions. Another set of groups is placed in the Builtin container in each domain. Builtin groups are provided for local group usage and backward compatibility, and are illustrated in Figure 13.24. Figure 13.23 Default Groups within Users Container

Figure 13.24 Builtin Groups

Other groups are available for security reasons that are not provided as an Active Directory security principal that you can add or remove users from.These special groups define default behavior for users.The reason that they are provided as special groups is so that the network administrator can define that default behavior in ACEs for various objects.The special groups are: ■

Anonymous Logon This group handles anonymous logons, and is used for Microsoft Message Queuing (MSMQ).When MSMQ clients use RPCs to reach an MSMQ server, the call is considered an anonymous logon.

■

Authenticated Users This represents any user who can log on to a machine or to Active Directory.This group is automatically made a member of the Power Users local group, so that all users are “Power Users” on Windows 2000 PCs.To reduce those users’ rights to be equivalent to standard users’ rights, you will need to remove the membership for Power Users and leave the membership to the Users local group. All

www.syngress.com

Intellimirror • Chapter 13

Authenticated Users are given the Read and Apply Group Policy rights to each group policy, so this will need to be removed from a group policy if the administrator wants to filter the group policy and apply it to only certain security groups. Of course, the administrator will need to apply explicit rights for those security groups in order for the group policy to become effective. ■

Everyone This group includes all current network users, including guests and users from other Active Directory domains.

■

Interactive This group includes any user who is currently logged on to a specific computer locally and given access to its resources. There can be multiple user accounts in this group when the domain controller is providing terminal services.

■

Network This group is the antithesis of the Interactive group. It includes all users who have been authenticated and granted access to a specific computer’s resources over the network.

Other special groups are installed with certain services. For example, a Dialup group is created for remote access services, and a Proxy group is created for Internet Information Services.Your Windows 2000 system may have additional special groups depending on which services have been installed.The service’s documentation should explain the purpose of those groups and what security might be required to manage them.

Domain Security Console Security for Active Directory is configured in many places, but domainwide policies are configured in the Domain Security Policy console shown in Figure 13.25. The Domain Security Policy is located in the Administrative Tools menu. There are several containers for security policy in the Domain Security console: ■

Account Policies

■

Local Policies

■

Event Log

■

Restricted Groups

■

System Services

■

Registry www.syngress.com

429

430

Chapter 13 • Intellimirror ■

File System

■

Public Key Policies

■

IP Security Policies on Active Directory

Figure 13.25 The Domain Security Policy Console

Account Policies There are three account policies: ■

Password Policy

■

Account Lockout Policy

■

Kerberos Policy

Kerberos Policy is new to Windows 2000, while Password and Account Lockout Policies are similar to the ones in the legacy Windows NT Server, available through User Manager for Domains. All are listed in Table 13.3.

www.syngress.com

Intellimirror • Chapter 13

Table 13.3 Account Policies Policy Type

Policy

Default Setting

Security Feature

Minimum and Maximum Values

Password Enforce Policy password history Password Policy

Password Policy

Password Policy

Password Policy

Password Policy

1 password Users are prevented 0 (do not keep remembered from re-using the password history) same password to 24 passwords. repeatedly. Maximum 42 days When set to a low 0 (passwords do password number, users are not expire) to age forced to use fresh 999 days. passwords, making the system more secure. Minimum 0 days When set to any 0 (password can password number other than 0, be changed age users are forced to immediately) to retain a password 998 days. for a duration of time, preventing immediate changes. Minimum 0 characters When set to a longer 0 (no password password number, users cannot required) to 14 length use easy-to-guess characters. passwords. Passwords Disabled When enabled, the Enabled or must meet password is required Disabled. complexity to have a combination requirements of other characters, numbers, and upperand lowercase. Store Disabled When enabled, Enabled or password passwords are Disabled. using encrypted. reversible encryption for all users in the domain Continued

www.syngress.com

431

432

Chapter 13 • Intellimirror

Table 13.3 Continued Policy Type

Policy

Password User must Policy log on to change the password

Default Setting

Security Feature

Minimum and Maximum Values

Disabled

When enabled, a user Enabled or must first present Disabled. existing credentials to the domain by logging on before changing the password. This presents problems for remote users. Account Account Not defined When defined, the 0 (account is Lockout lockout administrator sets locked out until Policy duration the number of administrator minutes that an unlocks it) to account is locked out 99,999 minutes. after the set of invalid logon attempts. Account Account 0 invalid The user must fail at 0 (account will Lockout lockout logon logging on for the not lockout) to Policy threshold attempts number of attempts 999 logon specified, and then attempts. will be locked out of the system. Account Reset Not defined The longer the 1 to 99,999 Lockout account number of minutes minutes. Policy lockout specified here, the counter more likely a user after… may have an account locked out. This is the duration of time during which the system counts invalid logon attempts before resetting to 0. Each successful logon resets this counter to 0. Kerberos Enforce Enabled This enables Kerberos Enabled or Policy user logon to use the logon Disabled. restrictions restrictions. Continued

www.syngress.com

Intellimirror • Chapter 13

Table 13.3 Continued Policy Type

Policy

Default Setting

Security Feature

Minimum and Maximum Values

Kerberos Maximum Policy lifetime for service ticket Kerberos Maximum Policy lifetime for user ticket

600 minutes The duration that a Kerberos security ticket remains valid.

0 (ticket does not expire) to 99,999 minutes.

10 hours

0 (ticket does not expire) to 99,999 hours.

Kerberos Maximum Policy lifetime for user ticket renewal Kerberos Maximum Policy tolerance for computer clock synchronization

7 days

5 minutes

The duration that a user’s logon remains valid without contacting a Kerberos host (KDC). In order to renew a previously used ticket, the user must contact a KDC in this timeframe. Kerberos authentication is stamped with a start and expiration time (default of 10 hours). If the time of the KDC and the client are not synchronized, the Kerberos ticket could prematurely expire or never expire. This sets the allowable time variance.

0 (ticket renewal does not expire) to 99,999 days.

0 to 99,999 minutes.

Administrators have tough decisions in front of them when they set up the Account Policies.They must decide where to tradeoff ease of use for security. For example, users who are forced to change passwords every day will be more likely to forget passwords and will overwhelm the help desk. However, users who are never forced to change passwords probably won’t. In such a case, the network is left nearly unsecured. When deciding on the policies for your organization, you should take into account the desired level of security and likelihood of security breaches in each area. For example, if your organization is a school with one domain for teachers and another domain for students, then it would be preferable to keep high www.syngress.com

433

434

Chapter 13 • Intellimirror

security on the teacher’s domain by enforcing monthly password changes and long, encrypted passwords.

Local Policies Three types of policies affect the local domain controller: ■

Audit policy

■

User Rights Assignment

■

Security options

Audit policy enables the administrator to audit the domain’s activity with security events. Audited items include (but are not limited to) events such as logons, access to objects, access to system events, and policy changes.The audit can reveal whether such security events were successful or unsuccessful. An administrator would generally prefer to know when an event has been unsuccessful, since that will provide the administrator with the knowledge of who has tried to access something denied to him or her. Administrators may also wish to know whenever a policy change attempt has been made whether successful or unsuccessful, since that is indicative of the use of a highly secured right. The User Rights Assignment container provides a single place to add general rights to the local domain controller for users or security groups.These rights control who can shut down the server, change system time, add computers to the domain, and so forth. Security options provide a local security system that can further lock down the domain controller.These security options include whether to disable using CTRL ALT DEL for logging on to the server, whether to automatically log off any users after a logon time expires, establishing a message text for users at the time of logon, whether to shut down the server if no more security events can be logged, and more. Although many of these items are new, others were available as registry edits in the legacy Windows NT Server.

Event Log The event log settings manage the system, application, and security logs.These settings can establish the maximum size, access to the logs, and retention of the logs.

Restricted Groups This is the same group restriction that can be set in a group policy.The setting here for restricted groups is far more secure, since a domain controller must be www.syngress.com

Intellimirror • Chapter 13

rebooted before it accesses and uses a new group policy.When restricted groups are used in the Domain Security Policy console, then the domain controller establishes the new security settings for groups right away.

System Services For each of the default services that runs, there is an associated policy.The policy is, by default, not defined.When defined, however, the administrator is faced with the dialog shown in Figure 13.26, where the service startup mode must be selected and the administrator can further edit who has access to change the service. By default, the group Everyone is first offered full control of services when a policy is activated. If using Terminal Server, this should be changed to Administrators. Figure 13.26 Editing a Service Policy

Registry The registry policy settings can secure individual registry keys from being edited by a user. Like services, by default, the Everyone group is initially offered full control of the registry keys, which means they can change them any way they please.You can add registry keys into this policy and then secure those keys from being changed, or viewed, by changing the groups and users who are granted access to those keys.

File System The file system policies can configure security for files and folders.This is a more granular control over files and folders than share-level security. It offers a single point of security administration for the local domain controller.

www.syngress.com

435

436

Chapter 13 • Intellimirror

Public Key Policies Public key policies let you add automatic certificate requests and manage the certificate authority behavior.You should make sure to have your Certificate Authority server(s) installed before attempting to establish these policies.

IP Security Policies on Active Directory If you have IP Security (IPSec) established on the network, these policies will manage it.There are several ways that a domain controller can handle IPSec.

Security Templates Windows 2000 has several templates for security settings that you can apply either to a group policy or to the Security console. If there are changes made to a computer’s security settings and the template is the organization’s standard, then reapplying the template can return the computer to a working state. To import a policy into a group policy, open the policy in the Group Policy editor.Then, navigate to the Computer Configuration | Windows Settings | Security Settings. Right-click on Security Settings and select Import Policy from the pop-up menu.The security templates will appear in the window. To import a policy into the Domain Security console, right-click on the root container called Security Settings. Select Import Policy from the pop-up menu and select the desired security template.

Object Protection With Active Directory, establishing permissions is more than just granting a user access to a file or a printer. It also involves permitting and denying access to objects for users and security groups.

Access Control Lists Permissions in Windows 2000 are stored in an access control list (ACL).The ACL is accessible through the Security tab on various objects, such as the Properties of a group policy, which is shown in Figure 13.27. The Security dialog screen lets you specify the groups or users that have access to the group policy.The default permission for any user to a group policy is to Read and Apply Group Policy, except for Domain Admins, Enterprise Admins, and the SYSTEM groups who are not granted the Apply Group Policy right to prevent themselves from being restricted by the policy.The administrative www.syngress.com

Intellimirror • Chapter 13

groups are also granted rights that enable them to edit the policy as well.The default rights set for groups is more than the minimum required, since Read access is not needed to use the group policy. It might mean a better-secured environment to remove the Read right for Authenticated users from the ACL. Figure 13.27 Access Control List

Access Control Entries Each individual permission within the ACL is an Access Control Entry (ACE).To gain comprehensive control over the ACEs, the administrator should click Advanced at the bottom of the Security dialog.This leads to the Access Control editor shown in Figure 13.28. When adding an ACE, several rights can be granted or denied. Explicitly denying a right will take precedence over allowing the right. If a user belongs to two different groups and one allows a right, while the other denies it, then the user is denied access. Note that many of these rights are not applicable to the GPO being edited. Instead, there is a check box at the bottom of the ACE editor that lets you establish these rights for the user or group.These rights then are granted to any objects within the container to which the GPO belongs. A good practice to follow when adding rights is to add them for groups only. Even if a single user is going to require a particular right, if you create a group and grant the right to the group, then other users can be added later, or the first user completely replaced.This facilitates administration in the long run, although it can be a little extra work upfront. www.syngress.com

437

438

Chapter 13 • Intellimirror

Figure 13.28 Access Control Entries

Security Descriptor When a user authenticates to Active Directory, the account is identified with its username and password.With a successful authentication, the system creates an access token including the Security Identifier, or SID (explained in the next section), and the SIDs of all the groups of which the user is a member.When the user generates a process after that, the access token is attached to the process. The security descriptor is attached to network resources, rather than to users. It is the reverse of the access token in that it is the holder of the resource’s ACL, which is compared to the user’s access token when the user attempts to authenticate to a resource, as illustrated in Figure 13.29.The ACL contains the SIDs of each security principal that has been granted or explicitly denied access.The SID maps the access token to the security descriptor. Figure 13.29 Access Tokens and Security Descriptors Are Used to Provide Access

UserA

www.syngress.com

Access Token - SIDs: UserA Member of GroupA Member of GroupB

Security Descriptor-ACL: GroupA: List Contents GroupB: Read and Write

ShareA

Intellimirror • Chapter 13

Security Identifier Security Identifiers (SIDs) are created for users, groups, computers, and domains— essentially any security principal. A SID is unique and built when the user, group, computer, or trust is generated within a domain. A SID’s components are: ■

Revision number

■

Authority that assigned the SID

■

Domain

■

Relative Identifier (RID) values

SIDs are a legacy Windows NT concept.When a user is moved from a legacy domain to an Active Directory domain, he or she must be issued a new SID. Because the SID is the mapping mechanism between the access token of the user and the security descriptor of the resource, it has significant implications when a SID is changed. In fact, membership would need to be reestablished for each user account.When groups are moved, new rights would need to be granted to reestablish the ACLs. There is a new attribute of security principals in Active Directory called SIDHistory. SIDHistory retains a copy of a moved object’s old SID. For example, a user who was upgraded from legacy NT to Windows 2000 would be able to access the same resources as before the move. Behind the scenes, the user would authenticate as the NT4/SID or as the Windows 2000/SID, whichever has more rights. SIDHistory works when moving a user from a domain in one forest to a domain in another forest as well. However, there are also implications when the SIDHistory is retained. If a user has been moved more than one time from an NT upgrade to Windows 2000, and from forest to forest, then there will be multiple copies of the SIDHistory in the access token and it becomes overlarge. Furthermore, troubleshooting permitted access for a security principal with multiple SIDHistories is difficult.

Security Model Active Directory includes an inherent security model using OUs to organize the namespace into subsets. Objects are contained within separate OUs within a domain. Each object can be granted or denied access to other objects in Active Directory. Access is so granular that it is applicable to each property of an individual object.Technologies involved in the security of Windows 2000 include www.syngress.com

439

440

Chapter 13 • Intellimirror

Kerberos, PKI, and IPSec. Directory services are used as a repository for digital certificates, both to store and to manage them.

Kerberos The Kerberos protocol is automatically installed when Active Directory is installed on a Windows 2000 domain controller. Kerberos is not only the provider of transitive, two-way trusts, but it is used for logon authentication in Active Directory.When logging on to Active Directory, a user is issued a Ticket Granting Ticket (TGT) by the Key Distribution Center (KDC) on a Windows 2000 domain controller. The TGT holds the authentication information about the user. It is encrypted with the domain master key.Whenever the user requests access to other network resources, the TGT is checked for permissions rather than executing a full authentication sequence.There is also an interdomain key shared by the domains that is used for authentication to use resources in other domains.This is a part of the Kerberos transitive, two-way trust relationship.

Public Key Infrastructure Public Key Infrastructure (PKI) is a security system that uses certificates as its basis. A certificate is a digital voucher containing the name of the account and a public key. The certificate can contain multiple names for the account, including the Active Directory ID, the UPN (where different), the e-mail account, and DNS names. A certification authority (CA) signs a digital certificate to attest that the account’s private key is possessed by the account and is associated with the public key. The CA issues the certificate that includes the public and private encryption keys.This system is based on standard public key encryption, whereby either key can be used to encrypt, and the other key can be used to decrypt any message that the first key encrypted. Public keys are called such because they are available to the public to use when encrypting messages to be sent to the account (usually a user, but sometimes an application).The account can use the private key to decrypt the message. A second use for this system is to verifiably ensure to the public that a message sent is from the named account.This is called a digital signature. It is sent using the private key from the account, and the public, using the public key, can ensure that the message came from the named account. Windows 2000 Certificate Services is an optional component. It works with Active Directory by storing certificates in the directory database.When installing a CA server, remember that you will not be able to rename the server or move it outside the domain it was in after installation. www.syngress.com

Intellimirror • Chapter 13

Smart Cards Smart cards depend on PKI to function. If you implement smart cards, you will need to install a Windows 2000 enterprise CA. A smart card looks like a plastic credit card and contains the private key for an account.When implementing smart cards on a network, each workstation requires a smart card reader and at least one enrollment station. Note that Windows 2000 only supports PC/SCcompliant, plug-and-play smart card readers.

IP Security IP Security (IPSec) is a method of enabling Network layer encryption and authentication to ensure private communications over any IP network including the Internet. Since IPSec is based on open standards, it can be used to communicate with other IP networks.

Secondary Logons Run As is a secondary logon feature for Windows 2000. Using this feature enables you to execute administrative functions without logging on to a machine as the administrator account.This adds a level of security because a PC could not be left running with an administrator’s credentials. Not only can a user walk up to that machine and execute functions with administrative access, but a Trojan horse attack that uses the credentials that currently exist on the PC to execute damaging functions would not have access to the credentials that enable those functions if using a standard user account rather than an administrator’s account. Secondary logon exists as the Run As Service and can be managed on each Windows 2000 computer via the Computer Management console, or from the Component Services icon in Control Panel.To use the tool, you must be logged on as a user without rights to some application.Then, right-click on the application while holding the Shift key down on the keyboard.Then, select Run As from the pop-up menu, as shown in Figure 13.30.

www.syngress.com

441

442

Chapter 13 • Intellimirror

Figure 13.30 Using the Secondary Logon Feature

www.syngress.com

Intellimirror • Chapter 13

Summary Group Policy is an Active Directory-integrated feature used to govern the user interface and computer settings. It is a newer version of the System Policies that originally were introduced with Windows 95, and used in Windows 98 and Windows NT 4. Group policies allow you to control how a workstation is used. Instead of being a file-based policy (like System Policies where machines must contact a server holding a particular system policy file before the policy is applied), group policy is applied to containers within Active Directory and applied during the computer authentication to the network and user logon to Active Directory. Group policies are applied in a specific order: 1. Local Group Policy object 2. Site Group Policy object 3. Domain Group Policy objects 4. Organizational Unit Group Policy objects from the parent OUs down to the user’s or computer’s OU location Although there is a single local group policy, there can be multiple policies associated with a site, domain, or OU.These policies can be changed in order to execute as the administrator would require.The last policy to execute will override all previous policies for the same item unless a policy has been designated as “No Override.”The more group policies that must be applied, the longer a user’s logon sequence will take.This does not pertain to the depth of the OUs, because six policies applied to a single OU will take as long to execute a logon as six OUs deep each with a single policy. Site policies will require contact with the domain controller that manages a particular group policy, and may further increase logon time.When designing group policies, do not use site-associated policies if possible. Use as few group policies as possible. To implement a group policy, start in the Active Directory Users and Computers console. From there, right-click on the container to which the group policy will be applied, and select Properties. Click on the Group Policy tab and then add, remove, and edit group policies as needed. One of the features of Group Policy is the capability of deploying applications to a set of designated computers or a set of designated users.The Software Installation container can be used to add Windows Installer packages and transforms to custom script a software deployment.There are two options for software installation: www.syngress.com

443

444

Chapter 13 • Intellimirror ■

Publish

■

Assign

Publishing an application enables it to be available for users to install, even within the Add/Remove Programs icon in Control Panel. Assigning an application does not give any options for the installation of the software; instead, it is a required installation. Security within the Windows 2000 Active Directory involves the use of access control lists (ACLs) and Security Identifiers (SIDs). ACLs are a list of the groups and users who have rights to the resource, and which rights they have been granted. SIDs are unique IDs applied to the security principal. SIDs for a user and any of the groups to which the user belongs are listed within a user’s access token at the time of logon.The ACL uses SIDs to identify the users and groups.The process is simply a comparison of a user’s access token to a resource’s ACL.The SID is used as the mapping mechanism between the two in order to determine which rights are applicable to the user.

Solutions Fast Track What Are Group Policies?  Group policies are rules that are applied by an administrator to manage a

user’s environment or a computer’s configuration, or both.  Group policies are created, edited, and deleted within the Group Policy

editor, an MMC snap-in that is accessible from MMC, Active Directory Users and Computers and Active Directory Sites and Services.  By default, group policies refresh every 90 minutes; however, you can

reconfigure this refresh interval to be a shorter or much longer period of time.

Group Policy Information Storage and Settings  Active Directory associated Group Policy templates are stored in the

SYSVOL directory of domain controllers.  Group Policy Settings are stored in a group policy for either users or

computers. Group policies stored under the Users container will follow www.syngress.com

Intellimirror • Chapter 13

an associated user around the network. Group policies under the Computers container will apply to a computer regardless of who logs on to it.  Administrative templates are ASCII text files with the extension of .adm.

You can create a new one and add it to your group policies.

Designing a Group Policy Strategy  Place users who will receive the same group policy settings in the

same OU. Place computers with the same settings requirements in the same OU.  Only apply the group policy settings that you absolutely require, and as

few group policies as possible in an inheritance tree, to reduce the time it takes users to log on.  Use slow link detection settings for remote access users.

Implementing a Group Policy Strategy  To launch the Group Policy editor in the Active Directory Sites and

Services, right-click on the site, select Properties from the pop-up menu, and then click on the Group Policy tab. In this dialog, either Add or Edit a group policy.  You can disable or delete a GPO when you no longer need it.This is

done in the Group Policy tab of a container, by right-clicking on the GPO and selecting either Disabled or Delete from the pop-up menu.  You can configure logon and logoff scripts in the User node, and startup

and shutdown scripts in the Computer node.

Deploying Applications with Group Policies  Group Policy application deployment can use Windows Installer packages,

or you can configure a .zap file.  If you publish an application to a user, the application installation

becomes optional for the user.

www.syngress.com

445

446

Chapter 13 • Intellimirror

 If you assign an application to a user, the application installation is

automatic and compulsory.

Understanding Security  Group policies include options for configuring IPSec.  A Security Identifier (SID) is attached to a user, listing the access control

list (ACL) of network resources.  The Domain Security Policy console includes the Account and Password

Policies for the domain.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: I want to deploy software to my users with Group Policy. I don’t want that to happen over telephone lines or to non-company PCs.What should I do for my telecommuters who log on via VPN with their home computers?

A: There are two things you should do. First, to prevent licensing problems for software, you should use software deployment only for computers within your domain.This means that your software publishing and assigning will only be done through the Computer Configuration node of a group policy. That way, when a user logs on from a home computer, which is not a member of your domain, the application won’t accidentally be installed.The second thing that you should do is make certain that slow link detection is enabled.When a slow link is detected, then software will not be deployed.

Q: We are concerned about hackers using tools like l0pht to crack security on our network. Is there something we can do with Group Policy to protect our organization?

www.syngress.com

Intellimirror • Chapter 13

A: l0pht was created to crack NTLM security, but is ineffective against Kerberos security. Active Directory uses Kerberos natively, but is backward compatible to NTLM, too. However, you can disable the NTLM compatibility in the Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options.

Q: We use system policies on our Windows 95 and NT computers. Can I still use them?

A: Yes, you can still use the system policies, and the POLEDIT utility to configure them.You must place the ntconfig.pol file(s) in the Netlogon share of the Windows 2000 DCs.This is now located at C:\WINNT\SYSVOL\SYSVOL.

Q: I want to deny a user access to a resource, but the user needs to belong to a group that is given full control of the same resource. Do I need to create a special group for this user?

A: That depends on how you want to manage this in the future.You do not have to create a special group with all the explicit rights for that user, and the user can remain in the group that is given full control of the resource.You can simply deny access to the resource to that user explicitly.The Deny right will override all other rights to the resource. However, if you have this situation occur once, you may encounter it twice; in which case, it is recommended that you leave the user in the group with full control of the resource, and then create a second group that is denied access to that resource. Adding the user to that second group will accomplish the same thing as denying access explicitly. If eventually you encounter another user who has the same requirements, you can simply add that user to the second group.

Q: Why do group policies contain many of the same features as the Domain Security Policy console?

A: Mainly because a group policy can be used to apply the same registry settings as the Domain Security Policy console and is flexible enough to apply those registry settings to computers domain wide, or to a subset of computers within a specific OU.

www.syngress.com

447

448

Chapter 13 • Intellimirror

Q: How can I look at the ACE for an OU? A: The ACEs are available from the Group Policy tab. By looking at the Properties of the group policy and selecting Security, the ACL is shown. From there, click Advanced. At that point, you can click Add or Remove to add or remove ACEs, or View | Edit to change an ACE.

www.syngress.com

Chapter 14

Publishing

Solutions in this chapter: ■

Publishing Resources

■

Interfacing with Active Directory

 Summary  Solutions Fast Track  Frequently Asked Questions

449

450

Chapter 14 • Publishing

Introduction The term published resource brings to mind the rustle of newspapers and the feel of their rough-cut edges. However, in Active Directory, newspapers they are not. Instead, in Active Directory, a published resource is some printer or network share or other network resource that has been made available to the public at large. Availability is not a problem until a network resource becomes unavailable. Then… well, it usually is a problem. Roaming users offer a particular challenge when it comes to providing resources on the network. Finding available network resources becomes much more problematic when users are not familiar with the office they are in. As more enterprises increase their mobile workforce, they are encountering the need to provide resources to people unfamiliar with their own surroundings.The mobile users may wander into an office to meet with their coworkers, but when they hook up to the network, they may find that they are unable to work because they cannot print to the printer around the corner or access the local file server.This is where published resources step in. Publishing resources within Active Directory enables each server, whether a domain controller (DC) or not, to make its files and printers available on the network through Active Directory in a user-friendly manner.Windows 2000 servers can share files and printers, normally, but users must know the server and share names to locate them.The fact that Active Directory uses the Domain Name System (DNS) as its namespace provider and locator mechanism further enables that resource to become available globally via the Internet as long as the Internet users have a compatible client software, appropriate access, and the network is connected to the Internet in such a way as to not prevent access.

Publishing Resources Although a group policy can publish an application to a desktop, it does not publish the application into Active Directory in the same way as other resources are published.The following items can be published within Active Directory: ■

Shared folders

■

Printers

When publishing a resource, the resource is more than just an object within Active Directory; it is also a searchable entity.That is, users can execute queries to find published resources, or they can browse around to look for them.

www.syngress.com

Publishing • Chapter 14

Not only should you determine what is going to be published, but also in the directory where it should be published. If a SalesReports user is in an organizational unit (OU) for Sales, then publishing the SalesReports share in the Services OU will not be as helpful as publishing it in the Sales OU. Select meaningful placement of resources, and pay attention to the location from which users may be suddenly browsing. If publishing a file from New York in a container that only holds Florida users, there may be more traffic on the WAN than desired. In these cases, another option is to use File Replication Services (FRS), which is a fault-tolerant form of sharing files automatically configured for each DC through the SYSVOL share. Alternatively, you can create a Distributed File System (Dfs) tree with redundant servers placed throughout your network.Then, you can create a share that is replicated with the files that you want to publish, even though there is a single Universal Naming Convention (UNC) name for accessing the file.We discuss Dfs later in this chapter.

Sharing Folders The first step toward making a folder available in Active Directory is to make it available within the domain as a standard shared folder.Two utilities are commonly used both in Windows 2000 and in legacy Windows NT 4.0 to share folders: ■

Windows Explorer

■

Computer Management (an extended version of NT’s Server Manager)

Although this is elementary, the steps to sharing a folder in Explorer are to right-click the folder that will be the root of the information share, and then select Sharing from the pop-up menu. Configure the share any way you desire. Best practices are to not share the root of a partition (e.g., C:\), since that share will have all the information ever placed on that partition within it. Problems particularly exist when sharing the system partition, because system files may be deleted or damaged. Computer Management is found in the Administrative Tools menu. In the Computer Management console shown in Figure 14.1, navigate to System Tools and then to Shared Folders. Click Shares within the Shared Folders. Right-click in the contents pane and select New File Share.The Create Shared Folder wizard will begin.You can walk through the steps to configure a share.

www.syngress.com

451

452

Chapter 14 • Publishing

Figure 14.1 The Computer Management Console

Publishing a Folder in Active Directory Sharing a folder is only the first step toward publishing it in Active Directory.The next portion of the process takes place in another console, the Active Directory Users and Computers console. In this console, navigate to the OU in which you will be storing the published resource. Right-click the OU and select New, then Shared Folder from the pop-up menu, as illustrated in Figure 14.2. The Name box in the dialog will be the name of the resource as it appears in Active Directory.This name can include spaces, so if a phrase is a better description than a single word, you may use it here.The Network path box is simply the UNC location of the share. You can publish a shared folder that does not exist on a server that does not exist, because Active Directory does not check to see if either the server or the share is available on the network.While this functionality is helpful for offline configuration purposes, it does pose a problem if you are prone to typographical errors.You should check each share that you create to ensure that the location is correct. However, you can change the network location at any time for a published resource, so that any errors, or even file migrations, can be rectified after a share has been published. Active Directory does not verify if a share has a duplicate entry. If a share has more than one description, it can be published twice. The properties for a shared folder are shown in Figure 14.3. Although the originally selected name for the resource cannot be changed from this window, www.syngress.com

Publishing • Chapter 14

you are able to add a description or change the location. (You can change the name in the contents pane of the Active Directory Users and Computers window.) Additionally, you can click Keywords and designate a set of keywords that will return this share when a user executes a query looking for this share. The Keywords dialog is shown in Figure 14.4. Figure 14.2 Sharing a Folder in the Active Directory Users and Computers Console

Figure 14.3 Shared Folder Properties

www.syngress.com

453

454

Chapter 14 • Publishing

Figure 14.4 Keywords for Shared Folders

NOTE Aside from a person’s home drive, shared drives are seldom provided for a single person’s use. Usually, a group of people with similar needs access the same set of network resources. It is always best to handle drive mappings for multiple end users through logon scripts. Manually mapped drives used to access network resources are difficult to manage in comparison.

Browsing and Querying for Shared Folders For those who lived through the change from NetWare 3 to NetWare 4, it soon became apparent that even the most user-friendly changes to the interface into the network required a hand-holding session with end users to assist them the first couple of times. It is likely that users will need a boost when they start using Active Directory too. If the users have Windows 2000, they can use the My Network Places icon to lead them to the network. By browsing the Entire Network and then looking through the Directory, they can browse through Active Directory until they reach a shared resource, as shown in Figure 14.5. If the user double-clicks a shared resource, the files appear even though they are not part of the Active Directory tree, as illustrated in Figure 14.6. Active Directory functions in such a way that when you open a published folder, it will locate it in the hierarchy of the “Microsoft Network” and open it there.The published folder is a pointer, not a copy or stored information. In this way, files can be location independent, and users do not need to know on which server a share is located. www.syngress.com

Publishing • Chapter 14

Figure 14.5 Browsing for Shared Resources

Figure 14.6 Shares Appear as Part of Active Directory Until They Are Opened

www.syngress.com

455

456

Chapter 14 • Publishing

Querying Active Directory for shared folders can be done through the Find utility on a Windows 2000 Professional client or a Windows client that has the DS Client installed. Open the My Network Places icon in Windows 2000 Professional (Network Neighborhood in other Windows clients), right-click the domain, and select Find.Then, in the resulting dialog, click the Find drop-down box and select Shared Folders. If you wish to look throughout the entire forest for the shares, or in another domain, you can click the In drop-down box and select Entire Directory or the target domain.You do not need to know the name of the resource, but you can use keywords to narrow your search, as shown in Figure 14.7. Figure 14.7 Using Keywords to Execute a Simple Search

If you want to find shares with a more focused control over the field details, click the Advanced tab.There are five fields that you may use: Description, Keywords, Managed By, Name, and Network Path. Even though the Name and Keywords are available on the first tab, this dialog allows a search looking for exact matches or partial matches for the field’s contents.The options include: ■

Starts with

■

Ends with

■

Is (exactly)

■

Is not

www.syngress.com

Publishing • Chapter 14 ■

Present

■

Not Present

For example, if a network administrator took advantage of the fact that the same share could be published multiple times with different names, in different domains and with different keywords and descriptions, and then moved a share to a new server, the administrator would need to locate all the copies of the shared resource within the directory.This could be done with the Network Path field, as shown in Figure 14.8. Figure 14.8 Using an Advanced Search to Locate Multiple Shares

Overview of Dfs and EFS Understanding the Distributed File System (Dfs) and the Encrypted File System (EFS) will assist in managing a Windows 2000 network.

Dfs Dfs creates a single logical file system tree that can access files and folders residing on multiple servers in various locations.There are two configurations for Dfs: ■

Standalone

■

Fault-tolerant

www.syngress.com

457

458

Chapter 14 • Publishing

When Dfs is standalone, it has little to do with Active Directory, because the Dfs topology is stored on a single computer.When Dfs is fault tolerant, however, the Dfs topology is stored within Active Directory, where it takes advantage of Multi-Master replication to provide redundancy for the Dfs topology. To create either type of Dfs, use the Distributed File System console.The Distributed File System console is located under Administrative Tools.To create a new Dfs root, right-click Distributed File System and select New Dfs Root... This opens the New Dfs Root wizard. Click Next at the introduction screen. When storing the Dfs topology in Active Directory, select the Create a faulttolerant Dfs Root option. Next, the wizard prompts for the domain to host Dfs, a server to host Dfs, a share for the Dfs root, and a name for the Dfs root.To create another root, in the Distributed File System console, right-click the hosting domain and select New Root Replica Member, as shown in Figure 14.9. After that, complete the file system tree by adding Dfs links, which are the names that users see when connecting to Dfs. Note that you are able to hide the Dfs root by rightclicking the root and selecting Remove Display of Dfs Root. Figure 14.9 New Dfs Link

EFS EFS uses a strong public key cryptographic system to encrypt files. A new feature of Windows 2000, it is a highly desirable feature for users who carry laptops or communicate across the Internet. It is preferable to use the certificate authority (CA) service when using EFS. If a CA is available, it can be used to sign the www.syngress.com

Publishing • Chapter 14

public key; otherwise, EFS self-signs the key. CA stores certificates within Active Directory. Encrypting a folder starts with viewing its properties in Windows Explorer. Click Advanced and select Encrypt contents to secure data.The folder and its contents will be encrypted, but the user who encrypted it will be able to access the file transparently. Only when access by an unauthorized person is attempted will the encryption be apparent. A command-line utility called cipher.exe can be used to encrypt or decrypt files as well. The only people who are able to access an encrypted file are the user who encrypted it and the data recovery agent. A data recovery agent is an authorized user who can be added to the Domain or Local security policy, or to the Group Policy Object (GPO) for a computer.

Publishing a Printer in Active Directory Printers are published in Active Directory through the Add Printer wizard of a Windows 2000 computer.The default behavior for a shared printer is a listing in Active Directory. To verify whether a printer is shared in the directory, right-click the printer object and select Properties. Click the Sharing tab.Verify that the box for List in Directory is checked, as shown in Figure 14.10. Figure 14.10 Windows 2000 Printers Listed in Active Directory

www.syngress.com

459

460

Chapter 14 • Publishing

If a legacy Windows NT printer must be shared in Active Directory, you can right-click any container, select New, and then Printer from the pop-up menu. Enter the UNC name for the shared printer. Another method of publishing printers from non-Windows 2000 networks is through the use of the script in Winnt\system32\pubprn.vbs.This Visual Basic script can be executed with the syntax: cscript pubprn.vbs servername "ldap directory services path"

For example, executing the command: Cscript pubprn.vbs \\printserver "LDAP://cn=printers,dc=root,dc=com"

will publish all the printers located on the server named Printserver into the Active Directory OU named Printers within the domain root.com.

Interfacing with Active Directory It’s no secret that there are directory services other than Active Directory.There are many different ways of accessing these directories. Some methods are based on protocols; others are based on application programming interfaces (APIs). Using these methods, two or more directory services can be synchronized. Understanding how these items work will assist in managing and synchronizing multiple directory services. ■

Active Directory Services Interface (ADSI)

■

Remote Procedure Calls (RPC)

■

Windows Sockets (WinSock)

■

Distributed Component Object Model (DCOM)

■

Exchange Active Directory Connector (ADC)

■

Microsoft Directory Service Synchronization for Novell (MSDSS)

ADSI ADSI is an API for Active Directory that is made up of a set of Component Object Model (COM) programming interfaces. ADSI is intended to be used by network administrators to automate Active Directory tasks, and by developers to connect

www.syngress.com

Publishing • Chapter 14

their applications to Active Directory. ADSI has been adopted by vendors to enable connectivity between their directories and any ADSI-enabled application. Four ADSI objects are capable of extending a directory service schema.They are called schema management ADSI objects: ■

Schema container Contains the target directory service schema.

■

Class container Defines object classes for the target directory service.

■

Property object Defines object attributes for the target directory service.

■

Syntax object Further defines the syntax used for a property object.

In addition to schema management objects, ADSI has directory objects that represent the directory service components.There are two types of directory objects: container and leaf objects. Container objects include namespaces, country, locality, organization, OU, domain, and computer. Leaf objects include users, groups, aliases, services, print queues, print devices, print jobs, file service, file shares, sessions, and resources. To manipulate a property value, ADSI uses two commands: GetInfo to read information about a directory service object and refresh cache from the directory, and SetInfo to establish new information for a directory service object to ensure it is written to disk. ADSI uses its own naming convention so that the object can be identified regardless of which namespace it will be ported to. For example, the directory is identified in a string called AdsPath along with the container and object names. A user named Joe in an Active Directory OU named Sales and a domain called CyberLabs.com would have an AdsPath of: LDAP://cn=Joe,ou=Sales,dc=Cyberlabs,dc=com

If you wanted to use ADSI to log on to Active Directory, you could use a script similar to the following: Dim dsobj As IADsOpenDSObject Dim dom As IADsDomain Set dsobj = GetObject("LDAP:") Set dom = dsobj.OpenDSObject("LDAP://DC=Cyberlabs,DC=COM", "MyUser", "password", ADS_SECURE_AUTHENTICATION)

www.syngress.com

461

462

Chapter 14 • Publishing

Another ADSI script can be used to run a backup of Windows 2000 computers. Set cntnr = GetObject("LDAP://OU=W2Kpro, DC=Cyberlabs, DC=COM") Cntnr.Filter = Array("computer") For each comp in cntnr Comp.BackupNow() Next

RPC RPCs are a Session-layer API that makes remote applications appear to be executing locally.The activity of an RPC is completely transparent to the end user. At the Session layer, RPC is able to run over other lower-level protocols such as IPX,Vines, NetBEUI, and TCP/IP. RPCs may use other interprocess communications to access remote systems, including named pipes and WinSock. An application that uses RPCs can place portions of the application on different computers.This is the definition of true client/server networking, in which a server can execute part of the processing and the client executes the remainder.The components of an RPC-enabled application include the items listed in Table 14.1. Table 14.1 RPC Components Component

Component Full Name

Function

Proc Stub

Remote Procedure Stub

RPC RT

RPC Run Time

APP Stub

Application Stub

Proc

Remote Procedure

Packages the calls to be sent to a remote server by RPC RT. Manages the communications between local and remote computers. RPC RT sends RPC requests to APP Stub, which then unwraps the package and sends the call to a remote procedure. The procedure called by the network.

www.syngress.com

Publishing • Chapter 14

Windows Sockets Windows Sockets, also known as WinSock, is a standard interface based on the original Berkeley Sockets interface specification.What Sockets was intended to do was enable multiple applications to be able to access and use the same network connection.The result managed to send data across a network from two or more separate applications.WinSock standardized this system further, and can work over the NetWare-compatible (IPX) protocol, as well as TCP/IP.This is the method employed by Windows 2000 servers to enable a single TCP/IP network connection to be used by multiple services simultaneously.

DCOM DCOM, or the Distributed Component Object Model, is actually a form of network-aware object linking and embedding. It has grown to be a software development system where software objects can be reused and/or replaced. Each object represents multiple sets of functions, with each set being considered an interface.The reason why more than one interface can be supported by a DCOM object is that any change or addition to an interface can only be done with the creation of a new interface.

Exchange Server 5.5 Active Directory Connector One useful thing for an administrator is the ability to synchronize accounts between two systems. Doing so cuts the work in half. Exchange Server 5.5 was capable of synchronizing mailboxes with Windows NT accounts. However, with an upgrade to Windows 2000, Exchange Server can no longer use the same mechanisms to synchronize accounts. Active Directory can be synchronized with Exchange Server using the Active Directory (AD) Connector. Because Exchange Server 2000 uses Active Directory natively, and extends the Active Directory schema with its own set of objects and attributes, it provides a different version of the AD Connector. If you are using Exchange Server 2000, you should select the AD Connector that ships with Exchange 2000. The technical requirements for deploying the Exchange Server Active Directory connector are as follows: ■

For each Active Directory domain, plan to have at least one Active Directory Connector server.

■

Exchange Server 5.5 must be installed with Service Pack 2, at a minimum. www.syngress.com

463

464

Chapter 14 • Publishing ■

Exchange Server’s LDAP port must be changed to a port number that will not conflict with Active Directory.

■

If upgrading a Windows NT domain, first complete the upgrade to Windows 2000 before implementing the connector in order to avoid duplicate accounts.

■

Whenever possible, place the AD Connector server on the same subnet as the Exchange Server bridgehead to Active Directory.

If a single Active Directory domain is connected to a single Exchange site, the requirements are simplified: a single AD Connector with two primary connection agreements (each connection agreement is configured from its starting point), one pointing at Exchange from Active Directory, and the other pointing at Active Directory from Exchange. Even though the connection agreement is configured from a starting point, it can designate either one-way or two-way traffic. Select two-way if you are unsure which your connection should be. When two Active Directory domains are connected to a single Exchange site, a decision must be made as to which domain will be the primary connection for Exchange.To avoid confusion over which is the master over the connection, always designate the domain closest to the root of the Active Directory forest to be the primary connection. When there are multiple sites and multiple domains, there can be any number of complex arrangements for connections. In these situations, planning is essential to ensure that redundant connections do not end up creating multiple duplicate accounts in either Exchange or Active Directory.There should only be one primary connection pointing to each Active Directory domain. Likewise, there should only be one primary connection pointing to each Exchange Server site. Bridgehead servers should be designated for the connections between Exchange and Active Directory.When designating a bridgehead server for Exchange, select any servers that are solely used as gateways or “connector servers” first. After that, select a server that is well connected to the network and has available resources for the connection processing overhead.When designating a bridgehead server for Active Directory, select a Global Catalog (GC) server first, a DC second, and a member server last. Also select a server that is well connected to the network and has available processing resources. To install the Exchange Server Active Directory Connector, look on the Windows 2000 Server CD-ROM for the \valueadd\msft\mgmt\adc directory.

www.syngress.com

Publishing • Chapter 14

Execute the setup.exe program to begin the Active Directory Connector Installation Wizard.When prompted for the component selection, select both the Microsoft Active Directory Connector Service and Microsoft Active Directory Connector Management components. Specify the install folder for ADC. Finally, designate a service account to manage the connection, and then finish the wizard. There will be a new program in the Administrative Tools menu called Active Directory Connector Management.This is the program used to configure the connector. Open it, right-click the Active Directory Connector Management object, and select Properties from the pop-up menu.The default properties for information originating in Exchange and for information originating in Active Directory will be available in this dialog after creating a new connection agreement.To create a connection agreement, right-click the Active Directory Connector for your server, select New, and then Connection Agreement. After configuring the connector, you can create new users in Active Directory or new mailboxes in Exchange, or change information to verify that communication is taking place.

Exchange Server 2000 When Microsoft developed Exchange Server 2000, they began to look at scalability of services in the network. As a result, Exchange Server 2000 does not include its own directory service as past versions had. In fact, Exchange Server offloads other services, such as Internet protocol services being offloaded to IIS, to systems that already manage that in the base Windows 2000 server operating system. Since Exchange Server 2000 does not include its own directory service (it uses Active Directory’s), the Exchange service does not place as heavy a load on the server. Active Directory uses the same type of storage system as Exchange 5.5 did—an Extensible Storage Engine (ESE). One of the advantages that Active Directory has over legacy Exchange is in its per-attribute replication.This means that when an update is made to an object in Active Directory, only the attribute values that have changed will be replicated, not the entire object.This lessens the bandwidth consumed by updates to the directory service, as shown in Figure 14.11. It also uses less processing power on the DCs.

www.syngress.com

465

466

Chapter 14 • Publishing

Figure 14.11 Per-Attribute Replication Uses Less Processing Power and Bandwidth Legacy Exchange Server Legacy Exchange Server Update is made on this server

Replication Traffic consists of the entire object replicated to other Exchange Servers

Legacy Exchange Server Legacy Exchange Server Replication

Domain Controller Domain Controller Update is made on this server

Replication Traffic consists of a portion of the object replicated to other DCs

Domain Controller Exchange Server 2000 Attribute Replication in Active Directory

You do not need to run Exchange Server 2000 on DCs; however, the Exchange Server must be able to contact DCs. In order to implement Active Directory with Exchange Server 2000, you must do the following: 1. Install or configure DNS to work with your future Active Directory. 2. Install Windows 2000 Server. 3. Update Windows 2000 with the latest service pack (at a minimum, you must have Service Pack 1 installed). 4. Run Dcpromo on all your DCs, in their appropriate domains, to implement Active Directory. www.syngress.com

Publishing • Chapter 14

5. Configure Active Directory to meet your design for OUs and sites. 6. Log on to the network with Schema Administrator and Enterprise Administrator privileges. 7. Prepare the forest for Exchange Server 2000, using the CD_Drive:\ setup\i386\setup /forestprep command. (You can create a new Organization or join an existing Exchange 5.5 Organization.There can only be one Organization per forest.) 8. Either wait for the new schema extensions to be replicated to the rest of the forest, or force replication using the REPAdmin or REPLMon utilities, or even via the Active Directory Sites and Services console by rightclicking on each Connection Object and selecting Replicate Now from the pop-up menu. 9. Prepare the domains for Exchange Server 2000, using the CD_Drive:\setup\i386\setup /domainprep command. 10. Install Exchange Server using the CD_DRIVE:\setup\i386\setup command. 11. Begin configuring Exchange Server 2000 for use on your network, such as adding Mail Exchange (MX) records for new Internet mail servers. ForestPrep will extend the schema for the entire forest, which is why you must be logged on with schema administrator and enterprise administrator privileges.You therefore only need to run ForestPrep once per forest. During ForestPrep, the Exchange Organization is installed. All Exchange Servers that are installed into that forest in the future will be members of that Exchange Server Organization.The dialog box in Figure 14.12 shows where you will be asked to input the Organization name. The Active Directory schema must be extended to include the objects and the attributes that will support Exchange Server 2000 messaging. Such extensions include the mailbox tabs for user objects.

www.syngress.com

467

468

Chapter 14 • Publishing

Figure 14.12 Organization Name Assigned During ForestPrep

www.syngress.com

Publishing • Chapter 14

Summary Published resources are network shares or printers that are enabled for access via the Active Directory. After being published, a resource can be either browsed or queried from an Active Directory-aware application. For example, a file resource can be viewed from below the Directory location in the My Network Places icon on any Windows 2000 PC when the user has access to it. Published resources should be placed in containers that are meaningful to the users who access them.Whenever possible, a resource should be published in the containers of the users who access the resource the most. Windows 2000 printers are published by default when they are created as network printers on Windows 2000 servers. If a Windows 2000 printer has been unpublished, and it is desired for that printer to be published, the administrator can change the Sharing properties for that printer, making certain that the check box to List in the Directory is checked. To publish a legacy NT printer, the administrator can right-click in any container in the Active Directory Users and Computers console, select New, and then Printer. After supplying the location and description, the printer is published as an object. To publish a folder in Active Directory, it must first be shared as a resource on the network.Then, the administrator can right-click any container in the Active Directory Users and Computers console, select New, and then Shared Folder. After supplying the location of the share and new name for it, the folder is published as an object. RPC, DCOM, and WinSock are all part of a developer system for networkaware Windows applications.These work alongside the Active Directory Services Interface to provide a method for both administrators and developers to manage and extend Active Directory.

Solutions Fast Track Publishing Resources  Publishing resources, such as files and printers, enables users to easily

locate the resources that are nearby or meet certain criteria.  In order to publish a file, you must first share it through a standard

Windows shared folder. www.syngress.com

469

470

Chapter 14 • Publishing

 When you publish a folder in Active Directory, right-click on an OU in

the Active Directory Users and Computers MMC, select New | Shared Folder, and then point to the resource that you are sharing.  Workstations with Active Directory client extensions can conduct a

search pointing in Active Directory, or even browse through Active Directory, to locate shared files.  The Distributed File System (Dfs) is not fault tolerant unless you inte-

grate it with Active Directory.  When storing the Dfs topology in Active Directory, select the Create a

fault-tolerant Dfs Root during the creation of the root of the Dfs tree.  The Encrypting File System (EFS) uses strong public key cryptography

to encrypt files stored on a hard drive. EFS is intended for local storage of encrypted files.  To publish a printer in Active Directory, you use the Add Printer wizard.

By default, all printers are automatically published in Active Directory.  You will not see published printers by browsing in the Active Directory

MMCs, but users can find them by querying for printers.

Interfacing with Active Directory  ADSI is an API used to interface with Active Directory. Programmers

can develop applications to extend the schema using ADSI.  Remote Procedure Calls (RPCs) run over TCP/IP—although they can

also run over other protocols—to interface with Active Directory. RPCs are used for replication traffic and for the traffic between clients and DCs.  Windows 2000 servers use WinSock to enable multiple services to use

the same TCP/IP connection simultaneously.  The Exchange Server 5.5 Active Directory Connector can interface the

directory service contained within Exchange 5.5 with Active Directory, so that Active Directory users can be linked to Exchange 5.5 mailboxes.  Exchange Server 2000 extends the Active Directory schema to include

the objects and attributes required for Exchange messaging.The ForestPrep process will extend the schema for the forest, and only needs to be executed once. www.syngress.com

Publishing • Chapter 14

 There is only one Exchange Server 2000 Organization per Active

Directory forest.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: When I right-click a container and select New | Printer, I receive a dialog for a printer share. I put in the printer share, but then receive an error saying that this is a Windows 2000 printer and must be listed elsewhere.What am I doing wrong?

A: Nothing.The printer object that shows up in the pop-up menu for containers is a pointer to legacy Windows NT printers. Active Directory does check to make sure that the printer is available before publishing it in the directory, and it also checks to make sure that the printer is a legacy Windows NT printer.Windows 2000 network printers are listed in Active Directory by default when their print queue is created in the Printers folder.The Sharing tab for a Windows 2000 printer’s properties will show whether the printer is shared.

Q: Why can’t I browse shared files in the Active Directory Users and Computers console?

A: The Active Directory Users and Computers MMC lists the users and computer objects actually stored in the Active Directory database.When a published folder is listed in Active Directory, it is actually a pointer to a shared resource.The folders and files are not stored in the Active Directory database, just the pointer.When a user queries for folders, and clicks on the pointer, it automatically points the user to the resources and displays them.

Q: Why aren’t printers listed in the Active Directory MMCs? A: This is the default behavior of shared printers and Active Directory.

www.syngress.com

471

472

Chapter 14 • Publishing

Q: I was able to install Exchange Server 2000 without running ForestPrep.Why? A: When you install Exchange Server 2000 for the first time on a DC, the ForestPrep and DomainPrep processes automatically execute without needing to be run separately.

Q: Do I need to have the Active Directory Connector for an Exchange Server 2000 Organization?

A: No. Exchange Server 2000 interfaces directly with Active Directory, so there is no need to implement an Active Directory Connector.

www.syngress.com

Chapter 15

Modifying the Schema

Solutions in this chapter: ■

About Objects and Attributes

■

Planning Schema Modifications

■

How to Modify the Schema

■

Schema Container

 Summary  Solutions Fast Track  Frequently Asked Questions

473

474

Chapter 15 • Modifying the Schema

Introduction What is a schema? How do you modify the schema? How often should you modify the schema? Who should modify the schema? At the very least, the schema is a source of concern to network administrators as they contemplate their new Active Directory. Active Directory is a database that uses Multi-Master replication.The database has a list of objects that it can contain.Whenever a new object is created, it is selected from that list. Each object has its own attributes, such as a user account First Name.This list of objects and all their possible attributes make up the schema. Active Directory is an extensible system.The originally installed list of objects can grow over time to include others. New applications can be created to take advantage of the existing schema, and they can create new objects or properties of objects to be added to the schema. Network administrators may want to add attributes to objects to meet their own specific business requirements.Whether an application or an administrator makes the change, this process is called extending the schema.

About Objects and Attributes The schema defines classes of objects and their attributes for Active Directory. An object class is simply the type of object, such as a user account, and all its applicable attributes, such as the user’s first and last names.When Active Directory is populated with objects, the new objects are considered instances of the object class. Each object class contains both Mandatory and Optional attributes.The attributes also have a syntax, which explains what type of data can be contained in an instance of the object class.The postalCode attribute for an instance of a user object can only have a numeric value; therefore, its syntax is string(numeric). The definitions of the Active Directory objects and attributes are contained in schema objects. A classSchema object defines an Active Directory object, and an attributeSchema object defines an attribute.When a classSchema object lists attributes under mustContain, those attributes are mandatory.Those listed under mayContain are optional. Figure 15.1 illustrates the relationship between objects and attributes.

www.syngress.com

Modifying the Schema • Chapter 15

Figure 15.1 The Relationship between Objects and Attributes Resulting Active Directory Object and Values Schema Definition Object Class and Attributes Object Class: Group

Name: GroupA

Member1

Attribute: Name Attribute: Members Member2

Planning Schema Modifications Modifying the schema is not something that every user should be able to do. There are limited capabilities for removing object classes and attributes that are native to the Active Directory schema.The limits are in place to prevent disasters. What if the unthinkable happened where there were no precautions in place against schema modification, and a user removed the User object class from the schema by deactivating it? (Don’t worry, the default schema cannot be deactivated because Active Directory protects against that, but objects that you add later can be deactivated. Back to the hypothetical situation…) The network would completely shut down. No users could log on; not even the administrator.Why? Because there would be no user objects defined anymore.What a disaster! This is merely a hypothetical situation to illustrate how important the schema objects are.This situation demonstrates the need not only to plan when to modify the schema, but also who should be granted this capability.

Why Modify the Schema? Knowing that making a change to the schema could be a disaster, one might wonder why it would ever need to be modified. Microsoft created Active Directory to be a customizable service that would provide more than simple logon and network security service. Network administrators can modify Active Directory to meet business requirements. For example, a corporation can use Active Directory for Human Resource information tracking. For some corporations this may be an ideal usage, since the

www.syngress.com

475

476

Chapter 15 • Modifying the Schema

identity information will be maintained in a single place with the network security rights. Additionally, Active Directory will automatically replicate the identity information throughout the enterprise network. Making changes to the schema can be destructive to the enterprise network if mishandled.Whenever possible, the existing objects and attributes should be used instead of creating new ones.

When to Modify the Schema Change management procedures should always be followed when modifying the schema. Modifying the schema is a task that can interrupt how Active Directory works, especially if there is a failure of some sort. Use the following evaluations to determine when to modify the schema: ■

Review the existing schema to ensure that the attributes or objects required are not already available in Active Directory.

■

Make sure to plan the schema changes before testing and implementing them.

■

Always test a schema modification on a separate forest before implementing.

■

Reserve universal changes for weekend implementations. Universal changes are those that affect a majority of users in a majority of sites. Schema changes fit this definition.

■

Only modify the schema when necessary, because the changes cannot be reversed.

Who Should Modify the Schema? There is a Schema Admins global group in Active Directory that has full control over the schema.The properties for this group in the Schema Management console are shown in Figure 15.2. To ensure that schema changes are controlled so that unexpected changes are not propagated throughout a production network, there should be guidelines established for all members of the Schema Admins group to follow.These guidelines include: ■

The criteria for changing schema

■

The criteria for being able to join the Schema Admins group

www.syngress.com

Modifying the Schema • Chapter 15 ■

The membership of the Schema Admins group

■

How users can apply for a schema change

■

The evaluation of the schema change

Figure 15.2 Schema Administrators Group Properties

Configuring & Implementing… Think Twice Before Modifying the Schema Modifying the schema is an advanced administrative right for a good reason. There are impacts and potential problems that can raise their ugly little heads whenever a change is made. The issues revolve around: ■

Creating invalid objects in Active Directory

■

Replication impacts to the network

No one intends to create invalid objects, but as an example let’s look at a user account named Joe. It has an attribute that is called Spouse that the administrator added to the schema and then placed the value “Mary” into the Joe object instance. Later, it is decided that the Spouse attribute is not required, so the administrator deletes it from the schema. Joe’s object is not like the rest because it has the Mary value in an attribute that does not exist. Active Directory lets Joe’s object remain Continued

www.syngress.com

477

478

Chapter 15 • Modifying the Schema

in the forest, but it does not clean up the invalid attribute. Instead, the administrator must perform a query and delete that attribute manually. Replication (discussed in Chapter 6, “Designing a Site Structure”) is affected whenever a schema change is made. That change is replicated to every domain controller (DC) in a forest. Latency inherent in the propagation process and exacerbated by replication schedules will cause a temporary inconsistency in the schema between various DCs. Objects that are created during the inconsistency period can be replicated before the schema changes, which results in a failure. Active Directory responds to the failure by initiating a new, explicit schema replication from the DC where the schema was changed.

Finally, the Schema Admins group should consist of a small, select group of administrators with the skills and authority to make changes to the schema. When you plan your Active Directory, you should be careful about upgrading an existing Windows NT domain into the forest root domain.When you do so, the members of that domain’s Domain Admins group are migrated to Enterprise administrators.These members have the ability to add themselves to the Schema Administrators group. If one of them had the access to the Schema FSMO, or captured that role to another DC, that person could extend the schema unintentionally. Consider also that any existing user accounts that are used for services such as backup applications will also have this extended capability. Since many applications use default names and some even offer default passwords for such accounts, these can be easy for a hacker to break into and grab control of your entire Active Directory.This is one of the reasons for creating an “empty” new domain at the root of the forest—to secure the Enterprise Administrators and Schema Administrators memberships.

Schema Management Console The Schema Management console enables the Schema Administrators to access and change the schema in Active Directory using a graphical interface. Not only does it enable the Schema Administrators to edit or create schema object classes and attributes, it also lets them select which object classes and attributes should be available in the Global Catalog (GC).This console is shown in Figure 15.3. In the Schema Manager, the left pane displays the scope of the schema, and the right pane displays the results.The top container, or node, in the left pane is the root node containing the forest schema, and the two below it are the class

www.syngress.com

Modifying the Schema • Chapter 15

node and the attributes node, which contain schema specifiers for classes and attributes, respectively. Figure 15.3 Schema Management Console

Flexible Single Master Operation Make sure that the Schema Manager console specifies the Operations Master for the schema of your forest.The Operations Master for the schema is a role that is granted to a single DC for making updates to the schema. Only one DC at a time can occupy this role. After the changes are completed, they are replicated to the remaining DCs in the forest.To see the Operations Master role, open the Schema Manager console, right-click on Active Directory Schema Manager root, and select Operations Master from the pop-up menu. Make sure that the box for The Schema may be modified on this server is checked, as shown in Figure 15.4. Checking this box sets the value “Schema Update Allowed” to 1 under the registry key HKLM\System\CurrentControlSet\Services\NTDS\Parameters.This method of enabling any DC to be a single master of the schema is called the Flexible Single Master Operation model, or FSMO (pronounced FIZZ-MO, a name which, I believe, reflects the excessive consumption of cola at Microsoft).

www.syngress.com

479

480

Chapter 15 • Modifying the Schema

Figure 15.4 FSMO Schema Master

NOTE The Schema Manager is not a utility that shows up in any menu, and can only be found in the Resource Kit utilities. First, the Resource Kit must be installed. Then, open the Schema Manager (schmmgmt.exe) and select the Console menu. Click Save As and save the file to the Documents and Settings\\Start Menu\Programs\Administrative Tools directory. You can rename the file from schmmgmt to Schema Manager at the same time.

There are five FSMO roles in Windows 2000: ■

Schema Master Controls schema updates.

■

Domain Naming Master Controls all the additions and removals of domains from Active Directory.

■

RID Master Controls the allocation of Relative IDs (RIDs). Relative IDs are allocated as a sequence of numbers to each domain.The RID is concatenated with the domain’s SID (Security Identifier) whenever a new object is created, and then assigned to the new object as a unique object SID.

■

PDC Emulator In mixed mode, the primary domain controller (PDC) emulator controls backup domain controller (BDC) replication and

www.syngress.com

Modifying the Schema • Chapter 15

backward compatibility. In native mode, the PDC emulator controls password updates. ■

Infrastructure Master Controls group-to-user references, so that updates of group memberships are propagated throughout Active Directory.

You can view various FSMO roles whenever you see the Operations Master option in an Active Directory console menu or pop-up menu.

How to Modify the Schema The schema can be modified through the addition, deletion, or updates to any objects or attributes within it.The schema is the structure of Active Directory and manages how the content of Active Directory is presented to users, administrators, and applications.When changes are made to the schema, Active Directory validates the changes to make sure that the entire Active Directory database retains integrity. Mergers and acquisitions of companies are complicated by the need to merge infrastructure technology.You cannot merge two forests without using a thirdparty tool to move user and computer objects from their old domain to a new destination domain.You also need to consider the schema of those objects. If you need to move an object from a forest that supports a schema extension to a forest that does not include that extension, be aware that either the entire object or the extended attributes will not be understood by the destination forest (depending on what part of the schema was extended in the former forest).You should be vigilant when selecting your tool—make certain to choose one that can determine schema extensions and their effect during migration. If the schema extensions are not needed, you may decide to create an entirely new forest and migrate objects from both former forests to it.

Class It is recommended to create attributes before creating classes so that new attributes can be designated as Mandatory in the class. A new class can be created without creating any new attributes, however. Before creating a new class of object in the schema, the information listed in Table 15.1 should be determined.

www.syngress.com

481

482

Chapter 15 • Modifying the Schema

Table 15.1 Object Class Information Needed for New Object Class Object LDAP Property Dialog Options Name Common name

Cn

Function

Name of the class of object. This name must be unique in the schema. LDAP Display LDAPDisplayName This name, similar to the common name, is used by programmers and is guaranteed to be unique. It has a format of being multiple words concatenated with capitals separating each word, but the first letter being lowercase. X.500 Object ID objectIdentifier This is a unique number X.500 OID where each set of numbers is separated by a period. It is guaranteed to be unique worldwide for standard object classes since it is usually issued by a standards organization, including the ISO, ITU, and ANSI. If creating a new class, the OID (Object ID) can be obtained from these standards groups. It is not recommended that you make up a number for this, since it could conflict with other classes that are added later. The class from which Parent Class PossSuperiors the new class will inherit default attributes. If a new object is a subclass of

Example My Object

myObject

1.1.111.111111 .1.1.111

ParentClass

Continued

www.syngress.com

Modifying the Schema • Chapter 15

Table 15.1 Continued Class Object LDAP Property Dialog Options Name

Class Type

objectClass

Function

Example

Person, it will inherit all the Person attributes. Person is a subclass of top, and inherits all the top attributes. The class type is an Abstract X.500 class type. There Auxiliary are three from the 1993 Structural X.500 definition: Abstract Template class for all three types of classes. Auxiliary List of attributes that can be included in Structural and Abstract classes. Structural True object class that will enable new objects to be created within Active Directory. There is one class type from the 1988 X.500 definition: 88. 88 does not have the same structure as the other classes, and is not available within Active Directory.

Follow these steps to create a new class in the Schema Manager console: 1. Right-click the Classes Node in the Schema Manager. 2. In the pop-up menu, click Create Class. 3. A warning will appear, as shown in Figure 15.5. Click Continue to bypass it.

www.syngress.com

483

484

Chapter 15 • Modifying the Schema

Figure 15.5 Class Object Creation Warning

4. In the Create New Schema Class dialog box illustrated in Figure 15.6, complete the information that was listed in Table 15.1, and click Next to continue. Figure 15.6 Create New Schema Class Dialog

5. In the next dialog, shown in Figure 15.7, you can select the attributes that will be part of this class. Add any attributes that an administrator must fill out when creating one of the instances of this object to the Mandatory section by clicking Add next to the section and selecting the attributes. Add any discretionary attributes to the Optional section by clicking Add next to the Optional section.You do not need to add any attributes, although some will be added by default. 6. Click Finish to create the object. 7. Expand the Classes node by clicking the plus sign to its left in the scope pane. 8. Under the Classes node, locate the new object and select it.The Results pane will display all the attributes that were added, along with many that are automatically defaults of that type of class.The attributes that are www.syngress.com

Modifying the Schema • Chapter 15

inherited are displayed with the name of the parent class in the Source Class column.These are shown in Figure 15.8. Figure 15.7 Adding Attributes to a New Class

Figure 15.8 New Class Object and Default Attributes

Once a class has been created, it can be modified by right-clicking the class and selecting Properties.The resulting dialog allows the administrator to change the selected attributes, the description, the possible superiors, and security. It also lets the administrator deactivate the object or enable it to be browsed in Active www.syngress.com

485

486

Chapter 15 • Modifying the Schema

Directory by checking the boxes for these options on the General tab, which is shown in Figure 15.9. Note that some of the properties are grayed out, and therefore cannot be changed.These include the Common Name, the X.500 Object Identifier, and the Class Type. Figure 15.9 Class Properties

Inheritance occurs when one object class is designated as a parent to another. This designation enables the attributes of that parent class to flow down to the child class. For example, when making a new class a child of a User class, all the attributes of Users will be available as part of the new class.To change the inheritance of the object or the attributes that it uses by default, select the Relationship tab. Click Add next to Auxiliary classes in order to select a list of attributes that should be included in this class.Then select an Auxiliary class from the list of available schema objects and click OK.The new attributes will be added to the defaults in the results pane when you are finished.

NOTE When applying for an X.500 Object ID in the United States, you can contact the American National Standards Institute (ANSI) via the Internet at www.ansi.org. ANSI will assign a subset of the X.500 OID hierarchy, which is termed an arc. This is essentially a set of numbers that can be further subdivided into subarcs, and used for multiple X.500 objects and attributes.

www.syngress.com

Modifying the Schema • Chapter 15

To add the inheritance from parent classes, click Add next to the Possible Superiors box, and Add a class from the list that appears. After clicking OK for either of these operations, the possible superior’s or auxiliary class’s X.500 Object Identifier will appear in the window, as illustrated in Figure 15.10. Figure 15.10 X.500 OID Appears When Adding a Possible Superior or Auxiliary Class

To select or deselect attributes for the class, click the Attributes tab, which is shown in Figure 15.11.You cannot add or remove any Mandatory attributes, but you are able to add or remove Optional attributes, even if they were added during the object’s creation.The process is the same as during the creation of the class. Figure 15.11 Adding Attributes After Class Creation

www.syngress.com

487

488

Chapter 15 • Modifying the Schema

Configuring & Implementing… Deactivating an Object Class The objects in the original Active Directory schema cannot be deactivated; however, those that are added later can be. Deleting a schema object is not supported by Active Directory because of the inconsistencies that could result. Deactivation is the next best thing since the object class is unusable, but the instances of the class can still exist, just not be newly created. The object class can be deactivated by checking the box in the Schema Manager. The object class can be reactivated by unchecking it later. When a class is deactivated, it cannot be added as an instance afterward. Those existing instances cannot be modified. Queries made by users, or deletions of Active Directory instances, can still occur as though nothing has happened. After deactivation, schema updates will only modify the isDefunct attribute of the schema object. The isDefunct attribute is set to true when the object is deactivated. No other modifications will be made except for that isDefunct attribute value.

Attributes When creating new object class that includes new attributes, it is recommended that the attributes be created first.Then, the new class can use the new attributes immediately upon creation.The attribute requires the same common name, Lightweight Directory Access Protocol (LDAP) display name, and Unique X.500 Object Identifier that is required by a new class object. Additionally, the new attribute will require the information contained in Table 15.2. Table 15.2 Required Information for a New Attribute Dialog Options

Purpose

Syntax

The syntax determines what type of information can be contained. This field is a drop-down list with several options, including Octet string (such as an IP address) and Boolean (true and false values). Continued

www.syngress.com

Modifying the Schema • Chapter 15

Table 15.2 Continued Dialog Options

Purpose

Minimum

This is the lower limit on the syntax’s value. For example, if using an Integer syntax, the default lower limit is 0, but placing 1 here will eliminate 0 from being used. This is the maximum limit on the syntax’s value. If using a String syntax, the maximum limit would be the length of the string. Placing 50 in this field would limit a String syntax attribute to 50 characters. When checking this box, it means that the attribute can have a one-to-many relationship with the resulting properties. For example, a multi-valued item is the Possible Superiors attribute. There can be many superior class objects. However, each Boolean attribute (true/false) can only be single-valued, since an item should not be true and false at the same time.

Maximum

Multi-Valued

In order to create a new attribute, you must start with the Schema Manager. 1. Right-click on the Attributes node in the Scope panel. 2. Select New Attribute. 3. Click Continue to bypass the warning. (It is identical to Figure 15.5.) 4. The Create New Attribute dialog box will appear, as illustrated in Figure 15.12.Type in the Common Name, LDAP Display, and X.500 OID, as well as the information determined for the items in Table 15.2, and click OK. The object will be created and will appear in the Results window in the Attributes node. The attribute can be modified somewhat after it is created.This is done by double-clicking the attribute in the Results pane, or right-clicking it and selecting Properties. Note that the Common Name, X.500 OID, and Syntax are grayed out and cannot be changed.There is a statement about whether the attribute is multi-valued or single-valued, and that cannot be altered either.The remaining items can be updated.

www.syngress.com

489

490

Chapter 15 • Modifying the Schema

Figure 15.12 Create New Attribute Dialog

System Checks after Schema Modification Two types of safeguards have been put in place to ensure that no problems will result from schema modification: ■

Safety checks

■

Consistency checks

The safety check reduces the possibility of schema modifications interrupting an Active Directory application that uses the object class or attribute that has been changed. Safety checks are simply the items that cannot be modified after a class has been created, and the items that cannot be changed on default schema objects, such as adding a new Mandatory attribute on a class. Consistency checks are the method that Active Directory undertakes to ensure that certain values must remain unique, such as the LDAP Display, Common Name, and X.500 OID. An addition of a new object will only be successful if these items and any other unique attributes are verified as unique throughout the Active Directory forest. Aside from these and other verifications, the Consistency check will ensure that: ■

All attributes and classes designated during object class creation or modification already exist within the schema.

■

All classes designated as Auxiliary have an Auxiliary class specification.

■

The rDNAttID attribute uses the syntax for String(Unicode).

■

The minimum value of an attribute is lower than the maximum value.

www.syngress.com

Modifying the Schema • Chapter 15

NOTE The rDNAttID attribute defines the naming convention used in the Active Directory schema. Because its applicability is universal, it is critical that it is consistent.

Schema Container The Schema container holds the entire schema, inclusive of attribute and class definitions. It must be replicated to each DC that is part of the same forest.The Schema container is located in the Configuration container, at cn=Schema, cn=Configuration, dc=mysubdomain, dc=mydomain, dc=com.The Schema Configuration container cannot be viewed with the default Windows 2000 Active Directory tools; however, it can be seen using the following Resource Kit utilities: ■

Schema Manager

■

ADSI Edit

■

LDP

The first time that ADSI Edit is executed, the user must connect to a naming context.This requires right-clicking the ADSI Edit container and selecting Connect to from the pop-up menu.The ADSI Edit tool must be pointed to the schema in order to see it.This requires right-clicking the root and selecting Settings, then changing the Naming Context to Schema.The result will be the screen shown in Figure 15.13.

The Cache When a DC initializes, it reads the schema from the Schema container into memory.This version of the schema sitting in RAM is called the schema cache. Whenever changes are made to the schema, they are validated against the schema cache rather than the schema on the hard drive to enhance performance.Whenever replication or changes are made, they are first made to the schema on the DC’s hard drive and then are automatically updated in the cache five minutes after the first change was made.The file on the hard drive that initializes the schema when it is first installed is the SCHEMA.INI.file located in %systemroot%\ntds.The Active Directory database is the NTDS.DIT that is located in the %systemroot%\ntds www.syngress.com

491

492

Chapter 15 • Modifying the Schema

directory by default. NTDS.DIT contains the entire Active Directory, including schema and GC. Figure 15.13 ADSI Edit Displays the Schema Container

The tables in the schema cache are called ATTCACHE and CLASSCACHE, and represent each attribute and class in the schema.There are hash tables of ATTCACHE and CLASSCACHE to enable lookups in the cache.The table sizes are dynamic, based on the number of items (attributes and classes) that exist in the schema.The table sizes increase or decrease based on the schema changes made. The schema cache is updated every five minutes.This means that changes made to the schema may not appear immediately.To update the schema cache from the hard drive without waiting for the five-minute interval to pass, in the Schema Manager, right-click the Active Directory Schema Manager root node and select Reload the Schema as illustrated in Figure 15.14.

Schema Utilities The Schema Manager is not the only utility that can update the schema, although it is probably the most user friendly. LDIFDE and CSVDE are two command-line tools that can also update it, as well as ADSI Edit.

www.syngress.com

Modifying the Schema • Chapter 15

Figure 15.14 Updating the Schema Cache

LDIFDE and CSVDE are two data format exchange utilities.The first, LDIFDE, uses LDAP Data Interchange Format.The second, CSVDE, uses a Comma Separated Value. Both of these utilities take files that contain data to be added or modified in Active Directory (LDIFDE can modify, CSVDE can only add), and import them to Active Directory. Both of these utilities can also export directory data from Active Directory. It is recommended that the Schema Manager be used to update the schema. For die-hard command-line utility users, the following is an LDIFDE file format representing an addition to the schema. Because CSVDE does not have as many features as LDIFDE, it is recommended that LDIFDE be used for the commandline format tool: dn: CN=myAttribute,CN=schema,CN=configuration,dc=microage, dc=melissacraft,dc=com changetype: add objectClass: attributeSchema ldapDisplayName: myAttribute adminDisplayName: my-attribute adminDescription: A new schema attribute attributeID: 1.2.840.113557.8.8.999 attributeSyntax: 2.5.5.12 omSyntax: 64 isSingleValued: TRUE systemOnly: FALSE searchFlags: 0 showInAdvancedViewOnly: FALSE

www.syngress.com

493

494

Chapter 15 • Modifying the Schema

Querying Active Directory The schema affects end users in a fundamental way. It provides the basic layout of information about users, computers, and other Active Directory objects.This layout is copied fully within each domain and partially to the forest’s GC. First, an attribute has to be replicated to the GC.This is accomplished in the Schema Manager by double-clicking any attribute and selecting Replicate this attribute to the Global Catalog, as shown in Figure 15.15. Figure 15.15 Making Attributes Available in the GC

Display Specifiers The user interface can be specified for each object within Active Directory.The user interface information is stored in an Active Directory object called a display specifier. The storage of the user interface information (UI) plus the ability to secure who sees which attributes allows Active Directory to adapt to the needs of both end users and administrators. For example, a network administrator JUNE may create a display specifier for CUBE NUMBER as an attribute for a user account that only administrators need to see.The PAYROLL business unit may also want to add display specifiers for SALARY and VACATION HOURS, but would not want JUNE to see the values for those fields. Both JUNE and the PAYROLL unit can add the display specifiers and then apply security to them so that JUNE cannot see SALARY and VACATION HOURS, and PAYROLL cannot see CUBE NUMBER. www.syngress.com

Modifying the Schema • Chapter 15

Display specifiers are Active Directory objects stored in cn=Display Specifiers, cn=Configuration, dc=mydomain, dc=com.They include property sheets, context menus and icons, and more. Display specifiers are available in the ADSI Edit utility. A Display-specifier object’s properties are shown in Figure 15.16. Figure 15.16 Display-Specifier Object

www.syngress.com

495

496

Chapter 15 • Modifying the Schema

Summary The Active Directory schema is the underlying layout for the Active Directory database. It is comprised of classes of objects and attributes.The objects that are within the Active Directory are instances of the schema classes.The properties of these objects are the schema attributes. The schema is replicated in its own container, which is located in the Configuration container, to all domain controllers (DCs) within a forest. Each DC loads the schema into a memory cache.This cache is updated at five-minute intervals with any changes that are made to the schema that resides on the DC’s hard drive. Only after the schema cache is updated will the new updates be seen in the schema. The schema is a critical underlying support factor to the Active Directory. It controls the structure and content that users and administrators see when browsing the Active Directory. Active Directory-aware applications and administrators both may need to extend the schema to include more objects or attributes. The only group that has access to the schema is the Schema Admins group. There can only be a single DC with the capability to extend the schema, since it uses the Flexible Single Master Operations (FSMO) method. FSMO lets any DC become the Operations Master for the schema, but only one DC at a time. Planning for changes to the schema should be managed with a change management policy that establishes who has the capability to change the schema, and under what conditions.The changes are best implemented during times when the internetwork is least busy. If possible, schema changes should be tested on a separate lab forest before being placed into use on a production network. Additions and modifications to the schema can be made in several utilities: ■

Schema Manager console

■

ADSI Edit

■

LDIFDE

■

CSVDE

It is recommended that the schema changes be made in the Schema Manager console because of its user-friendly interface.When a new class or attribute is added, it should have the complete information documented prior to its implementation, since the schema safety and consistency checks will not allow some changes to be made to the attribute or class after its creation. Classes and

www.syngress.com

Modifying the Schema • Chapter 15

attributes cannot be deleted, but they can be deactivated. Classes and attributes within the default schema that Active Directory starts with cannot be deactivated. When a new attribute is created, it must be replicated to the Global Catalog (GC) in order for users to search for objects based on that attribute.This is available as a property of the attribute. Users and administrators can easily search for objects within the Active Directory Users and Computers console.

Solutions Fast Track About Objects and Attributes  An object class describes the types of objects that can be placed in the

Active Directory. A user account is an object class. A user account named JUSER is considered an instance of the user object class.  An attribute class describes the types of attributes that can be assigned to

object classes. An IP address is an attribute class.The IP address can be an attribute of the Server object class.  The classSchema object is used for object classes.The attributeSchema

object is used for attribute classes.

Planning Schema Modifications  You can modify the schema, or extend it to include new types of object

classes and attribute classes.  Schema additions are permanent and cannot be deleted, only disabled.  When you intend to extend the schema, you should plan carefully to

ensure that the Active Directory does not become corrupted.  The Schema Management MMC snap-in can view the schema object

and attribute classes, select which objects and attributes should be contained in the Global Catalog, and to manually change object and attribute classes.  The Schema Master FSMO role must be owned by the DC on which

the schema will be changed.

www.syngress.com

497

498

Chapter 15 • Modifying the Schema

How to Modify the Schema  You should create attribute classes before you create object classes, so

that you can incorporate the new attributes in your new object.  Mandatory attributes added to an object class means that when one of

those objects is created in a domain, the administrator must complete the value for those attributes.  A consistency check executes to ensure that new schema object classes

and attribute classes are unique throughout the forest.

Schema Container  The Schema container can be viewed using the Schema Manager, ADSI

Edit, and LDP.  Whenever a DC starts up it loads the copy of the schema into RAM.

This is called the schema cache.  In order for an attribute to be searchable within the forest, it must be

enabled for the Global Catalog.This is done in the Schema Manager console.

www.syngress.com

Modifying the Schema • Chapter 15

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: What is the schema? A: The schema is the blueprint for every object and attribute in the Active Directory. It defines classes of objects and their attributes for Active Directory.

Q: I looked for the Schema container in the Active Directory Users and Computers, the Active Directory Sites and Services, and even the Active Directory Domains and Trusts utilities.Where is it located?

A: The schema is such a critical component to the Active Directory that it is protected by not being easily accessible through standard utilities.To access the schema, use the Resource Kit utilities for the Schema Manager or ADSI Edit.

Q: I made a change to the schema, but the change did not appear on the network right away.Why is that?

A: What you see when you look at the schema is actually the schema cache in RAM of the DC.When changes are made, they are made to the schema located on the hard drive.There is a five-minute interval for the schema cache to be updated by the changes made to the schema on the hard drive. This interval can be bypassed by manually reloading the schema from the Schema Manager console.

Q: How can I change the schema FSMO to the current DC? A: In the Schema Manager console, right-click the root and select the Operations Master. If the current DC is not listed, click Change and select the current DC.Then, return to the Operations Master dialog and select The Schema May Be Modified on this Server.

www.syngress.com

499

500

Chapter 15 • Modifying the Schema

Q: We offer each student a unique e-mail address and user ID in our network. We are migrating to Windows 2000 and Active Directory.We’d like to include a Student ID as a field in the User Object, and let that be a searchable string in the Global Catalog. Can we do this?

A: Yes, you can do this by extending the schema with a new attribute, named StudentID, or something similar that makes sense to you.Then you can assign the attribute to a user object and enable it for the Global Catalog.You should also write a script for the new attribute’s display specifier to add the actual textbox to the object’s dialog when accessed via Active Directory Users and Computers. Before doing this on your production network, test it in a lab to see how the results will look.

www.syngress.com

Chapter 16

Using Active Directory: A Case Study

Solutions in this chapter: ■

Planning the Group Policy Solution

■

Implementing the Group Policy

■

Creating Logon/Logoff Scripts

 Summary  Solutions Fast Track  Frequently Asked Questions

501

502

Chapter 16 • Using Active Directory: A Case Study

Introduction Designing, planning, and installing a Windows 2000 network with Active Directory results in a functioning network operating system and directory service.The true value of Active Directory is in using it for managing your network. It can save you a great deal of time and effort since it automates many administrative functions for end users. For example, you can reduce errors by removing potentially dangerous capabilities such as registry editing from end-users’ desktops.This, in turn, reduces Help Desk telephone calls and Deskside Support management, while keeping users busy working in a productive environment. This is a case study of a government organization, govern.gov, which has implemented Windows 2000 with Active Directory.Their goal is to provide standard user environments, and to enable the use of kiosks.They are required to update their systems to meet federal regulations for Internet connectivity.These business objectives have driven the Active Directory project.

Case Study Overview Govern.gov has implemented a single forest environment with the domain plan shown in Figure 16.1. In this domain plan, their forest root domain, named secure.govern.gov, is empty.This root remains empty to prevent accidental access to the schema and to sensitive security groups such as Enterprise Admins.The internal.secure.govern.gov domain is used for production work, while the public.secure.govern.gov domain is exposed to the Internet. Their Domain Name System (DNS) servers are all Windows 2000, running on domain controllers (DCs) to enable Active Directory-integrated zones, because govern.gov wanted to take advantage of the secure dynamic updates. Govern.gov uses Windows 2000 Professional on all its client computer workstations, laptops, and kiosks. A plan is underway to upgrade these to Windows XP Professional. There are only two domains for which organizational units (OUs) plans are made. Figure 16.2 shows the OU plan for public.secure.govern.gov. Figure 16.3 shows the OU plan for the internal.secure.govern.gov. Govern.gov has only two sites, SiteA and SiteB, that share a single site link. Each site has over 2000 users.There are 33 small offices with only three to five users, and they are connected directly to either of the two sites. Kiosks and telecommuters all connect through a virtual private network (VPN) using Layer Two Tunneling Protocol (L2TP) and IP Security (IPSec).

www.syngress.com

Using Active Directory: A Case Study • Chapter 16

Figure 16.1 Domain Plan

secure.govern.gov

public.secure.govern.gov

internal.secure.govern.gov

Figure 16.2 Public Domain’s OU Plan public.secure.govern.gov.

Admins

Internet

Public

Kiosks

Public Policy

Kiosk Policy

The public.secure.govern.gov domain only contains Web servers (aside from the DCs) and public users who have signed up on the Internet. All of public.secure.govern.gov Web servers are located in SiteA. Govern.gov has implemented this domain and OU plan throughout their environment. All servers have been upgraded or installed with Windows 2000 Server. All workstations run Windows 2000 Professional.The replication topology is in place and works appropriately.The OU hierarchy within the domains has www.syngress.com

503

504

Chapter 16 • Using Active Directory: A Case Study

been created and populated with users. Now, the administrators are ready to put group policies in place to manage the environment for users and computers. Figure 16.3 Internal Domain’s OU Plan internal.secure.govern.gov

AllUsers

HR

Acctg

Admins

HR Policy

Legal

Clerical

Legal Policy

Planning the Group Policy Solution Govern.gov needs to manage computers, especially kiosks, in such a way that there will be no need to physically travel to a kiosk and work on it.The kiosks are placed in public locations that require administrators to manage them across long distances.

Configuring & Implementing… Managing Configurations Configuration management is an all-day job for someone with manual processes. If Joe gives his laptop to Jill, then Jill needs to have the laptop reconfigured to fit her needs—her applications, her identification and password information, even her colors and wallpaper. This means that the administrator, Jill or someone else, must make those changes on that laptop before Jill can use it productively. If Jill passes that laptop back to Joe, then the process needs to be completed all over again. Continued

www.syngress.com

Using Active Directory: A Case Study • Chapter 16

When hundreds of people need these types of configuration changes on a daily basis, the network can become tremendously expensive to support. Group policies are the answer to administrators’ dreams! An administrator can control any aspect of a user’s desktop and apply registry entries for that user or that workstation without affecting any other user or workstation on the network. Unlike the way that registry entries were handled under legacy NT 4.0 where the registry retained the changes permanently, Windows 2000 Group Policies’ Administrative Templates will only retain registry changes temporarily while the group policy is in effect. This means that the workstation can be used by multiple users with differing requirements, and the administrator simply needs to keep the group policies up to date.

Creating New OUs Group Policy implementation is one of the considerations in planning the Active Directory structure for an organization.The basic units of Group Policy are Group Policy Objects (GPOs).These are basic units in the sense that you link (or do not link, as the case might be) an entire GPO at a time. It is not possible to link only a subset of a GPO to a target. It is possible to leave portions of a GPO unconfigured.This means that you can configure the User Node and leave the Computer Node policies completely unconfigured, but when you apply the GPO, you cannot leave out the Computer Node section. Using security groups to filter the scope of group policy also has the effect of turning the entire GPO on or off; it does not function on only part of a GPO. (Notwithstanding the fact that the Software Installation and Folder Redirection extensions of Group Policy exploit permissions to tailor the behavior of those particular extensions based on security group membership.) You may decide to create multiple OUs, nested, in order to manage the application of group policy. Govern.gov will be applying a group policy to any user who logs on to the Public OU (the default location for Internet users). In addition to the configuration information in that group policy, kiosks will need an additional group policy.Therefore, the kiosks can be placed in a nested OU within the Public OU.

www.syngress.com

505

506

Chapter 16 • Using Active Directory: A Case Study

Deciding Group Policy Application Govern.gov’s group policy design will determine how easily they can manage their user and computer configurations. GPOs are stored in the SYSVOL, and associated with the domain database partition of Active Directory, even if they are site-attached.This means that if a group policy that is assigned to SiteB and the group policy is stored on DCs in the public.secure.govern.gov domain (whose DCs are all in SiteA) and a user from SiteB logs on, the user’s group policy must be transmitted across the WAN link between SiteA and SiteB. Govern.gov has elected to avoid both site-attached and domain-attached group policies. Instead, they are only creating group policies attached to OUs. The next decision govern.gov must make is how many group policies to apply to a user’s logon. Since group policies are layered on top of each other, multiple group policies can be applied either to an individual OU, or through inheritance down the tree of OUs.The more group policies a computer must process, the longer it takes for that computer to start up and log on to the domain. Performance hits can be minimized by reducing the total number of group policies that are applied to a computer or user. In addition, multiple group policies can be difficult to troubleshoot. As each group policy is applied, it overrides the settings of the previous group policy if they conflict; otherwise, group policies are additive.The only time that this is not true is if a No Override or Enforce Policy Inheritance setting has been enabled. Govern.gov decides to limit group policies to no more than two to be applied to any single user or computer. Because it is difficult to manage local group policy, govern.gov will not use local group policies either. Govern.gov has migrated both Windows 95 and Windows NT v4.0 workstations to Windows 2000 Professional.They have had some legacy system policies that were used on these computers. Govern.gov decides to use Group Policy in preference to Windows NT 4.0 System Policy.They have discovered that registrybased system policies leave registry changes permanently on the computers to which they have been applied. By contrast, group policies do not remain within a registry after the user logs on to an OU with different policies.Those legacy system policies are undesirably persistent from a Windows 2000 perspective. Moreover, because Group Policy refreshes the registry and the computer’s environment in general each time the policy is refreshed, govern.gov elects to no longer use their existing system policies.

www.syngress.com

Using Active Directory: A Case Study • Chapter 16

Determining What Group Policies Are Needed There are two group policies that Govern.gov will apply in the public.secure.govern.gov domain: ■

Public

■

Kiosks

The Public policy will apply to all users who log on from the Internet to the public.secure.govern.gov domain.This is expected to apply to an application that runs in a Terminal Services window embedded within a browser window. Because it will affect the application only, it will be applied to the Computer Node of the group policy. The Kiosks policy will apply to a generic user account that is used to automatically log on to each kiosk, and it will apply to all of the kiosk computers. This group policy will include both User and Computer Node policies. In the internal.secure.govern.gov domain, there are two group policies: ■

HR

■

Legal

The HR staff requires a group policy for security of their workstations.The HR group policy will consist only of Computer Node policies.The Legal staff requires a group policy for telecommuting.The Legal OU contains all of the telecommuters within the organization.

Implementing the Group Policy Govern.gov’s first task is deciding the result that they want for a set of users to have.They consider all the items they want to control, as well as all the items they do not want to control.When they are working with users’ desktops that exist across a slow network connection, such as the telecommuters’ environments in the Legal OU, they intend to make it easy for the users to work and give them few reasons to call for assistance. One of the best ways to do this is to optimize computer performance and minimize access to applications that require expert knowledge, such as the Registry Editor.

www.syngress.com

507

508

Chapter 16 • Using Active Directory: A Case Study

NOTE One thing that you should try to do is establish some way to determine that the group policy has been applied. The easiest way to do this is to set the wallpaper for the group policy to something unique. You may want to create a special wallpaper for each group policy—if you have to troubleshoot those group policies, you will immediately know which group policy was the last one applied. To set the wallpaper, navigate to the User Node | Administrative Templates | Desktop | Active Desktop and open the Active Desktop Wallpaper policy. Select Enabled and then use a server location for the wallpaper, such as \\server\share\ wallpaper.bmp. The only drawback to this is that users may not want to use your wallpaper.

Computer Node The Computer Node policies are applied to the computer when the computer starts up. User Node policies are applied after the user completes the logon process. Most of the user’s personal desktop environment is configured under the User Node in the Administrative Templates container.The Administrative Templates container under the Computer Node will let you configure more of the networking-related components for the desktop environment (as opposed to personal). For example, the Computer Node | Administrative Templates | System container holds logon rules and group policy rules. Pay attention to the policies under Logon in order to optimize users who log on over slow WAN links.These policies will apply to the users who use VPN. ■

Enable Run startup scripts asynchronously to let the user interact with the desktop as soon as possible.

■

Set the Maximum wait time for Group Policy scripts to somewhere between 60 and 300 seconds so that the user can interact with the desktop as soon as possible.

■

Set the Slow network connection timeout for user profiles so that if there is a slow link, the user is not prevented from working while waiting for a profile to download.

■

Set the Timeout for dialog boxes to 10 seconds so that default values are applied to dialog boxes that pop up during logon scripts.

www.syngress.com

Using Active Directory: A Case Study • Chapter 16

Govern.gov may also optimize the Computer Node | Administrative Templates | Group Policy rules for users who log on over slow links in the Legal OU. ■

Enable Apply Group Policy for computers asynchronously during startup to let the user log on before group policies have fully been applied.

■

Enable Apply Group Policy for users asynchronously during logon to let the user’s desktop appear before all group policies have fully been applied.

■

Set the Group Policy refresh interval for computers to 1440 minutes so that group policies are only refreshed once per day.

■

Enable Group Policy slow link detection to establish what you consider to be a slow link.

■

Enable User Group Policy loopback processing mode and set the mode to Replace so that the desktop environment is applied from group policies and not local system settings.

User Node The Kiosk OU includes a set of users who are automatically logged on to each kiosk at the kiosk’s startup, to automate any issues with rebooting and power outages.This requires that the kiosk users are strictly managed, and that each kiosk machine has a strict desktop configuration. When you have a strictly managed environment, there may be a specific desktop configuration mandated for all users, such as the kiosk users. If such a configuration is applicable to every single user within the network, you should apply your desktop configuration as part of a domain group policy for each domain so that you only need to create the desktop configuration policies once per domain. In the case of the kiosks, however, the user configuration only applies to the kiosk user accounts in the Kiosk OU, and the kiosk computer configuration only applies to the kiosk computers.The User Node Administrative Templates have several containers for managing the kiosk users’ desktop environment: ■

Start Menu and Taskbar

■

Desktop

■

Control Panel www.syngress.com

509

510

Chapter 16 • Using Active Directory: A Case Study ■

Network

■

System

■

Windows Components

NOTE You can reduce some administrative headaches by setting up a refresh for users’ profiles. If you delete the user profile cache, a user must authenticate to the network and load a new profile. Be selective when choosing users to refresh profiles on, however. Authenticating and downloading profiles may not be desired for remote users, especially if they have large profiles to load or are often traveling.

Most of the Start Menu and Taskbar policies are dependent on the environment that the kiosk users must have. In this case, the kiosk users are restricted from making changes to the taskbar and Start menu.The kiosks have “Run,” “Search,” common program groups, and Control Panel removed from the Start menu.They are also allowed only to see the applications to which the public is allowed access. For example, they are not allowed to have access to any of the accessories that are loaded by default as part of Windows 2000. Since each kiosk connects across the Internet using VPN, govern.gov should consider enabling the following policies for the kiosk user accounts: ■

Enable Disable and remove links to Windows Update so that users are not downloading service packs before you have tested them with your company’s applications.

■

Enable Disable drag-and-drop context menus on the Start Menu so that users do not accidentally change their Start menu and then call you to find out why one of the application shortcuts has disappeared.

■

Enable Disable user tracking so that application menus display all the available options rather than just the ones that users have used in the past.This prevents users from calling to find out what happened to a missing menu item.

■

Enable Gray unavailable Windows Installer programs Start Menu shortcuts so that users can distinguish between programs that are fully installed and those that are only partially installed.

www.syngress.com

Using Active Directory: A Case Study • Chapter 16

As an administrator, you can control all aspects of the way that a desktop appears in the Desktop container.The Desktop container holds two subcontainers—Active Directory and Active Desktop. Of all of the options available throughout the Desktop container, the item govern.gov selects for the Legal and HR policies is “Prohibit user from changing My Documents path.”This makes sense since they have established a network location for My Documents and they want to ensure that users’ files are backed up in these two business units due to their highly sensitive nature.The following policies are enabled for the Kiosk OU: ■

Enable Remove My Documents from the Start menu.

■

Enable Hide My Network Places icon on the desktop.

■

Enable Hide Internet Explorer icon on the desktop.

■

Disable adding, dragging, dropping, and closing taskbar’s toolbars.

■

Disable adjusting desktop toolbars.

■

Enable Don’t save settings at exit.

Govern.gov wants to keep all the kiosk user accounts from having access to the kiosk computer’s inner workings.To accomplish this, they concentrate on securing the Control Panel by working with the Control Panel container of policies.They begin by enabling the policy to “Disable Control Panel.” For the HR and Legal Group Policies, they can’t remove Control Panel access completely from those users.Therefore, they look through each of the items here and customize how it should work for the HR and Legal staff. In particular, they do not want to allow the users to install new software, so they disable Add/Remove Programs.They also disable the capability to share files and printers. The Network container has two subcontainers—Offline Files and Network and Dialup Connections. Govern.gov is going to implement Offline Files, and has trained users on how to use them.These users are all telecommuters, so this policy is enabled in the Legal OU. In the HR OU, and the Kiosk OU, Offline Files will not be used. For these group policies, govern.gov configures “Disable user configuration of Offline Files” to prevent users from implementing Offline Files on their own. In the Network and Dialup Connections container, govern.gov enables the following policies: ■

Prohibit “deletion of Remote Access Service (RAS) connections.”

■

Prohibit “enabling/disabling a Local Area Network (LAN) connection.”

■

Prohibit “configuration of connection sharing.” www.syngress.com

511

512

Chapter 16 • Using Active Directory: A Case Study

The System container has two subcontainers—Logon/Logoff and Group Policy. Under the System container, under the Kiosk, HR, and Legal OU policies, govern.gov configures “Disable registry editing tools.” For the Kiosk and HR OU, there are strict rules about what a user can run on the computer. For these OU policies, they also configure “Run only allowed Windows applications” and “Don’t run specified Windows applications.” In Logon/Logoff, the HR and Legal OU policies have “Connect home directory to root of the share” set, so that the user cannot see other directories in the tree structure.The Kiosk group policy includes the following: ■

Disable Task Manager.

■

Disable Lock Computer.

■

Disable Change Password.

■

Disable Logoff.

■

Disable “Run Logon Scripts visible.”

■

Disable “Run Logoff Scripts visible.”

■

Enable “Run these programs at user logon,” so that the kiosk application will automatically start when the kiosk user logs on.

The Windows Components container has several subcontainers. Govern.gov configures the following policies in the HR, Legal, and Kiosk OUs: ■

In the Windows Explorer subcontainer, they enable “Hide the Manage item on the Windows Explorer context menu” so that a user does not accidentally bring up the System applet (which can lead to some interesting challenges).

■

In the Microsoft Management Console subcontainer, they enable “Restrict the user from entering author mode.”This prevents a user from creating console files for the Microsoft Management Console (MMC), and from being able to add snap-ins and access administrative functions from his or her computer.

■

In the Windows Installer subcontainer, they enable “Disable media source for any install,” since they do not want users to install applications that are not strictly approved and available on the network.

Govern.gov also configures assigned software to the kiosk user so that kiosks will automatically receive the required kiosk application even if it somehow becomes damaged. www.syngress.com

Using Active Directory: A Case Study • Chapter 16

Throughout each GPO, govern.gov purposefully disables all leftover Not Configured settings.This has a slight performance advantage in that it expedites startup and logon.

Creating the Group Policy for an OU The group policies that govern.gov creates are placed within a GPO that is associated with each of the specified OUs. Govern.gov uses the following procedure to create each GPO: 1. Log on to a computer as a Domain Administrator. 2. Click Start | Programs | Administrative Tools | Active Directory Users and Computers. 3. Connect to the appropriate domain. 4. Expand the OU hierarchy by clicking the plus (+) sign next to each container in order to navigate to the OU where the GPO will reside. 5. Right-click the OU. 6. Select Properties from the pop-up menu. 7. Click the Group Policy tab. 8. Click New. 9. Type a name for the new policy. 10. Select the Policy and click Edit to enable and disable the individual policy settings.

Configuring & Implementing… Assigning a Group Policy to a Group You can assign a GPO to a group of users, or individual user accounts, rather than to an entire OU. In order to do so: 1. Log on as a Domain Admin. 2. Click Start | Programs | Administrative Tools | Active Directory Users and Computers. 3. Navigate to the OU with the GPO. Continued

www.syngress.com

513

514

Chapter 16 • Using Active Directory: A Case Study

4. Right-click the OU and select Properties. 5. Click the Group Policy tab. 6. Right-click on the GPO and select Properties from the popup menu. 7. Click the Security tab. 8. Click Add. 9. Select the group to enable the GPO for, and enable the Apply Group Policy Access Control Entry (ACE) and the Read ACE. (Both Apply and Read must be granted, or the group policy will not be accessible to the user.) 10. You will also need to remove the Apply Group Policy ACE from Authenticated Users so that only the group that you have selected will have the group policy enabled for them. Click on Authenticated Users and clear the Apply Group Policy check box. You can either leave the Read ACE or remove it, according to your preference.

Creating Logon/Logoff Scripts The Logon script in a GPO is not the same logon script that users are presented from the domain controllers. Instead, this logon script is in addition to the other one. Given that multiple scripts cause a challenge for troubleshooting, govern.gov decides to only use standard logon scripts for the internal.secure.govern.gov, and group policy logon scripts for the public.secure.govern.gov domain.To set up a Logon script, they use the following procedure: 1. Log on to the computer as a Domain Admin. 2. Click Start | Programs | Administrative Tools | Active Directory Users and Computers. 3. Open the public.secure.govern.gov domain. 4. Navigate to the Public or to the Kiosk OU (whichever group policy is being edited). 5. Right-click the OU and select Properties. 6. Click the Group Policy tab. 7. Select the GPO and click Edit.

www.syngress.com

Using Active Directory: A Case Study • Chapter 16

8. Navigate to the User Configuration Node. 9. Expand Windows Settings by clicking the plus (+) sign. 10. Click the Scripts container. 11. Double-click the Logon script in the right-hand pane. 12. Click Add to add a new script. 13. Locate an existing script or create a new script by right-clicking and selecting New from the menu, and then providing a new script name. A script that can be placed in the GPO can be any script type that is used in the normal logon script. It can use any batch or scripting language that is understood by the Windows Scripting Host (WSH). Startup and Shutdown scripts are located within the Computer Configuration Node of a GPO because they apply to the computer, not the user. Given that there is usually some lag between the time a computer starts up and a user logs on, the startup script is usually completed before a user logs on.

www.syngress.com

515

516

Chapter 16 • Using Active Directory: A Case Study

Summary One of the strengths of group policies is the capability to manage configurations over long distance.You can take advantage of group policies to optimize how a computer runs on the network, to control the access that users have to the internal system of their computer, and to create a consistent desktop environment for the computer. If done well, you should be able to manage the network with little or no need to walk over to a user’s desk, thus reducing your administrative overhead. Careful consideration should be given to the placement of Group Policy Objects (GPOs) within the Active Directory hierarchy. In addition, the number of GPOs should be kept to a minimum in order to reduce the performance hits that multiple group policy application can cause a user’s logon. You must ensure that users or groups are granted the Allow Group Policy Access Control Entry (ACE) as well as the Read ACE in order for the group policy to be applied.

Solutions Fast Track Planning the Group Policy Solution  Before you design group policies, you should have a complete under-

standing of the requirements for the desktop. A functional specification can reduce ongoing management and change control issues.  Group policies are preferred over system policies because they are not

persistent. A registry change implemented by a group policy will be refreshed if a different user logs on.  When planning your group policies, you need to determine how many

group policies you will allow to run for each workstation or user.The more group policies that must be processed, the longer it takes for the computer to start up or the user to log on.  Some users will require different types of group policies.These users

should be grouped separately.

Implementing the Group Policy  The policies contained within the Computer Configuration Node will

affect the computer when it starts up.These policies should be applied to www.syngress.com

Using Active Directory: A Case Study • Chapter 16

computers that require those configuration options regardless of which user logs on.  Policies contained within the User Configuration Node will affect each

separate user as he or she logs on.These policies should be applied to users who require specific configurations regardless of which computer they log on to.  In order to create a group policy for an OU, open Active Directory

Users and Computers, and then right-click the OU and select Properties. Click the Group Policy tab, and then click Add.

Creating Logon/Logoff Scripts  The logon scripts contained within the GPO are not equivalent to the

logon scripts that run for all users who log on to a domain controller.  Logon scripts and Logoff scripts are configurable within the User

Configuration Node under Windows Settings.  A Startup script applies to a computer and executes regardless of who

logs on to the computer. Many times, the startup script executes before a user can log on.

www.syngress.com

517

518

Chapter 16 • Using Active Directory: A Case Study

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: If we create two OUs, one called AllUsers and the other called Groups, and then apply a group policy to the Groups OU, would all the users in the groups within the Groups OU receive the group policy?

A: No. Group policies apply to the users who are authenticated within their same OU.The group can be used to filter the application of the group policy to certain users within an OU, but the users must exist within that OU or below it in the OU hierarchy in order to process the group policy’s settings.

Q: What is the best approach to setting group policies—– restricting everything or restricting nothing?

A: Actually it’s somewhere in between, and largely depends on your environment and the policies in your organization. If you have an environment in which there are problems that need to be managed—for example, users who violate your software policies by adding unapproved applications—you should implement policies to control those problems. If you have a specific situation that requires users to have full access to all the options in the computer—for example, in a research and development department—then you should not implement policies except ones that are absolutely required by your environment.

Q: When should you use group policies to deploy software? A: If you have a software deployment system already in place, you may find that implementing group policies for software deployment is redundant. However, if you do not currently have a software deployment system, then group policies may be able to save you significant time and energy.You should use group policies for software deployment if you have few workstation images. The more complex the hardware and application sets are that you use, the more likely you will experience difficulties with software deployment via group policies. www.syngress.com

Using Active Directory: A Case Study • Chapter 16

Q: If we only enable User Configuration container policies for a group policy in the X OU, and a computer is placed in that X OU, will the policy be applied if a user logs on whose account is placed in the Y OU? Both the X OU and the Y OU are contained directly below the domain container.

A: No, the User Configuration container policies will only apply to user accounts that exist within that OU, or below in a nested OU.

Q: Should we use our existing system policies or create new group policies? They seem to have the exact same options for our needs.

A: Because group policies can be easily refreshed (unlike persistent system policies), you will be better served by implementing group policies and stopping the use of legacy system policies.

www.syngress.com

519

Part V

Integrating with Active Directory

Chapter 17

Plugging into Active Directory

Solutions in this chapter: ■

Microsoft’s Metadirectory

■

Microsoft’s Active Directory Deployment Tools

■

Quest’s FastLane Technologies

■

Cisco

■

Other Applications

 Summary  Solutions Fast Track  Frequently Asked Questions

523

524

Chapter 17 • Plugging into Active Directory

Introduction Applications drive the adoption of operating systems and underlying services for many organizations.When an application is constructed to function only on one operating system, there really is no choice but to use both of them together. Active Directory is similarly impacted by applications. A programmer can increase his or her application’s performance, and reduce the time to market, by offloading directory service functions to another directory service such as Active Directory. This chapter lists a fraction of the applications that plug into Active Directory.

Microsoft’s Metadirectory Microsoft may have developed Active Directory, but they did not create it in a vacuum. Microsoft made every effort to ensure that Active Directory would be representative of Internet standards, and be able to interoperate with third-party applications. Many enterprise networks have a common set of business requirements for their networked systems, including: ■

Single logon and synchronized passwords across systems to simplify network access from the user’s perspective, which translates directly to a reduction in support needs.

■

Ease of propagating human resources information throughout multiple systems when a user is hired, thus providing network access; and when a user is fired, thus providing a measure of security.

■

Single global address book that contains current information for other users, including their e-mail addresses regardless of the messaging system used.

Metadirectories have become more prevalent in networking because of the proliferation of directory databases.The average enterprise has about 10 directories residing in their multiple network operating systems, electronic messaging, databases, groupware, PBX telephone systems, and infrastructure operating systems. For example, when a new employee is hired, a company might need to enter that employee’s data into an HR database, a security badge database, the PBX voice mail system, an electronic messaging application, a proxy server, Novell Directory Services, a NetWare bindery, a legacy Windows NT domain, Active Directory, and so forth.

www.syngress.com

Plugging into Active Directory • Chapter 17

A metadirectory is somewhat different from a synchronization method of updating directories. Synchronization is the process of ensuring that when an administrator makes a change to one database, that change is synchronized across all other databases.This is like Multi-Master replication among dissimilar databases. As unlikely as it seems, this is a common system already developed for many messaging systems. It enables global address books from different vendors to be synchronized when a change is made to one of those vendors’ directories.This type of synchronization is traditionally implemented through gateway or connector software. A metadirectory, on the other hand, is a superset of all directories. Primarily, these directories manage identity information, but many of them extend into other resource information, such as data, files, printers, shares, applications, telephone information, policy rules, and so on. Not all directories contain the exact same extent of information, but most have a commonality in the identity of users who are allowed to access this information, as shown in Figure 17.1. Figure 17.1 Identity Management with a Metadirectory NDS Identity -----Resources

PBX Identity -----Phone

AD Identity -----Resources

Metadirectory Identity

Messaging Identity -----E-Mail SQL Identity -----Data

DNS Identity -----Location

Groupware Identity -----Data

The metadirectory is actually a directory itself, or an index, of all the information that can be synchronized between these various databases.There are two approaches to metadirectory products: www.syngress.com

525

526

Chapter 17 • Plugging into Active Directory ■

Identity information index

■

Single point of administration

The identity index approach enables centralization of the common identity information from the various databases mapped to each other. In the early development of metadirectories, this approach is most common.The single point of administration approach includes a further extension into the security aspects of the various directories by including the resource information and the rules that apply to how users are granted access to those resources. Regardless of which approach is used, the capability of managing identity from a single point is a major administrative process improvement over the problems incurred through managing an average of 10 directories containing information about the same user identity. The challenge with metadirectories is to establish rules to manage the updates when they can be initiated from any one of the directories.The question at hand is, “which directory owns that particular identity attribute?” For example, is it more sensible to have the messaging database own the e-mail address or the SQL database? Probably the messaging database should own that piece of information. That means, if an administrator made a change to the e-mail address on a SQL database, and another administrator made a change to the messaging database, the change that would win is the messaging database e-mail address.This is done by establishing the messaging database as the master of the e-mail address attribute, whereas other databases are slaves to the messaging master. Microsoft acquired Zoomit Corporation, a company that developed metadirectory technologies, in 1999.This acquisition enables Microsoft to implement a metadirectory that will be able to access and interact natively with Active Directory, and be able to work with other directory services.The new product is Microsoft Metadirectory Services (MMS). Such directories would likely include: ■

Messaging address books

■

DNS and DHCP databases

■

Third-party directory services

■

Database directories

■

Mainframe and minicomputer account managers

In essence, a metadirectory enables an administrator to have a single interface into multiple directory services, and manage those directory services using intelligent rules.The metadirectory must be able to integrate with those other directory www.syngress.com

Plugging into Active Directory • Chapter 17

services in a way that can maintain integrity across directories, and translate between different types of data representing the same value. For example, the e-mail address in one directory might be given two fields: a string representing the user ID and a string representing the Internet domain. A different directory might keep the e-mail address in a single field as a string value.Telephone numbers can include area codes and symbols in one directory, represented by a string value, but they could be a seven-digit telephone number in another directory with no symbols and represented by a number. The metadirectory must be able to understand these values and map them between directories.This can be done by using a native API for each directory, or by using a common protocol to access each directory (such as the Lightweight Directory Access Protocol, or LDAP) and then manipulating the data to ensure that the data is correct in each directory that the metadirectory touches. The optimal architecture for a metadirectory is one in which the metadirectory is the central connecting point between all the other directory services (Figure 17.2). If a directory service were connected to others in a serial fashion, where directory A connects to directory B and directory B connects to directory C and so on, it would be less likely that the metadirectory could apply business rules regarding the ownership of values in the data (Figure 17.3). Figure 17.2 Hub and Spoke Metadirectory Legacy NT Domain

Web Server

Active Directory Metadirectory Novell Directory Services

Database

Exchange Server

www.syngress.com

527

528

Chapter 17 • Plugging into Active Directory

Figure 17.3 Serial Directories

Exchange Server

Legacy NT Domain

Active Directory

Metadirectory Novell Directory Services Database Web Server

MMS Architecture VIA was the name of the metadirectory product that Microsoft acquired when they bought Zoomit. It can run as a service or a console on a Windows NT 4 or Windows 2000 Server.To access the MMS metadirectory, a client can be one of the following: ■

Web browser

■

LDAP client—either LDAP v.2 or LDAP v.3

■

Zoomit Compass client

The MMS “metaverse” database connects to multiple directories through management agents that work in a bidirectional flow that can be scheduled by the administrator.There are management agents currently available for the following directories. Future versions and updates may contain additional management agents. ■

Banyan VINES

■

GMHS (BeyondMail and DaVinci)

■

Lotus Notes

www.syngress.com

Plugging into Active Directory • Chapter 17 ■

Microsoft Exchange Server

■

Microsoft Mail

■

Microsoft Windows NT domains

■

Microsoft Windows 2000 Active Directory

■

Netscape Directory Server

■

Novell NetWare bindery

■

Novell Directory Services

■

Novell GroupWise (4.x and 5.x)

■

SQL databases, via ODBC

■

X.500 directories, via LDAP, such as ISOCOR, ICL, and Control Data

Additionally, a report management agent is available for reporting on the metaverse, and a generic management agent is available to use in creating a custom version for a different database. The metaverse can synchronize directories to the attribute level. In fact, new objects can be created in any directory or the metadirectory, or attributes can be changed, and then those objects and attribute changes will be propagated to the metadirectory (if made from a different directory). From the metadirectory, they will be propagated to the rest of the connected directories. MMS also supports ownership of data to the attribute level.This further maintains the referential integrity of the data when there are two or more different sources for identity information.

Obtaining MMS MMS is not available through the normal channels. Instead, you must contact Microsoft Consulting Services or a Microsoft partner who has been approved to assist with MMS deployments.

Microsoft’s Active Directory Deployment Tools Microsoft provides utilities through its resource kit and on the Windows 2000 CDROM.The resource kit utilities can be downloaded from www.microsoft.com/ windows2000/downloads/tools/default.asp. Of all these tools, two are popularly

www.syngress.com

529

530

Chapter 17 • Plugging into Active Directory

used in an Active Directory deployment—the Active Directory Migration Tool and the Directory Services Client.

Mission Critical’s Active Directory Migration Tool Microsoft has licensed the Mission Critical application for migrating users from one domain of either Windows NT or Windows 2000 to a Windows 2000 domain only.This utility is called Active Directory Migration Tool (ADMT). ADMT is a graphical tool with wizards and an easy-to use console. It can easily move users, computers, and Local groups between domains. ADMT’s capabilities enable it to model domain migration strategies and test them prior to the actual migration. ADMT also allows you to restructure domains, whether they are Windows NT domains or Windows 2000 domains. If you are merging domains, you can place users in OUs, and at the same time delegate administrative control over the OUs to the former domain administrators.

Deploying Active Directory-Enabled Clients Windows 2000 Professional is the ultimate Active Directory-enabled client. It was built to belong to that architecture. Because of Windows 2000 Professional’s enhanced security features and other improvements, many organizations will combine a Windows 2000 Server rollout with a Windows 2000 Professional rollout. However, there are others that will not. For those organizations, the goal is to successfully integrate clients with Active Directory, and to access resources located on Windows 2000 Servers. There are some limitations to using Windows 9x clients, as opposed to Windows 2000 Professional or Windows XP. Because Windows 9x clients cannot become members of the domain, they are not listed as objects in Active Directory. As a result, group policies with Computer Configuration Node settings will never be applied; they are only applied to computers represented by objects that contact Active Directory during their startup.What this means is that you lose some of the features and benefits of Active Directory by not implementing Windows 2000 Professional or Windows XP on the desktop.

Best Practices In general, a prudent approach to project management will enable better success with any Windows 2000 rollout, regardless of client types.This includes:

www.syngress.com

Plugging into Active Directory • Chapter 17 ■

Planning the locations of domain controllers/DNS servers in respect to clients

■

Planning sites to enhance users’ perception of network performance

■

Considering the deployment of Active Directory-enabled applications

■

Establishing appropriate administrative roles and boundaries for sets of clients

■

Ensuring that business requirements are met by the technical solution that is implemented

Deploying DSClient The DSClient file is located on the Windows 2000 Server CD-ROM under Clients\. For example, if installing the client for Windows 95 or Windows 98, the directory is \CLIENTS\WIN9X.The executable is named DSClient.exe.When you execute this command, you will see the Directory Service Client Setup Wizard, as shown in Figure 17.4. Microsoft has released a client for NT 4.0 Workstation, which is available for download from www.microsoft.com/ntworkstation/downloads/Other/adclient.asp.This client allows NT 4.0 workstations the functionality that is provided to Windows 9.x clients for access to Active Directory. Figure 17.4 Directory Service Client Setup Wizard Welcome Screen

There is not much to the installation process.The wizard offers a couple of dialog screens that explain the DSClient installation, and after copying the appropriate files, the machine prompts to be rebooted.The DSClient can be executed in quiet mode, without requiring any user intervention, by using the /Q switch with the dsclient.exe command. www.syngress.com

531

532

Chapter 17 • Plugging into Active Directory

After installation, there are a few changes to the client workstation.The main change is in the Find menu, shown in Figure 17.5, to which a “People” option has been added. Figure 17.5 DSClient Finding People

The Find command has an added menu that can look in various directories, including Active Directory.This is illustrated in Figure 17.6. Figure 17.6 Active Directory Is Added to the Find Options

Quest’s FastLane Technologies FastLane Technologies, now a part of Quest Software, began creating network administration tools in 1993.The original focus of the tools was to automate tedious functions, and to solve problems surrounding Banyan networks.Then, FastLane began to create software focused on Windows NT network administration. In 1997, they created an Enterprise Directory Management engine called Active DMS.This was quickly followed by products that assisted with domain migrations, network reporting, and NT administration that were all based on the Enterprise Directory Management engine. FastLane Technologies creates software that can be used for Active Directory migrations and for directory management. FastLane’s tools make daily network administration much less tedious and repetitive by providing ways to delegate, script, and automate repetitive tasks. FastLane has a lifecycle for their products’ usage in the Windows 2000 migration cycle (Figure 17.7). www.syngress.com

Plugging into Active Directory • Chapter 17

Figure 17.7 DM/Lifecycle Planning DM/Reporter - to assess the current NT environment DM/Administrator and DM/Developer - to create a test hierarchy and administrative tools to validate the hierarchy

Consolidation

Administration

DM/Consolidator - to consolidate existing NT servers DM/Manager - to consolidate existing NT domains DM/Administrator - to consolidate the administrative structure

DM/Reporter - for ongoing reporting on the Windows 2000 network DM/Administrator for ongoing administration of the Windows 2000 network

Cleanup DM/Manager and DM/Developer - to clean up old accounts, clean up SIDs, and decommission NT Servers from the network

Migration DM/Manager - to manage users, groups, and resources during migration DM/Developer - to automate migration tasks

FastLane Reporter A best practice for executing a Windows NT to Windows 2000 migration is to clean up the existing user accounts and machine accounts in the NT SAM prior to the migration.This will avoid unnecessary processing and reduce the time it takes to migrate the data. FastLane Reporter is a tool that can discover which accounts are no longer valid. FastLane Reporter can provide much more detailed information than accounts, which makes it an excellent ongoing administrative tool as well. FastLane Reporter uses Active DMS to access directory service data, and displays that data in a report based on Seagate’s Crystal Reports software. Many reports are provided within the FastLane Reporter product as standards, and an administrator can customize his or her own reports to suit his or her needs. FastLane Reporter shines best when migrating to Windows 2000 from Windows NT.There can be a multitude of problems that must be fixed in a Windows NT environment that is going to be upgraded to Windows 2000, including: ■

There are inactive or invalid accounts in the NT security accounts manager.

■

Different naming conventions have been used. www.syngress.com

533

534

Chapter 17 • Plugging into Active Directory ■

Some user accounts have passwords that violate security requirements.

■

Multiple domains contain duplicate account names.

■

Global groups have been granted rights to resources, rather than Local groups.

■

There are too many users with Administrative rights.

■

Workstations and servers that will be upgraded to Windows 2000 may not have enough RAM or a compatible processor or network interface card (NIC).

■

Workstations or servers that will be upgraded are not at the right service pack or are running incompatible applications.

FastLane Reporter can expose these types of problems and many others.This enables the migration team to identify problem issues before experiencing problems with the Windows 2000 migration.The administrator can take the information from FastLane Reporter and make the necessary changes to the accounts or the machines as needed.

FastLane Administrator Network delegation is the process of granting users the ability to perform management functions for a portion of the directory. For example, an administrator may grant a manager rights to administer users in his own group first.The problem in the past has been that this type of delegation has been granted through creating multiple domains or by adding many people to the Administrators groups. FastLane Administrator mitigates these problems by enabling a specific taskby-task delegation, and even per-user delegation.Therefore, whereas in Windows 2000 you have the flexibility of selecting which organizational unit (OU) and which rights a user should have over certain user accounts and resources, with FastLane Administrator you can select a subset of users within an OU or several users across OUs that a user can have rights to administer. The most effective use FastLane Administrator has for a Windows 2000 migration, however, is in maintaining a standard administrative interface before, during, and after the migration has completed.The FastLane Administrator software can be used to create a test hierarchy as an overlay structure on top of an existing Windows NT 4.0 network. Multiple, different test hierarchies can be created simultaneously to validate the most optimal hierarchy for the administrators to use. www.syngress.com

Plugging into Active Directory • Chapter 17

Once a hierarchy has been selected, the administrators can use FastLane Administrator to manage the network.This application can be used to delegate administration to other groups, with only the required rights needed, during the migration from NT 4 to 2000. After the Windows 2000 migration has completed, the FastLane Administrator can be used to administer the network.This can prevent the need for delegated administrators to have access to Administrative consoles such as the Active Directory Users and Computers or Active Directory Sites and Services. If using the FastLane Administrator application throughout the migration, administrators will be familiar with the management tasks since they are executed through the same interface.

FastLane Migrator FastLane Migrator is a migration tool that uses a project approach to migrating to Windows 2000. FastLane Migrator lets an administrator create a project, select the items to be migrated, and then perform the migration. FastLane Migrator can import a scripted selection of user objects from other data sources as well. All that is required is a source file and a separate file to describe the source’s structure. If populating the Windows 2000 domain with user accounts from a Human Resources database, for example, a delimited text file can be extracted with the user information. Another text file simply describes the location of the fields that will be populated. It does not matter if the user’s firstname field is before or after the last-name field, since the second text file will describe its location and place the information into the correct user account attribute in the new Active Directory objects. During the project, the administrator may need to view certain aspects of the users or resources. FastLane Migrator has the capability of looking at these items. Figure 17.8 shows the groups within a domain, both Global and Local groups, and their members. SIDHistory issues exist when migrating a user account. SIDHistory is the new functionality within Windows 2000 to migrate a user account along with the token it originally had to access resources.This feature can shorten the time to migrate since there is no need to reestablish rights to resources for each user that is migrated.The user still has the SID that identifies it as a member of the Windows NT groups, and so the user keeps those rights while those Windows NT domains and groups remain. Problems begin to build when the user is granted new rights to existing resources. If the user eventually is granted the identical rights to the same resources, then the user’s token is double what it www.syngress.com

535

536

Chapter 17 • Plugging into Active Directory

would otherwise be.What happens if the user account is migrated to another domain and retains the SIDHistory again? The result is token bloat, or an excessive number of rights within a single token. Simply viewing resources’ access control lists (ACLs) and planning to migrate accordingly can help make a decision whether to retain SIDHistory. FastLane Migrator enables this process and several others, as shown in Figure 17.9. Figure 17.8 Viewing Groups

Figure 17.9 Viewing the ACLs

www.syngress.com

Plugging into Active Directory • Chapter 17

Windows NT did not have any way of migrating Windows NT primary domain controllers (PDCs) or backup domain controllers (BDCs) between domains, or changing their status from DC to server, and vice versa.The only way of doing this, without a third-party tool, was to reinstall the Windows NT Server.When these server changes are needed before the Windows 2000 migration is begun, FastLane Migrator includes a tool to do this.

FastLane Developer FastLane Developer is for the serious network administrator. FastLane Developer is basically a software developer kit for cross-directory management with “hooks” into Windows NT and Windows 2000 Active Directory.There are several established scripts that enable the translation of multiple directories into shareable information. FastLane Developer can script administrative tasks, as well as assist in managing across multiple directory services.

FastLane Consolidator The FastLane Consolidator product is new to the FastLane suite. It makes a complex task, consolidating two servers into a single box, into a simple one. FastLane Consolidator enables the administrator to move data from one server to another, yet enable users to retain the same rights they had on the original server to the data now on the other server.This considerably shortens the time it takes to merge two servers into one. Many corporations might discover that one or more of their servers do not meet the minimum hardware compatibility requirements for Windows 2000. In that case, they might decide to simply migrate the data to another server in preparation for upgrading to Windows 2000. FastLane Consolidator makes this mission as brief as possible.

Cisco Active Directory presents a comprehensive distributed directory service. It is scalable, uses standard technologies that are familiar on the global Internet, and is integrated with the Windows 2000 network operating system. Cisco has built a product called Cisco Networking Services for Active Directory (CNS/AD) that is built upon Active Directory’s scalable and extensible architecture. CNS/AD provides an integration point between Active Directory and the Cisco Internetworking Operating System (IOS).The result is a directory-enabled internetworking solution.

www.syngress.com

537

538

Chapter 17 • Plugging into Active Directory

CNS/AD has only been released to a limited group of Cisco’s partners. In the future, it is expected to be released to a wider group of Cisco clients. It is expected that CNS/AD will provide an architecture for use by third-party products, but CNS/AD also provides a basis for a suite of Cisco solutions, Cisco Service Management System (CSM), that address a service provider’s four areas of operations: ■

Planning

■

Provisioning

■

Monitoring

■

Billing

Since these services are directly applicable to service providers, such as those providing access to the Internet (ISPs), Cisco has further taken Active Directory and ported it to UNIX systems. Many ISPs depend solely on UNIX systems to deliver Internet access services. By providing a UNIX type of solution, CNS/AD can provide the common Cisco schema and data to all network systems. This new extension of Active Directory provides a basis for an intelligent network. Users can be provided services that are differentiated solely by the identity of the user.This differentiation is transparent to the users.The directory provides an elemental role in the intelligent network, since it provides a dynamic glue between users, applications, policies, and the network resources such as servers, printers, and even routers.

CNS/AD Policy-based networking has been around for many years. For instance, a policy for networking could state “All traffic from MAC address X will receive the highest priority to reach MAC address Y.” A policy like this could be executed on a router or server with a simple rule.This type of rule exists on a single network segment and applies to the Data Link layer (Layer 2) of the OSI reference model. At Layer 3, the rule can apply to a logical IP address. Using a logical address allows some mobility for that address to move around from machine to machine, if needed, since the user could potentially change the IP address on any machine he or she visited. However, that is not a likely scenario. The flexibility of a logical network address is not enough for an administrator to be certain that the correct user was receiving the correct level of service.The most useful type of policy would be one that could be tied to the person using

www.syngress.com

Plugging into Active Directory • Chapter 17

the machine, regardless of which machine. In this scenario, a policy would need the ability to plug in to a directory service, like Active Directory, to match the identity of the user to the IP address of the machine that the user has logged on to, and then to send the policy to the networking infrastructure equipment (routers, hubs, and switches) to flag that user’s traffic for priority, or Quality of Service (QoS).This type of rule would be more user friendly, as well as capable of following the user anywhere on the internetwork. For instance, the rule might state “All traffic from Vice President George Doe will receive the highest priority.”Then VP can travel to Alaska from Florida, yet receive the same QoS when he logs in to the directory service.This system is independent of physical location, as shown in Figure 17.10. Figure 17.10 CNS/AD and Quality of Service Computer When user sends data across router, it uses credentials to verify which quality of service this user should receive

Router

and tes s a c i ent tial uth reden a r sc te Rou check

Rec User l eiv ogs es c on red ent ials

CNS/AD

When policies are stored in a dynamic database, they are not only flexible and simple to execute, but reflect more accurately the results that a network administrator is trying to gain. For example, an administrator can manually configure several routers to provide a higher QoS to traffic originating from a certain IP address.This address can be manually assigned to a specific computer used by a specific user. If, however, the user uses another computer, or the QoS is only supposed to be enabled during certain hours, the administrator will be required to reconfigure everything to meet these business requirements.With CNS/AD, a

www.syngress.com

539

540

Chapter 17 • Plugging into Active Directory

policy can automate this, thereby saving the administrator a lot of work. QoS policies are one of the main draws for using CNS/AD. One of the main benefits of CNS/AD is that Cisco’s IOS features can be managed from a policy standpoint in a central location.This is highly desirable for an enterprise that has multiple Cisco routers, since a single point of administration (Active Directory) can be accessed and used rather than the alternative choice: using Telnet (or a Web browser if the IOS version supports it) to access individual routers with their IP addresses. By extending Active Directory, information and policy used by network services can be stored.These items can be linked to user accounts or other objects, such as computers, in order to specify the users’ or computers’ access to them. In a case where a person used videoconferencing on a different user’s computer, this linking process will still enable that person to have the QoS granted to him for videoconference data (assuming he logged in as himself). An administrator has fundamental control over the policies, and does not need to control the dynamic nature of the users and resources to which those policies might apply.

What CNS/AD Does CNS/AD is a set of extensions to Active Directory that provide a foundation that may be used by network-aware applications and even existing IOS applications, such as the CiscoAssure policy server.These extensions enable: ■

Storage and management of secure information from authenticated resources, such as routers or users

■

Processing of events from resources, such as time-critical alarms or application events

■

Maintenance of information about network resources’ current state, such as router statistics

In order to function, each user and resource must authenticate to Active Directory.The Active Directory-provided credentials supplied upon authentication determine security options such as which user can access data or which machine can process which events. A process in which a user and router both authenticate to Active Directory illustrates how the user is governed by both his credentials and the router’s policies when he needs to access the router. CNS/AD supplies a high-speed transaction-based cache that stores and replicates transitory data (such as router statistics) and low-latency data. Low-latency data is any type of data that can propagate quickly across a network and usually www.syngress.com

Plugging into Active Directory • Chapter 17

carries a low overhead, such as DHCP data, which is based upon the User Datagram Protocol (UDP). UDP has a much smaller header than TCP because UDP’s header doesn’t require the fields needed for reliability (which TCP provides) Otherwise, UDP performs the same basic function at the Transport layer. The following are two examples of the way that CNS/AD may be able to assist a network manager on a real-world network: ■

A research and development manager for a company that has contracted to develop a new technology logs in to his network.While executing normal file and print services, CNS/AD enables standard security measures established by the administrator for those services. However, when the manager logs in to the R&D database, CNS/AD authenticates the manager and then turns on IPSec encryption during the session, as well as granting him a higher QoS for that session.These policies apply to the session end to end through each infrastructure component that sits between the manager and the R&D database server. Because they are all connected logically through Active Directory, the system is able to apply the policies throughout an internetwork.

■

An ISP provides services to thousands of consumers. A demand from several of its top corporate clients for faster, more reliable services has placed the ISP in jeopardy of losing a large percentage of its business. The ISP implements CNS/AD. It then creates several policies that grant users’ accounts a QoS in a matrix of Platinum, Gold, Silver, and Bronze, in which a Bronze user receives the least amount of service quality and Platinum receives the highest.The ISP then grants the top accounts Gold services and offers them a Platinum account for a premium charge. All other accounts are granted Bronze services with upgrades available for premium charges.The result is that the ISP can grant a higher quality of service to clients who have paid for the privilege or who are too valuable to lose.When users authenticate to the ISP’s Active Directory, they are granted the appropriate QoS based on their level and current network conditions.

Other Applications Many applications that use a database to manage their information can offload the security features to Active Directory.This reduces the administrative overhead that a database administrator (DBA) is tasked with, since network administrators www.syngress.com

541

542

Chapter 17 • Plugging into Active Directory

handle user password and name changes, adding and deleting user accounts, and so on.The DBA can then focus solely on providing the access to the database, or its components.

SAP Microsoft works with independent hardware and software vendors in ensuring that their operating system will work with the hardware and software that consumers will be purchasing. SAP is one such software vendor. SAP has a client that locates servers by searching for an application’s information stored in the Active Directory database.This client is a directory service interface within SAP’s Computing Center Management System (CCMS). CCMS can monitor and manage R/3 (SAP’s highly acclaimed program) and other SAP components. CCMS does not require Active Directory in order to function, and can work independently as the management application for R/3. However, if a network administrator wanted to integrate the R/3 account information as a part of Active Directory, CCMS can interface to it using LDAP. SAP Release 4.6c directly integrates with Windows 2000. A SAP System will register itself upon startup with Active Directory.The SAP System information can be accessed using the Active Directory Users and Computers MMC.

Mobile Information Server Wireless technologies are still emerging. End users are adopting individual devices on their own to enhance their ability to work. As a result, organizations are faced with the decision to either take over management for wireless technologies or deny the ability to use them with their network. Microsoft’s Mobile Information Server (MMIS) enables a mobile strategy on your network and integrates it with Active Directory and Exchange Server 2000. Like Exchange Server 2000, Mobile Information Server extends the schema of the forest with more objects and attributes.This will require the installer to run a forest preparation process prior to installing the server.This is done with the command Drive:\Setup.exe /vForestPrep.The domain will also need to be prepared using the command Drive:\Setup.exe /vDomainprep=1. Once Mobile Information Server has integrated with Active Directory, user objects will have a Wireless Mobility tab with mobile options. MMIS uses Active Directory for its security of users much the same way that Exchange Server 2000 does. In fact, MMIS requires Exchange Server 2000 to be installed. However, the security aspects of wireless technologies present challenges to IT management. www.syngress.com

Plugging into Active Directory • Chapter 17

How do you secure a transmission that is uncontained? Anyone with the technology to capture wireless transmissions can capture yours passing by if you happen to be in the right location. One of the methods of securing Active Directory is to create a domain for all wireless users, and provide those users with an auxiliary account. For example, if you had a single domain in your enterprise, and then decided to deploy MMIS, you could create a subdomain solely for the use of wireless users and populate that domain with auxiliary accounts.This would secure your standard domain, as well as your standard user accounts.

SQL Server 2000 SQL Server has always had the capability to offload its security to Windows NT, and now to Windows 2000, user accounts.This integration means that within a SQL Server database, the SQL Server administrator can select a user account from an Active Directory domain and grant that user access to database features. In addition, Microsoft’s SQL Server 2000 lists properties of its databases in Active Directory.When an instance of a SQL Server database is registered in Active Directory, an MS-SQL-SQLServer object is added within the SQL Server’s Computer object. Replication publications and Analysis servers may also be registered and listed within Active Directory. Applications can then be written using Active Directory Services Interface (ADSI) to locate SQL Server information throughout the network. To register a database in Active Directory, you use the SQL Server Enterprise Manager MMC. Locate the SQL Server database that you want to register in the database, and right-click it. Select Properties from the pop-up menu and then click the Options tab. Check the box for List this database in Active Directory. There is also a box for “List this publication in Active Directory” located on the General tab of a SQL Server publication’s properties. In addition, there is an entire Active Directory tab provided for the properties of Analysis Servers. Once a database, a publication, or any other SQL Server object has been listed in Active Directory, you will be able to view the objects using ADSI Edit. Another technique for accessing these objects is to use the LDP tool. Both of these are available on the Windows 2000 CD-ROM under the Support\Tools directory.

www.syngress.com

543

544

Chapter 17 • Plugging into Active Directory

Summary Active Directory will not stand alone in the network as a directory service. As time goes by, an enterprise might add other applications and systems that integrate with Active Directory.There might be some directories that cannot be integrated or synchronized directly with Active Directory. If the network grows with multiple directory services, it might simplify processes to use a metadirectory. A metadirectory is a database that serves as an index of other directories.This index can propagate data throughout the various directory services. It can synchronize data between them. Microsoft purchased Zoomit Corporation, which produced a metadirectory called VIA.VIA is now a Microsoft metadirectory that can access Active Directory information. In addition to being a standard metadirectory,VIA can apply business rules in order to place ownership of data for certain directories over others. Microsoft has released a directory services client (DSClient) for legacy Windows machines.This client is located on the Windows 2000 CD-ROM. Installing DS Client is simple and quick, and makes a few small changes to the Windows interface, such as the Find feature to enable browsing of Active Directory. Cisco has created a direction in partnership with Microsoft to create a directory-enabled network infrastructure.This system is called Cisco Networking Services for Active Directory (CNS/AD). CNS/AD is an extension of Active Directory that allows infrastructure equipment using the Cisco Internetworking Operating System (IOS) to authenticate to Active Directory. In addition to authenticating, routers can apply rules, or policies, to traffic that is passing over them, depending on either who (which user account) or what (which directoryenabled application) is sending that traffic. FastLane Technologies has a suite of applications that can help in preparing for a migration to Windows 2000, and administer Active Directory after the migration has completed.These applications include: ■

FastLane Reporter, which reports information about the Windows NT or Windows 2000 accounts and resources

■

FastLane Administrator, which can create a test hierarchy as a superstructure over existing Windows NT domains, and can be used to delegate administrative tasks

■

FastLane Migrator, which takes a project approach to migrating from Windows NT to Windows 2000

www.syngress.com

Plugging into Active Directory • Chapter 17 ■

FastLane Developer, which scripts tasks even across different directory services

■

FastLane Consolidator, which can merge two servers into a single server

SAP has included a Lightweight Directory Access Protocol (LDAP) directory service interface with its management application for R/3.This interface can access Active Directory so that R/3 becomes a directory-enabled application.

Solutions Fast Track Microsoft’s Metadirectory  Microsoft acquired Zoomit’s metadirectory application and used it to

create the basis for Microsoft Metadirectory Services (MMS).  Metadirectories connect dissimilar directory services so that there can be

a single set of identity management, reducing errors and administrative overhead.  Rules at the field level can be created so that only approved sources of

information are used for each object and attribute.

Microsoft’s Active Directory Deployment Tools  Microsoft licensed ADMT from Mission Critical.  ADMT is a graphical tool, equipped with wizards, that can test and

implement migrations of user and computer objects from a Windows NT or 2000 domain to an Active Directory Windows 2000 domain.  ADMT can be used in domain restructuring, merging, or splitting

domains.  When deploying the DSClient, make certain that you have placed DNS

servers, domain controllers, and Global Catalog servers in locations that can be accessed by workstation traffic.  The DSClient.exe file is used to install the Active Directory client on

Windows 9x PCs.

www.syngress.com

545

546

Chapter 17 • Plugging into Active Directory

 Once the DSClient is installed, users can query Active Directory for

objects and network resources.

Quest’s FastLane Technologies  FastLane Technologies offers DM/Suite, a suite of applications that can

be used in managing and migrating to Active Directory.  FastLane Reporter provides reports on existing domains, and their

contents.  FastLane Consolidator can be used to consolidate Windows NT or

Windows 2000 servers to reduce administrative overhead.

Cisco  Cisco extended Active Directory with a product called Cisco

Networking Services for Active Directory (CNS/AD).  CNS/AD enables policy-based networking so that users’ traffic can

receive the appropriate priority.  Quality of Service is one of the applications that CNS/AD can

streamline.

Other Applications  SAP will integrate with any LDAP-compatible directory service.  SAP release 4.6c supports Active Directory integration.  Once SAP is integrated with Active Directory, the Active Directory

Users and Computers MMC can view and change SAP objects.  Microsoft’s Mobile Information Server extends the Active Directory

schema using a forest prep command: Drive:\setup /vforestprep.  MMIS also requires domains to be prepared using the command

Drive:\setup /vdomainprep=1.  After the schema is extended, user objects have a Wireless Mobility tab.  Instances of SQL Server can be registered in Active Directory.

www.syngress.com

Plugging into Active Directory • Chapter 17

 Analysis Services and Replication Publications can also be registered in

Active Directory.  Once SQL Server objects have been registered in Active Directory,

applications can query Active Directory using ADSI in order to locate SQL servers.

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: Is Microsoft’s Directory Synchronization Service (MSDSS) for Novell NetWare a metadirectory?

A: No. MSDSS is not a metadirectory, since it does not create a centralized index that connects Active Directory to others. Instead, it works more closely to a Multi-Master replication scheme, since no single directory owns any data.

Q: Is there a DSClient for Windows 3.1? A: No.There is no DSClient for Windows 3.1.There is a single DSClient for both Windows 95 and Windows 98, and a DSClient for Windows NT 4.0 is available from www.microsoft.com/ntworkstation/downloads/Other/ adclient.asp.

Q: How does CNS/AD change the way in which a user interacts with the network?

A: Users should not experience any overt changes in the way that they work on the network. Instead, CNS/AD works transparently through Active Directory. The results users see when they access directory-enabled applications or require a higher Quality of Service (QoS) will improve, since the users will no longer be required to be in a single place to use that service.

www.syngress.com

547

Chapter 18

Disaster Recovery for Active Directory

Solutions in this chapter: ■

Modeling Sites with Disaster Recovery in Mind

■

Avoiding Disasters

■

The Active Directory Database File Structure

■

Backup

■

Recovering a Failed Domain Controller

 Summary  Solutions Fast Track  Frequently Asked Questions 549

550

Chapter 18 • Disaster Recovery for Active Directory

Introduction Disasters come in many forms.They can range from a corruption of mission-critical data to a total destruction of a company’s sole office building along with all systems within it. Regardless of the extent of the destruction, the result is an interruption in business along with some loss of revenue. Not only is there a range for disasters, there is also a range for disaster recovery plans. Generally, these can range from a plan to store backup tapes offsite to a plan to move critical personnel to a hot standby site that is ready to begin working immediately upon their arrival.When developing your disaster recovery plan, you must estimate the likelihood of a disaster and the scope of destruction that a disaster might have. It may be more likely that you will experience a virus spread by e-mail than a hurricane if your office is located in a desert and you are connected to the Internet. However, don’t dismiss the possibility of natural disasters; Nature has its own way of making itself known. For example, if your building is located in an area that experiences hurricanes, establish a plan that will mitigate the disastrous effects of a hurricane and that is also realistically in line with the loss of revenue that might occur. If you have a small branch office that generates $30,000 profit per month, the plan should not exceed the revenue-generating potential of the office over a period of time during which the disaster’s effects could be fixed. If the hurricane damage can be repaired within three months, then the disaster recovery plan should not cost more than $90,000 to implement, since it would effectively be saving only that much. However, if the office is a multimillion-dollar generating campus with hundreds of employees, then a more extensive disaster recovery plan can be executed. For further information on general disaster recovery techniques and planning best practices, check out these Web sites: ■

http://admin5.hsc.uth.tmc.edu/ishome/dr/drwhy.html

■

www.paaet.edu.kw/Info/HomePage/shaheen/security.htm

■

www.disaster-survival.com/Planning_Overview.html

Modeling Sites with Disaster Recovery in Mind When planning Active Directory, keep disaster recovery preparation in mind. Sites offer a clear enabler of disaster recovery if their structure is implemented www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

according to your disaster recovery plan. Let me explain: If there is a planned cold standby or hot standby office (cold standby offices are available to begin business after being set up and data and personnel have been transferred to them, and hot standby offices have recent data and available personnel to staff them should an emergency take place), an Active Directory structure can be implemented in that office with an up-to-date copy of all identity information and resource information simply by placing appropriate DNS, DHCP, Global Catalog (GC), and domain controller (DC) servers for each domain that will use that standby site in addition to a link from the production network to the standby site. For instance, fobya.com is run by a company that has planned a standby site for disaster recovery.The network administrator establishes two sites within the fobya.com domain, one for the main office and one for the standby office.The company that sponsors the standby office establishes a T1 line between fobya.com and their data storage warehouse that houses the fobya.com standby servers. For the standby site, fobya.com places a server that manages DNS and DHCP, and a second server that acts as a DC and GC server.The fobya.com office maintains several servers and ships data backups to the warehouse on a weekly basis.The administrator then sets replication to occur every 30 minutes because the servers can handle the extra processing and there is no other data traveling across the site link.The configuration is similar to Figure 18.1. Figure 18.1 fobya.com Single-Domain Site Model for Disaster Recovery

Domain Controller Global Catalog

Domain Controller Global Catalog

DC

DC

DNS, DC

DHCP

DNS, DHCP Standby Site

Server

fobya.com main site

www.syngress.com

551

552

Chapter 18 • Disaster Recovery for Active Directory

Dealing with a single production office means that a network administrator must manage to a single point of failure. However, what happens if fobya.com grows to include multiple domains placed around the globe? Figure 18.2 shows the domain configuration for fobya.com after it has merged with other companies and become a global entity. In the new fobya.com forest, each domain exists in a separate country. Figure 18.2 fobya.com Global Site and Domain Configuration

fobya.com

United States

logy.com deka.fobya.com

United Kingdom Canada

sykol.logy.com triska.deka.fobya.com

Germany Japan

www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

If the network administrator creates a second recovery site for each of the domains, he or she will need to establish two links from that recovery site: one to the domain that will be recovered, and a second link to some other site.The reason for the dual links is that if a site crashes, the standby site will lose its link to the forest unless it has that second link. Because the sites are in different countries, the likelihood of a disaster wiping out more than one site is extremely small. Using standby sites for each domain may not be feasible. Instead, the network administrator can configure sites in a way that provides redundancy and backup of the domain information in a different site.The network administrator can place a DC from one domain into a site that houses most of another domain.The result would be similar to Figure 18.3. Figure 18.3 Modeling Multiple Domains and Sites for Disaster Recovery

fobya.com

United States

United Kingdom

dc5.fobya.com

logy.com DC1.deka.fobya.com deka.fobya.com

dc4.logy.com

Canada Germany sykol.logy.com

Dc2.triska.deka.fobya.com triska.deka.fobya.com

Japan

dc3.sykol.logy.com

Figure 18.3 ensures that the destruction of a single location, such as Japan, would not cause a complete loss of all the domain information for the triska.deka.fobya.com domain.There will be an incremental increase in traffic www.syngress.com

553

554

Chapter 18 • Disaster Recovery for Active Directory

between sites when domains span sites, since more data (from the domain partition) than the GC, schema, and configuration will be traveling across the wire.

Avoiding Disasters Many small disasters can be avoided through effective implementation of Windows 2000 features along with the appropriate hardware to support those features. Disaster avoidance can diminish the consequences of disasters.The following items contribute to disaster avoidance and recovery: ■

Uninterruptible power source (UPS)

■

Redundant Array of Inexpensive Disks (RAID) when implemented with parity (such as RAID 5) or mirroring (such as RAID 1)

■

Daily backup of data to removable media

■

Offsite storage of removable media

■

Backup diesel- or gasoline-powered generator to supply power campus-wide

■

Clustered servers

■

Antivirus

Uninterruptible Power Source A UPS provides power if an electrical failure occurs. Most UPS hardware will also provide line conditioning to prevent power surges from damaging your server equipment.Windows 2000 supports UPS power supplies. A UPS is added by configuring the UPS service in the Power Options applet within Control Panel. Most UPS manufacturers create their own UPS management programs.The basic UPS features supported by the Windows 2000 UPS service are as follows: ■

Detect power failures

■

Detect low battery

■

Shutdown from the UPS

When a UPS detects a power failure, it notifies the Windows 2000 Server, usually via a serial cable connected to the server’s com1 or com2 port. Newer UPS equipment supports Universal Serial Bus (USB), and connects to the server using a USB port and cable. www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

Windows 2000 maintains a configuration for the UPS that tells it how to act in the event of a power failure. In most cases, a UPS should be used to shut the server down in such a way that it will not cause data corruption, rather than to provide continuous power until the battery is exhausted. Even though the Windows 2000 UPS service supports a large number of UPS models, it is always best to implement the manufacturer’s UPS utility.This will ensure that you will receive the advantages of all the features that the manufacturer’s UPS equipment provides.

RAID There are several versions of RAID, the following being the most common: ■

RAID 0 A single disk, which is not really RAID but has gained the name from common use when people try to place a single disk into the RAID scheme.

■

RAID 1 Mirroring, which requires two disks.

■

RAID 5 Striped data with parity across disks, which requires three or more disks.

These are all configurable through Windows 2000 software or through hardware from manufacturers. A manufacturer’s hardware RAID solution is recommended because it offloads processing and management from the operating system to a separate piece of hardware in the server. If you want to implement mirroring RAID 1 or software RAID 5 in Windows 2000, use the Computer Management utility in the Administrative Tools menu.The disk configuration can be found under Storage\Disk Management, as shown in Figure 18.4. In order to implement software RAID 5, the disks must be in dynamic mode. If they are not, right-click each disk and select Upgrade to Dynamic Disk from the pop-up menu. RAID 5 volumes are created by clicking on the dynamic disk’s unallocated space and selecting Create volume from the pop-up menu, and then following the dialog sequence through the RAID 5 volume creation path. A RAID 5 array appears as a Failed Redundancy if one of its disks is offline, missing, or has errors. In order to recover a failed RAID 5 volume, first attempt to repair the disk by right-clicking it and selecting Reactivate Disk. If the disk is unable to be recovered, remove it from the system and replace it with a new disk.Then right-click the failed disk’s RAID 5 volume and select Repair Volume from the menu. Select the new disk from the dialog, and click OK.The array should be recovered. www.syngress.com

555

556

Chapter 18 • Disaster Recovery for Active Directory

Figure 18.4 Configuring Disks in the Computer Management Console

Whenever possible, you should implement hardware-based RAID rather than Windows 2000’s native software-based RAID.The performance for hardwarebased RAID is much better, and the recovery rate is higher. Other advantages of hardware-based RAID 5 include: ■

Hot swap support You can remove and replace a disk drive while the server is running. (Software-based RAID is usually limited to cold swap, which means you must take down the server in order to replace the disk.)

■

Hot spare support You can assign a disk to be a “standby.” In the case of a disk failure in the RAID array, the hardware automatically rebuilds the array using the hot spare.This is also called automatic swap.

Clustering Clustering is a group of independent servers called nodes that work together to provide fault tolerance to any single system failure within the group.There are two requirements to implementing clustering: ■

The software and hardware that creates a cluster

■

The software that manages the cluster

www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

Clustering can be configured in two modes: ■

Active—Passive

■

Active—Active

Active—Passive mode is used in failover situations. One server is active and engages in network activities. It sends a heartbeat message to the passive server to let it know that it is functioning.The passive server detects a failure if it does not receive the heartbeat from the active server. If there is a failure of the active server in a cluster, a passive server will continue to provide network services after a failover sequence is completed. Active—Active mode is used for both load balancing and failover. For load balancing, both servers act as though they are a single device on the network. They receive the same information and carry only part of the full load of network requests. If one of the servers fails, the other server continues to provide functions and takes over the full load. Windows 2000 Advance Server supports clustering.This can be deployed with the Windows 2000 cluster services or with a manufacturer’s application. When the Windows 2000 clustering is installed, a new program utility is added to the Administrative Tools menu called Cluster Administrator. A command-line utility called cluster.exe will also manage the server. Clustering is recommended for systems that must be available on a 24 x 7 basis.

NOTE Whenever possible, use hardware-based fault tolerance solutions. Manufacturers provide extended capabilities that increase the fault tolerance and reduce the performance hit that implementing such solutions may cause.

File Replication Service The File Replication Service (FRS) is a fault-tolerant system automatically configured on each DC. Since it is dependent upon DCs, you must have Active Directory installed to use it. FRS automatically replicates the contents of the SYSVOL share between all DCs.

www.syngress.com

557

558

Chapter 18 • Disaster Recovery for Active Directory

Distributed File Service The Distributed File Service (Dfs) offers the capability of creating a fault-tolerant root within Active Directory and adding up to 128 replicas across the network. A redundant system can only be implemented when the fault-tolerant Active Directory root is used; a standalone Dfs implementation cannot offer any redundancy.The Dfs utility is shown in Figure 18.5. Figure 18.5 The Dfs Console

The Active Directory Database File Structure Each DC contains a set of files that hold its portion of Active Directory.The file structure is a fault-tolerant transaction–based database, which is based on the Extensible Storage Engine (ESE).Transactions occur in a short sequence of actions: 1. The administrator creates an object, which initiates the transaction. 2. The transaction is written to a log file. 3. The transaction is then committed to a database buffer. 4. The transaction is completed when the database on the disk is written. Several files are involved in this process.The NTDS.DIT file is the database file that stores all the objects for that DC’s partition of Active Directory.There are also several log files: www.syngress.com

Disaster Recovery for Active Directory • Chapter 18 ■

Transaction logs

■

Checkpoints

■

Reserved logs

■

Patch files

Transaction log files can reach 10MB in size. A current transaction log, called edb.log, is used until it reaches the 10MB limit. At that point, the log is saved as a separate file, edb00001.log—where the numerical portion of the filename is incremented as new full logfiles are saved—and the edb.log is emptied for new transactions. Circular logging will not create the past transaction log files, such as edb00001.log, edb00002.log, and so on. Instead, it will rewrite over the current transaction log.The circular logging can be turned on to reduce the number of log files on the hard drive.The default behavior of Windows 2000 Active Directory is to execute circular logging. Since Active Directory is redundant, and replication will update a DC to the latest version of the directory service database, it is not important to save the latest logs for the latest data recovery. Instead, you simply allow the DC to replicate with its replication neighbors to reach the latest version of the Active Directory contents. There is a checkpoint file named edb.chk, which is stored in the same directory as NTDS.dit.This file holds the pointers to the transactions in the transaction logs that have actually been written to the database.The file literally checks the point at which the log file and the database are consistent. Two reserved log files, res1.log and res2.log, are also placed in the same directory as NTDS.dit.These files are each 10MB in size and will become log files if there is not enough space on the disk to create a new edb.log file. Any outstanding transactions are copied from memory into the reserved logs, and then Active Directory will shut down with an “out of disk space” error. Patch files are used to track transactions written to the Active Directory database during backup. Split transactions are those that are written across multiple database pages. A split transaction can be written to a portion of the Active Directory database that has already been backed up.The backup process is as follows: 1. A patch file with a .pat extension is created for the current database written to disk. 2. Backup begins.

www.syngress.com

559

560

Chapter 18 • Disaster Recovery for Active Directory

3. Active Directory split transactions are written both to the database and to the patch file. 4. The backup writes the patch file to tape. 5. The patch file is deleted. Do not delete log files. Active Directory will automatically run a Garbage Collection process to delete unused objects, delete unused files, and defragment the database.When files are manually deleted, Active Directory can become corrupted. Garbage collection will take place on a 12-hour interval basis. Offline database management is performed with the NTDSUtil.exe program. To run the offline database tool, start the server and at the initial boot menu screen press F8. Select the Directory Services Repair Mode option, and then run the ntdsutil.exe tool.

Backup Windows 2000 has a Backup utility program found in the Programs | Accessories | System Tools menu.This utility is shown in Figure 18.6. Figure 18.6 Backup

www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

The Backup utility provides the following features: ■

Data backup of files, folders, Active Directory, and system information

■

Scheduled backups

■

Storage of backup data on networked systems and removable media

■

Data and Active Directory restoration

■

Emergency repair disk creation

To create a backup job, you will select the files and folders to back up, the location to place the backed up data on, and options such as data verification or compression of the data. One of the new items in the Backup utility is the System State data. System State data refers to the server’s registry, component services Class Registration database (storing COM data), startup files, Certificate services data, Active Directory, and SYSVOL.Whenever creating a backup that is intended to be able to repair a server, select the System State in addition to the data that is being backed up.The System State data is selected by checking it off, as shown in Figure 18.7. Figure 18.7 Checking Off System State Data

The Backup utility does support a scheduled backup.This is a common feature in many backup utilities, where a backup automatically executes after standard business hours and is completed when administrators return. Scheduling

www.syngress.com

561

562

Chapter 18 • Disaster Recovery for Active Directory

backups to occur after standard business hours reduces the impact to network performance that a backup might cause.

Creating an Emergency Repair Disk In Windows 2000, the emergency repair disk is included as a backup option, rather than a separate application. Emergency repair disks contain minimal system data, although typically enough to get a downed server to restart.To create an emergency repair disk, select the option in the Backup utility as shown in Figure 18.8. The Backup utility will prompt for a diskette to be placed in the default drive A:. Figure 18.8 Create an Emergency Repair Disk

Recovering a Failed Domain Controller When a DC fails, there is typically more to be restored than just files and folders. There are two issues involved: ■

Transactions might not have been written to disk, but were written to log files for Active Directory.

■

Data in the Active Directory databases on other DCs might have had additional changes since the failure.

This means that the log files must be used to bring the written transactions to a current state. It also means that when the Active Directory database is brought www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

online, it must be synchronized with the rest of the domain and forest.To ensure that this happens, make certain to restore the System State data. After that is restored, an automatic consistency check occurs on the DC’s Active Directory database and then indexes it. After that, replication takes place and Active Directory is updated with the latest information, and file replication services restore the latest data versions from other DCs.

WARNING If the DC has a corrupted Active Directory database, you must use the Directory Services Restore Mode startup option before restoring the System State data.

Non-Authoritative Restore versus Authoritative Restore When you restore data to Active Directory, you can do it in one of two ways: ■

Authoritative

■

Non-authoritative

An authoritative restore will put objects into the Active Directory partition and essentially state that even though they are restored from objects with older versions or older dates, they are to be considered the latest version and date of the object. If you perform a full authoritative restore, then you will roll back the domain and Global Catalog to the point in time when you performed that backup (from which you performed the authoritative restore). By contrast, a non-authoritative restore will simply place data onto a DC and retain its original versions and dates. After an object has been restored using this method, objects and attributes with newer dates and versions on other DCs will synchronize the DC to their own latest version.This method of restoration is useful for reducing replication time when you have to restore a failed DC.

Authoritative Restore of Deleted Objects It is going to happen at some point. Someone will delete an organizational unit (OU) filled with user accounts or other objects. It will be an accident, of course,

www.syngress.com

563

564

Chapter 18 • Disaster Recovery for Active Directory

but an accident that you will need to fix quickly.The place to start is restoring your last backup—but there will be a problem… When you restore deleted objects from Active Directory, those objects will be deleted—actually become tombstones—the next time that replication takes place. The reason that this happens is that the objects have been marked for deletion in another DC’s replica of Active Directory, and replication will redelete them in the database you just restored.This is normally the behavior you want, except in the case of accidents. To prevent this behavior, you can execute an authoritative restore.This process will enable the objects that are restored to resist deletion when replication occurs. Each object that is restored in this manner will be marked as authoritative. The authoritative attribute prevails over the tombstone attribute when replication next occurs.The tombstone, by default, is retained for 90 days.To perform this operation: 1. Boot the computer. 2. At the startup screen, press F8 for Advanced startup options. 3. Select Directory Services Restore mode. 4. Restore the System State data of a backup that contains the objects that you want to restore. 5. After restoration has finished, close Backup. 6. Run NTDSUtil.exe. 7. Type authoritative restore at the prompt. 8. Type restore subtree and the distinguished name of the object or OU (for example, restore subtree ou=labs,ou=eng,dc=microage,dc=com). 9. Exit the NTDSUtil program and restart the computer normally.

Startup Options There are several options available when Windows 2000 starts.These can assist in returning a failed server to normal operations in different ways.Table 18.1 lists the startup options.

www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

Table 18.1 Startup Modes Startup Option

Function

Purpose

Debugging mode

Sends the debug data to Only use this when you need another computer through to do high-level debugging or a serial cable. are sending a report to a debugging expert. Directory Services Allows restoring of Active Use this whenever you need Restore mode Directory and SYSVOL files. to do offline defragmenting of the NTDS.DIT file using the NTDSUtil.exe utility, or when you need to restore or repair Active Directory on a DC. Enable Boot Creates an ntbtlog.txt file Use this if you want to find Logging in the systemroot showing out which device drivers are all device drivers loaded loading. This is helpful if you during startup. suspect one of them is causing problems on the server. Enable VGA mode Runs Windows 2000 using Use this if you accidentally a standard VGA driver. selected the wrong display driver and it will no longer load properly. When in this mode, you can change the display driver and then test it by rebooting normally. Last Known Good Starts up Windows 2000 Use this if you changed the Configuration with the last configuration server’s configuration and the that a full logon was exe- server will no longer get to cuted on. the point of a logon screen. Or, if you have reached the logon screen, but really don’t want to save your changes, reboot instead of logging on and select this option. Safe Mode Runs Windows 2000 with Use this if the server will not the most basic drivers, function properly and you creates a log file. suspect a device driver of some type is causing the problem. If it starts properly in Safe Mode, it is most likely a new device driver. Continued

www.syngress.com

565

566

Chapter 18 • Disaster Recovery for Active Directory

Table 18.1 Continued Startup Option

Function

Safe Mode with Runs Windows 2000 with Command Prompt the most basic drivers at a command prompt rather than the GUI, creates a log file. Safe Mode with Runs Windows 2000 with Networking the most basic drivers, loads networking drivers, creates a log file.

Purpose Use this if you want to change that device driver by copying over a file from a command prompt. This option is rather handy. Use this if you need to get the server into a file and print sharing mode and you have been able to get the server into Safe Mode, or if you want to test that the network device driver is not the one that has caused the server to stop functioning—if it has, this option will not work.

The Recovery Console The Recovery console does not automatically install on a Windows 2000 machine, nor does it have to be installed to be used. It can be executed from the Windows 2000 CD-ROM using the Recovery Console option when given the Repair Options screen. If you want to install the Recovery console, open a command prompt and execute: :\i386\winnt32 /cmdcons

When you use the Recovery Console option, you can configure a service to start or stop when the server boots—a handy tool for corrupted services that cause a server to hang before logons can begin.You may also copy files to the NTFS hard drive, which is handy in case one of the files on the hard drive has become corrupted. (Previously, this could only be attempted with a third-party tool that could access an NTFS drive from a DOS prompt.) Finally, you can manage files, folders, partitions, and disk drives, even deleting and recreating partitions and formatting them. However, changing partitions and formatting them should be a last resort when you have a server with errors.

www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

Summary When designing Active Directory, a part of the design should take into account the plans for disaster recovery. Because each DC holds several partitions of the Active Database—at a minimum, the schema, configuration, and the domain in which they belong—with some DCs containing a copy of the GC, they can become a point of failure if they are all held within the same physical location. If all the controllers in a single domain were held in a single building, the loss of that building would become the loss of that domain. Sites can be designed by adding an extra site for each standby office, or by maintaining at least one DC in another location. Windows 2000 Server, Advanced Server, and DataCenter Server support hardware that can help avoid disasters. RAID uses multiple disks to provide redundancy for data so that if one hard drive fails, the others can essentially continue providing services. UPS provides a source of power in the event of a power outage, and can shut a server down properly without causing data corruption. Clustering is a solution that provides redundancy for the entire server. If a server is in a cluster and it fails, the cluster undergoes a failover procedure that enables another server within the cluster to take over the processing for the failed unit. Windows 2000 also includes a file replication service (FRS) that can provide redundancy for data. FRS is executed automatically. Additionally, using the Distributed File System (Dfs) with a redundant root in Active Directory can provide fault tolerance for files, with additional replicas of data placed throughout the network that utilize the same UNC path.To a user on the network, or to a script, the UNC path never changes, even though the data might be located in different places. Redundant data can be used in the case of a downed server carrying a different replica of the same data. The Active Directory database consists of several file types: ■

The database itself—ntds.dit

■

Checkpoint files—edb.chk

■

Transaction logs—edb.log

■

Patch files—*.pat

■

Reserved log files—res1.log, res2.log

The patch files are used during backup.The checkpoint and log files are used to indicate which files have been written to disk and which have not.

www.syngress.com

567

568

Chapter 18 • Disaster Recovery for Active Directory

The Windows 2000 Backup utility can be used to both back up and restore Active Directory.The key to this process is to back up the System State data. If restoring Active Directory, an authoritative restore created with the NTDSUtil.exe utility can restore deleted objects and ensure that they persist after replication takes place.

Solutions Fast Track Modeling Sites with Disaster Recovery in Mind  You can plan redundancy in your site topology design to ensure an

easier disaster recovery, should a disaster occur.  A standby site is one in which redundant DCs for each Active

Directory domain are placed. Replication to a standby site should be held frequently enough to remain current, yet infrequently enough to not incur disastrous changes immediately after they occur.  When planning redundant DCs across site boundaries merely for

the purpose of disaster recovery, expect to see incremental bandwidth consumption.

Avoiding Disasters  You can use some of the features within Windows 2000 Server to avoid

disasters, such as UPS, RAID, Clustering, FRS, and Dfs.  A UPS should be placed on each server, so that power outages and

surges will not damage the server.  When possible, you should implement a hardware-based RAID solution,

instead of using the Windows 2000 software-based RAID solution because you will receive better performance.  FRS and Dfs are both methods of storing files redundantly on multiple

servers while seamlessly providing them to end users.

www.syngress.com

Disaster Recovery for Active Directory • Chapter 18

The Active Directory Database File Structure  The Active Directory Database is an Extensible Storage Engine (ESE)

database.  The main file on each DC containing the Active Directory partitions is

called NTDS.DIT.There are also checkpoint files, transaction logs, reserved logs, and patch files.  Active Directory supports circular logging by default because it is not

difficult to synchronize a DC to the latest Active Directory data after an outage.

Backup  You should schedule backups to take place on a periodic basis to ensure

recoverability of data.  The Windows 2000 Server backup utility will back up all Active

Directory-related information in addition to files.  The Windows 2000 Backup utility can be used to create an emergency

repair disk (ERD).

Recovering a Failed Domain Controller  After a failed domain controller has been recovered, it will synchronize

with the other domain controllers on the network and return to a current state of Active Directory.  To perform an authoritative restore of Active Directory objects, you

must run in Directory Services Restore mode.  To install the Recovery Console on a Windows 2000 machine, run

CD:\i386\WINNT32 /CMDCONS from the Windows 2000 installation CD. It will then appear in the boot menu.

www.syngress.com

569

570

Chapter 18 • Disaster Recovery for Active Directory

Frequently Asked Questions The following Frequently Asked Questions, answered by the author of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form.

Q: I have many files named edb000xx.log on my Windows 2000 Server and I would like to delete them to free up space. Can I delete them from Windows Explorer?

A: No.These log files are essential for ensuring that data is able to be restored to a current state.When a backup is performed, log files will be deleted automatically. If the log files are manually deleted, they may cause corruption to Active Directory.

Q: How often should I back up my domain controllers? A: It depends on how often changes are made in your network, whether you have files stored on the domain controller, and how much of that data you can afford to lose. It’s usually a good rule of thumb to run some sort of backup—whether full, differential, or incremental—on a daily basis.

Q: If I place a file on a DC’s SYSVOL, and I have 38 DCs, does that mean I will have 38 copies of that file on my network?

A: Yes. However, if you make a change to that file on any of the DCs, the others will synchronize as soon as replication fully converges.The only caveat for FRS is that the entire file will be transmitted, which can hog the wire. It’s usually a good idea to only place small, seldom-updated files into FRS.

Q: Can I run the recovery console if I didn’t install it on my server? A: Yes, you can run the recovery console directly from the CD-ROM, even if you didn’t install it.

Q: I can’t find the ERD utility to create a repair disk.What do I do? A: The Emergency Repair Disk (ERD) functionality has been moved to the Windows 2000 Backup utility. www.syngress.com

Appendix A

Migrating from Novell NetWare

571

572

Appendix A • Migrating from Novell NetWare

Novell NetWare is a network operating system that uses its own directory services system. In the original NetWare versions (3.x and prior), NetWare used a service called a Bindery.The Bindery was server-centric, so the more servers you had, the more administration you had to deal with. NetWare 4.x introduced Novell Directory Services (NDS), a hierarchical tree based on X.500 that could be transparently partitioned across multiple servers. Many of the features of NDS are similar to those of Active Directory. Because there are a multitude of applications built for Windows 2000, an organization may decide to migrate to Active Directory from NDS to gain the advantage of the application support.

Migrating from Novell Directory Services Many organizations have invested time and effort in creating a directory services tree (NDS) for Novell NetWare and then educating their users on navigating its specific OUs.The existing NDS model can be migrated to Active Directory so that users have a familiar navigational structure to use. You can select a third-party tool, or use a migration tool from Microsoft to execute your NetWare migration. Microsoft offers Microsoft Directory Synchronization Services (MSDSS) specifically for this process. MSDSS is a component of Microsoft Services for NetWare v5.0, which is a separate product available from Microsoft. 1. MSDSS must run on Windows 2000. 2. Network traffic is reduced if MSDSS runs on a DC. 3. The tool can be used for multiple migrations of NDS trees as well as legacy NetWare server binderies. Since 2000, most Novell NetWare users have upgraded to at least NetWare version 3.12.This version and all later versions can be migrated using MSDSS. 4. Each migration is established as an individual project within the tool. A migration can consist of a portion of an NDS tree or the entire tree itself.This enables an incremental migration. Such partial migrations are beneficial if you have modeled your Active Directory domain structure on your top level OUs or existing partitioning scheme in NDS. If you

www.syngress.com

Migrating from Novell NetWare • Appendix A

have done this, then you will only want to move a selected portion of the tree to any particular domain, rather than moving the entire tree into a domain and deleting the unwanted objects. 5. Before beginning a migration, the Network Administrator should have complete documentation of the NDS design, administration, and groups, and the same documentation for Active Directory. 6. Active Directory should be readied to receive the new resources by having the domains, DCs, OUs, and groups already designed and implemented. 7. Each migration project begins with the selection of the Novell NetWare resources that will be imported offline.The Network Administrator has the option to change some of the resource properties to fit the Active Directory model.Then the offline project can be exported to Active Directory. Additionally, files can be moved from NetWare servers to the Windows 2000 servers for any NetWare servers that will be taken offline through the tool.The project should end with a quality assurance check to ensure that the migration was successful. After starting MSDSS, a new project must be created.To create a new project, click the Action menu and select New Project. After creating the project, the first task is finding out what NetWare resources are available on the network. Creating a new view will start the Discover wizard and do just that.To create the view, right-click on the new project, select New and then View from NetWare. This step allows you to select the source users, groups, and containers that will be used for that project. The next step is to make any necessary changes to the objects, whether to conform to a new naming convention, establish new passwords, or move them into different containers.The objects are stored in an offline project database. The project data can then be exported into Active Directory.This is done by right-clicking an object in MSDSS project, selecting Task from the pop-up menu, and then selecting Configure Object to NTDS.The Configure Objects to NTDS wizard will prompt for the Active Directory destination OU, and after clicking Finish, the object will be exported. Migrating files is performed by right-clicking NDS volume objects in the project and selecting File Migrate from the pop-up menu.

www.syngress.com

573

574

Appendix A • Migrating from Novell NetWare

Other Utilities The value of migrating from NDS to Active Directory using a tool is mainly in saving the time and effort required to re-create user IDs, move files and grant rights and authorities. Utilities will speed up your project and allow you to reach your goal faster. Quest software (www.quest.com/solutions/ms.asp) offers a solution for migrating NDS trees to Active Directory.You can use their NDS Migrator plugin with the FastLane Migrator application to migrate an NDS tree. NetIQ (www.netiq.com/solutions/Windows/default.asp) provides the NetIQ NetWare Migrator utility to migrate NDS trees to either Windows NT 4.0 or Windows 2000 networks.

www.syngress.com

Appendix B

Secrets

575

576

Appendix B • Secrets

Lesser-Known Management Shortcuts The following sections contain descriptions of some of the management shortcuts that, while not well-known, can save an Administrator both time and effort.

Upgrading DNS and Supporting DNS Dynamic Update Protocol When you upgrade DNS from Windows NT 4.0 to Windows 2000, DNS does not automatically support dynamic updates. In fact,Windows NT 4.0 DNS service does not support DNS Dynamic Update Protocol (DDNS), so if you plan to use this feature, you should upgrade your NT 4.0 DNS first.The DNS Dynamic Update features must be manually changed in the new DNS Management Console: 1. Click Start | Programs | Administrative Tools | DNS. 2. If not running DNS on the local server, connect to the computer running Microsoft DNS. 3. Right-click on the zone that you want to support Dynamic Updates, and select Properties. 4. The General tab has a drop-down box for Dynamic updates—select whether any Dynamic update will be accepted, or trusted updates only.

Creating a Custom Microsoft Management Console One of the most annoying things to do is to change from one console to another in order to manage Active Directory. Luckily, the Microsoft Management Console (MMC) is customizable.To create an MMC console that contains all of the options that you need to manage Active Directory: 1. Click Start | Run | MMC, and then OK. 2. Click the Console menu and select Add/Remove Snap-in. 3. Click Add. 4. In the resulting dialog, select each of the consoles that you will want to use most often. (I recommend that you at least select Active Directory Users and Computers, Active Directory Sites and Services, DNS, and Computer Management.) You can always add or remove snap-ins from the console later. www.syngress.com

Appendix B • Secrets

5. Click Close and then OK when you have finished. 6. Click the Console menu and select Save or Save As. If you want the console to be available on this computer for any user, save it to the C:\Documents and Settings\All Users\Start menu or Desktop folders. 7. If you are creating a custom MMC for a user and want the console to appear in user mode rather than author mode, click the Console menu and select Options. Drop down the box that states Author mode and select a User mode.Then clear the box that enables the user to save changes to the console.This will lock the console into a mode that is more secure than the default.

PDC Emulation and Native Mode When a Windows 2000 Active Directory is working in mixed mode, it has an FSMO that is set to act as the “PDC Emulator.”The PDC Emulator takes on the tasks of a primary domain controller (PDC) to down-level Windows NT backup domain controllers (BDCs).This is an intuitive role for a PDC Emulator to play. What is interesting is that the PDC Emulator does not disappear after Active Directory is changed over to native mode. Instead, the PDC Emulator remains as a primary checkpoint for password changes.When a password is changed in Active Directory, the PDC Emulator is preferred to receive this replication traffic first.This role exists in order to manage situations in which replication of password changes may take several hours to complete across an entire Active Directory database. If a password is changed, it will be replicated as a changed password to the PDC Emulator.Then, if the user attempts to log on at another domain controller (DC), which has not yet received the update to Active Directory including that user’s password, the DC will not immediately reject the logon. Instead, the DC will contact the PDC Emulator and check with it first to make sure that the password is correct. Because the PDC Emulator FSMO gets all password changes immediately, it should be placed in a central location, well connected to the other subnets. A DC can be set to not contact the PDC Emulator if the PDC Emulator role owner is not in the current site. If the AvoidPdcOnWan registry entry in HKEY_LOCAL_MACHINE\CurrentControlSet\Services\Netlogon\Parameters\ is set to 1, the password change reaches the PDC Emulator nonurgently, through normal replication.

www.syngress.com

577

578

Appendix B • Secrets

The PDC Emulator in the root domain of the forest provides one other function, regardless of which mode the domain is in: it is the authoritative time source for the forest.This root domain PDC Emulator is the one that should be set up with an external time source in order for the forest to use an external time provider.The hierarchy of time providers is as follows: ■

Client workstations and member servers use the authenticating DC as a time provider.

■

DCs in a domain use the PDC Emulator of their own domain as the time provider.

■

Each PDC Emulator will use the PDC Emulator of its parent domain, or the forest’s root domain if they are the top of a domain tree, as its time provider.

■

The root domain’s PDC Emulator is at the top of the hierarchy and can be used to connect to external time sources.

How Active Directory Prevents Unnecessary Replication The bidirectional loop created for replication provides multiple paths for DCs to send and receive updated information, thus providing both fault tolerance and enhanced performance. A less desirable side effect could be that multiple instances of the same update are sent to the same DC, but Active Directory prevents this through propagation dampening. In Figure B.1, there are three servers that are direct replication partners to each other in a bidirectional ring. (They each have connection objects beneath their NTDS Settings for the other two servers.) When an object in Active Directory is updated on Server A, it changes the object’s Update Sequence Number, or USN. Replication occurs to both Server B and Server C since they are both direct replication partners. Servers B and C detect that Server A had replicated the change to both, so they do not send the update to each other.To make this process work, Active Directory uses two vectors: ■

Up-to-dateness vector

■

High watermark vector

www.syngress.com

Appendix B • Secrets

Figure B.1 Server Replication Ring

Server A

Server B Server C

The up-to-dateness vector is comprised of pairs of server USNs.The high watermark vector is the highest USN stored for each object. Propagation dampening occurs because each DC keeps track of its direct replication partners’ high watermarks.

Under-Documented Functions and Procedures The following sections describe under-documented functions and procedures of Active Directory.

How an LDAP Query Accesses Active Directory The lightweight directory access protocol (LDAP) query starts in the domain where the query was generated. In the Active Directory forest using LDAP, each domain knows about the other domains within its own tree, so LDAP is only referred within a single tree.To use an expanded scope including domains with other namespaces in a forest, the Global Catalog (GC) must be used. The LDAP referral process for an LDAP query acquires an authoritative answer first. In the following example, the LDAP client is asking for information about an Active Directory object within a sister domain:

www.syngress.com

579

580

Appendix B • Secrets

1. The LDAP client queries DNS for an LDAP server in the current domain. 2. DNS responds with a DC in the current domain. 3. The LDAP client queries the DC for information about an Active Directory object. 4. The DC refers the client to the parent domain. 5. The LDAP client queries DNS for an LDAP server in the parent domain. 6. DNS responds with a DC in the parent domain. 7. The LDAP client queries the parent DC for information about an Active Directory object. 8. The parent DC refers the client to another of its child domains. 9. The LDAP client queries DNS for an LDAP server in the sister domain. 10. DNS responds with a DC in the sister domain. 11. The LDAP client queries the sister DC for information about an Active Directory object. 12. The sister DC responds to the request.

Software Installation In group policy, assigning an application and publishing an application not only differ from each other, but have different attributes when applied to a User Configuration’s Software Installation package rather than a Computer Configuration’s Software Installation package.The resulting behavior is summed up in Table B.1.

www.syngress.com

Appendix B • Secrets

Table B.1 Assigning versus Publishing Details Assigned or Published

User or Computer Configuration

Assigned

User

Assigned

Computer

Published

User

Result Users will see a program icon “advertisement” on their desktop or Start menu when they log on. The program will not install until either that icon is doubleclicked or a file that has an extension associated with that program is executed. When the computer starts up and the group policy object is applied, the applications assigned to a computer are automatically installed. Any user who logs on to the computer will have that application automatically. When the user logs on, the group policy object enables the user to add or remove the program via the Add/Remove Programs icon in Control Panel. Additionally, if the user invokes a file with an extension that is associated with the program, the program will install. When the user logs off the machine, if the user never installed the application, the Add/Remove Programs icon will not remain for the next user unless that user has the same group policy applied. If the user installed the application, it will not be available to other users.

Group policy software distribution may appear to be dependent upon the Windows Installer, but this is not so. If you have a custom application to install that does not use the Windows Installer, you can create a .zap file to do the job. There are some limitations to using a .zap file, so if you have the option of using Windows Installer, you will be better off doing so: ■

You cannot assign a .zap file.

■

Your users will probably be required to answer setup questions, and they must have the local permissions for installing software on their computer.

www.syngress.com

581

582

Appendix B • Secrets ■

You do not get the benefits of the “auto-repair” functionality that Windows Installer provides. Instead, if the application cannot start, it will typically try to reinstall itself.

.zap files are text files that are similar to standard .ini files. A .zap file will let you install many applications through group policy, even if they can’t be installed with the standard Windows Installer.They have two standard headings: ■

[Application] This describes the name of the file, the setup command, and other application information.

■

[Ext] This is an optional section in the file that lists the extensions that this application will use.

How to Create and Configure a Dfs Root 1. Click Start | Programs | Administrative Tools | Distributed File System. 2. Once in the Dfs console, right-click on the distributed filesystem and select New Dfs Root. 3. The Create New Dfs Root wizard will start. After clicking Next at the Welcome screen, the wizard will prompt for the type of Dfs root. It is preferable to create a fault-tolerant Dfs root since that is integrated into Active Directory. If that is not desired, however, select create a stand alone Dfs root. 4. The next screen of the wizard will prompt for the server that is to host the Dfs root. 5. After that, the wizard will prompt for the share that will be the Dfs Root Volume. If you prefer, you can create a new share, rather than selecting an existing share. 6. Finally, you will be asked for a Dfs root name, which can be different from the share name. 7. After setting up the root, Dfs links and replicas can be added.This is done by right-clicking on the root (or subsequently added Dfs links),

www.syngress.com

Appendix B • Secrets

and selecting New Dfs Link or New Replica from the pop-up menu. Since the paths to the links use UNC naming conventions, you can add Dfs links and replicas throughout the network by indicating \\servername\sharename.

Informational Message At server startup time, there may be an NTDS Event number 1094 stating “Disk write caching on drive E: has been disabled to prevent possible data loss during system failures.”This message will only appear for drives that contain Active Directory and the log files. (Remember, the log files and Active Directory should not be placed on the same physical disk.) For any drive that has soft write caching enabled, Active Directory will disable it and leave this message.

Renaming A domain cannot be renamed. However, if you demote and repromote each of the DCs into a new domain, then either recreate the accounts or migrate them to the new domain, and finally join clients to the new domain, you will achieve the same effect as renaming. Do not attempt this with a domain that has child domains. If this is the case, you will need to migrate all the child domains before performing these operations on the parent domain. Similarly, the only way to rename a DC is to demote the DC, rename it, and then repromote it. Demoting a DC means that the Active Directory database partition for the domain is removed from the server. If there are no other DCs in the domain, all the user accounts and Organizational Units (OUs) will be lost.

Quick Application of an Updated Group Policy If you have created a new group policy and want to see if it works, you can apply it to the local machine with a simple command. In order to quickly refresh the group policy for a computer configuration without logging off and logging on again, run the following command from a command prompt on the local machine: secedit /RefreshPolicy MACHINE_POLICY /Enforce

In order to quickly refresh the group policy for a user’s configuration, run the following command from a command prompt on the machine where the user has logged on: secedit /RefreshPolicy USER_POLICY /Enforce

www.syngress.com

583

584

Appendix B • Secrets

DNS Migrations If the existing DNS server does not support SRV resource records (SRV RRs), the only options available to Windows 2000 users are to upgrade the DNS server to a version that does support SRV RRs, or to migrate to Windows 2000 DNS. The method of migrating to Windows 2000 DNS is dependent upon the final DNS configuration. If the existing DNS server is authoritative for the domain that Windows 2000 will be in—for example, domain.com—then the migration strategy should be: 1. Review the existing DNS zone information and make sure that it is current. Make any necessary changes. 2. Perform zone transfers with any secondary DNS servers so that all are current. 3. Install the Windows 2000 DNS server as a secondary server for the domain.com zone. 4. Perform a zone transfer so that the Windows 2000 DNS server becomes current. 5. Promote the Windows 2000 DNS server so that it is a primary DNS server for the domain.com zone. 6. Test that the Windows 2000 DNS server is primary for the zone by making a change to it and performing zone transfers from the other secondary servers. 7. Remove any secondary DNS servers that do not support SRV RRs. If there is no way to remove the existing DNS server as a primary server, for whatever reason, the other option is to delegate the Windows 2000 zones that contain the SRV RRs.These zones are actually created as subdomains. If the DNS domain is domain.com, the zones that must be delegated are: ■

_msdcs.domain.com

■

_tcp.domain.com

■

_udp.domain.com

■

_sites.domain.com

Each of these subdomains begins with an underscore so that those organizations that do have host names or domain names that use “msdcs” or “tcp,” for

www.syngress.com

Appendix B • Secrets

example, will not have conflicts when these domains are created automatically. It is much rarer for an organization to create domains with underscores at the beginning, so these names are fairly safe from causing conflicts. So, to use this technique, the migration strategy is: 1. Review the existing DNS zone information and make sure that it is current. Make any necessary changes. 2. Perform zone transfers with any other secondary DNS servers so that all are current. 3. Add the delegated zones to the existing DNS server and point it to the Windows 2000 DNS server. 4. Install the Windows 2000 DNS server as a primary server for the _msdcs.domain.com, _tcp.domain.com, _udp.domain.com, and _sites.domain.com domains. 5. Be sure to include the A record for the parent domain’s host.

DNS Best Practices ■

Delegate a zone for each Active Directory domain.Then place DNS servers, which are authoritative for each Active Directory domain, near their own domain’s DCs.

■

When there are multiple domains within a forest, and the forest root domain is separated from any of the child domains via slow links, create a delegated _msdcs.domain.com zone, then make DNS servers across those WAN links secondary servers to the _msdcs.domain.com zone. This will avoid extra traffic across the WAN.

■

Configure all clients to query more than one DNS server, even if the second of those servers exists across a WAN link.This practice will avoid errors in the case of a downed DNS server. “Client,” as used here, describes each Windows 2000 DC, member server, each network-aware TCP/IP printer, each workstation, and any other type of IP host that does not provide DNS services.

www.syngress.com

585

586

Appendix B • Secrets

For Experienced Users The following sections describe high-end procedures and functions.

Add a Server to Two Different Sites Simultaneously Using the Active Directory Sites and Services console will allow you to configure a server as a member of a single site. If you want a server to be available in multiple sites, you will, by design, need to use a different method. Allowing a server to be a member of multiple sites may result in poor network performance, so use this only as a last resort. Begin by logging on to the server that you want to make a member of more than one site. Make sure to use an Administrator’s name and password. Click Start and then Run.Type regedt32, and click OK. In the Registry Editor, navigate to HKLM\System\CurrentControlSet\ Services\NetLogon\Parameters. Select the Edit menu and choose Add Value. In the resulting dialog box, type the name SiteCoverage and select the type of REG_MULTI_SZ, then click OK. After that, enter the names of each site of which the server will be a member, putting each site name on a new line and using identical spelling and capitalization. After the last entry, press Shift and Enter to move to the next line, and click OK to finish. Now the server is a member of more than one site, but it will not show up in the Active Directory Sites and Services console.You can manually create the server objects by right-clicking on each additional site and selecting New, and then selecting Server. Place the NetBIOS name of the server in the space provided, and click OK. Once the server object has been created, right-click on it and select Properties from the pop-up menu. In the section under Computer, click Change. Select the correct server from the ones available on the network.This capability is useful when a site exists without a DC, as it allows a DC in another site to become the preferred logon DC.

Removing Phantom Objects A phantom object is one that has been removed from Active Directory, but for some reason still appears as an object within it.This type of error can happen when a command has not completed properly (the server lost power, received an unrecoverable network packet during the change to Active Directory, etc.). Such errors www.syngress.com

Appendix B • Secrets

are troublesome because they cause Active Directory to not truly reflect the current network configuration. Fortunately, this is not a difficult problem to solve. First, note the full path of the object, such as cn=object,cn=ou,dc=domain, dc=com.Then boot the DC into DS Repair Mode. Start NTDSUTIL.exe.Type Files and press Enter. Remove the object using its full path. Run a Header check, and then run an Integrity check. After these complete, reboot the server normally and initiate replication. Sometimes an object is left as a logical placeholder in Active Directory, even though its physical component has been removed. For example, if a DC is removed from Active Directory and does not appear in the Active Directory Users and Computers console (or when you run NTDSUTIL), it may still appear in the Active Directory Sites and Services console.When this happens, you can safely remove that object by right-clicking on the server object and selecting Delete from the pop-up menu.

Phantom Domains When an Administrator demotes the last DC for a domain, he or she should select the option for This server is the last domain controller in the domain.This will remove the metadata for the domain from the Active Directory forest. If the Administrator does not select it, the metadata for that domain must be removed as follows: 1. Log on to the domain naming master FSMO DC as a member of the Enterprise Admins group and force replication to take place. 2. Open a command prompt, type ntdsutil, and press Enter. 3. Type metadata cleanup, and press Enter. 4. Type connections, and press Enter. 5. Type connect to server nameofdomainnamingmasterFSMO, and press Enter. 6. Type quit, and press Enter. 7. Type select operation target, and press Enter. 8. Type list domains, and press Enter.You will see a list of domains associated with numbers. 9. Type select domain numberofdomain, and press Enter. 10. Type quit, and press Enter.

www.syngress.com

587

588

Appendix B • Secrets

11. Type remove selected domain, and press Enter. 12. Type quit, and press Enter until you have exited the NTDSUTIL.

Transferring FSMO Roles The RID master is a single designated DC in an entire forest that provides the relative ID (RID) portion of the SID to other DCs. Moving the RID master entails one of two methods. 1. In the Active Directory Users and Computers console, right-click on the domain and select Connect to Domain Controller from the pop-up menu. 2. Select the DC that will be the new RID Master, and click OK. 3. Right-click on the domain again, and select Operations Masters from the pop-up menu. 4. Select the Rid Pool tab. 5. Click Change at the bottom of the dialog box. 6. Click OK. Or, using NTDSUTIL, the Administrator can do the following to change the RID master: 1. Log on as a member of Enterprise Admins to any DC. 2. Open a command prompt, type ntdsutil, and press Enter. 3. Type roles, and press Enter. 4. Type connections, and press Enter. 5. Type connect to server servernameofnewRIDMaster, and press Enter. 6. Type quit, and press Enter. 7. Type transfer rid master, and press Enter. 8. You will be prompted by a dialog to transfer the role. Select Yes. 9. Type quit, and press Enter until you have exited NTDSUTIL. The PDC Emulator is a computer that acts as the PDC for Windows NT BDCs in a mixed domain. It also handles password changes and has authority for time for its domain.To change the PDC FSMO role:

www.syngress.com

Appendix B • Secrets

1. In the Active Directory Users and Computers console, right-click on the domain and select Connect to Domain Controller from the pop-up menu. 2. Select the DC to be the new PDC Emulator, and click OK. 3. Right-click on the domain and select Operations Masters from the pop-up menu. 4. Click the PDC tab. 5. Click Change, and Click OK. Or, using NTDSUTIL, the Administrator can do the following to change the PDC Emulator: 1. Log on as a member of the Enterprise Admins group on any DC. 2. Open a command prompt, type ntdsutil, and press Enter. 3. Type roles, and press Enter. 4. Type connections, and press Enter. 5. Type connect to server servernameofnewPDCEmulator, and press Enter. 6. Type quit, and press Enter. 7. Type transfer pdc, and press Enter. 8. You will be prompted by a dialog to transfer the role. Select Yes. 9. Type quit, and press Enter until you have exited the NTDSUTIL. The Infrastructure master is responsible for managing the group-to-user references.This will ensure that users are able to access resources.To change the Infrastructure master, do the following: 1. In the Active Directory Users and Computers console, right-click on the domain and select Connect to Domain Controller from the pop-up menu. 2. Select the DC that will be the new Infrastructure master, and click OK. 3. Right-click on the domain, and select Operations Masters from the pop-up menu. 4. Click the Infrastructure tab. 5. Click Change, and click OK to confirm.

www.syngress.com

589

590

Appendix B • Secrets

To perform the same change with NTDSUTIL, execute the following: 1. Log on as a member of the Enterprise Admins group on any DC. 2. Open a command prompt, type ntdsutil, and press Enter. 3. Type roles, and press Enter. 4. Type connections, and press Enter. 5. Type connect to server servernameofnewInfrastructureFSMO, and press Enter. 6. Type quit, and press Enter. 7. Type transfer infrastructure master, and press Enter. 8. You will be prompted to transfer the role. Select Yes. 9. Type quit, and press Enter until you have exited NTDSUTIL. There is only one domain naming master FSMO per forest.This designated DC ensures that any domain added to the forest has a unique name.To change the server that handles this role, first make sure that the new DC is also a GC server: 1. In the Active Directory Domains and Trusts console, right-click on the Active Directory Domains and Trusts root, and select Connect to Domain Controller from the pop-up menu. 2. Specify the name of the DC that will be the next domain naming master FSMO (remember, it must also be a GC server), and press Enter. 3. Right click on the Active Directory Domains and Trusts, and select Operations Masters from the pop-up menu. 4. Click Change. 5. Click OK to confirm. To execute this same process using NTDSUTIL: 1. Log on to a DC as a member of the Enterprise Admins group. 2. Open a command prompt, type ntdsutil, then press Enter. 3. Type roles, and press Enter. 4. Type connections, and press Enter. 5. Type connect to server servernameofnewdomainnamingmasterFSMO, and press Enter. 6. Type quit, and press Enter. www.syngress.com

Appendix B • Secrets

7. Type transfer domain naming master, and press Enter. 8. A dialog will appear to confirm the role transfer. Choose Yes. 9. Type quit, and press Enter until you have exited the NTDSUTIL. The schema master is the one DC upon which the schema can be changed. There is only one schema per forest.To change this role, you must use the Active Directory Schema Manager console: 1. Log on to a DC as a member of the Schema Admins group. 2. Start the Active Directory Schema Manager console and right-click on the Active Directory Schema root. 3. Select Change Domain Controller from the pop-up menu. 4. Specify the name of the DC that will be the new schema master, and click OK. 5. Right-click on the Active Directory Schema, and select Operations Master from the pop-up menu. 6. Click Change. 7. Click OK when a dialog confirms the role transfer. The change of the Schema Master FSMO can be accomplished using NTDSUTIL. 1. Log on to a DC as a member of the Enterprise Admins group. 2. Open a command prompt, type ntdsutil, then press Enter. 3. Type roles, and press Enter. 4. Type connections, and press Enter. 5. Type connect to server servernameofnewSchemaMasterFSMO, and press Enter. 6. Type quit, and press Enter. 7. Type transfer schema master, and press Enter. 8. Select Yes for the dialog regarding the role transfer. 9. Type quit, and press Enter until you have exited NTDSUTIL.

www.syngress.com

591

592

Appendix B • Secrets

Troubleshooting Tips The following are troubleshooting tips for Active Directory.

Avoiding Errors When Migrating a Domain Do not try to add a Windows 2000 server as a DC into a Windows NT 4.0 domain that has a Windows NT 4.0 PDC.The Windows 2000 DC will automatically emulate the PDC for that domain and cause conflicts.You will receive errors if you try to upgrade a BDC that exists in that domain before upgrading the PDC as well. Before upgrading any server to Windows 2000 and Active Directory, you should have a migration strategy documented.This will prevent errors during your migration process. As discussed in previous chapters, a simple domain upgrade process is as follows: 1. Clean up the domain accounts and synchronize. 2. Take a BDC offline for use in case you need to restore the NT domain. 3. Upgrade the PDC first. 4. Upgrade BDCs next. 5. Once the DCs are all upgraded to Windows 2000, you may switch to native mode at any time, and upgrade member servers to Windows 2000 as needed.

Remote Procedure Call Errors Strange but true: when you receive a Remote Procedure Call (RPC) error, you are most likely having problems with DNS—or worse, there could be a hardware problem, or an IP address that is not applied to the network interface, or some other lower-layer problem. RPC is the session-level protocol that runs procedures transparently on remote hosts. It can run over multiple lower-layer protocols including TCP/IP. It uses DNS to find remote services. DNS depends on IP addressing, which further depends on the Physical and Data Link layer protocols such as Ethernet or Token Ring, and those lower-layer protocols can only function if the network interface is working and connected to a functional network. So, the order in which to troubleshoot an RPC error is this:

www.syngress.com

Appendix B • Secrets

1. Run NetDiag. 2. Check your DNS server’s configuration (DNSCMD on a Windows 2000 DNS Server). 3. Verify that your workstation’s network interface has an IP address (you can use WINIPCFG or IPCONFIG on most Windows machines). 4. Check to make sure the network interface card (NIC) is functioning. (If the NIC has lights, are they green? Did you run the vendor diags?) 5. Check the network cable. 6. Check the hub and switches to make sure that they are functioning.

www.syngress.com

593

Index A .aas files, 400 Access Control Entries (ACEs), 424, 437–438 Access Control Lists (ACLs), 12, 112 access tokens, 438 Account policies, 429, 430–434 accounts, directory, 11, 12 ACEs. See Access Control Entries (ACEs) ACLs. See Access Control Lists (ACLs) Active Desktop, 511 Active Directory, 74–75 administration with, 76–77, 308–310 advantages of, 90–91 architecture of, 20–21, 22–23, 33–35 business objectives met by, 47–49 database location for, 295 Directory Enabled Networks (DEN) standard and, 5 disadvantages of, 91–92 distribution across multiple servers, 15 DNS namespaces and. See DNS namespaces domain controller promotion/demotion by, 75–76 Domain Name Service (DNS) and. See Domain Name Service (DNS) domains. See domains Dynamic DNS (DDNS) and. See Dynamic DNS (DDNS)

Extensible Storage Engine (ESE) database, 16, 74 forests and. See forests impact on computer industry, 88–90 Intellimirror and, 48–49, 82–83, 394 interim-mixed domains and, 240, 255 Internet capabilities and, 16–17, 85 Internet Protocol (IP) and, 17 Kerberos security and. See Kerberos LDAP and. See Lightweight Directory Access Protocol (LDAP) migrating Exchange Server 2000 to, 129, 463–465 migrating Novell Service Directory Services to, 129, 572–574 mixed-mode domains and, 240, 255–256 Multi-Master database replication, 14, 15, 18–19, 21–22, 109–112, 256, 406 naming conventions for, 17, 127–128 native-mode domains and, 240, 256–257 .NET platform and, 16–17 objects and. See objects, Active Directory organization of, 15 Organizational Units (OUs) and. See Organizational Units (OUs) planning for. See planning process, Active Directory

prevention of unnecessary replication by, 578–579 resource accessibility and, 86–87 scalability of, 78–80 schema of. See schemas scope of, 24–25 single-point administration by, 15, 18–19, 82 time synchronization and, 362–363 virtual containers and, 128 Active Directory APIs, 17 Active Directory architecture, 20–21, 22–23, 33–35 administration model, 35 data model, 33 design issues, 59–60 Kerberos security model, 34–35 schemas and, 27–28, 33–34 Active Directory Connector, 463–465 Active Directory Domains and Trusts MMC, 327–329, 338, 339 Active Directory implementation, 61–67 Active Directory-integrated zones and, 109–112, 298, 299 budgeting for, 63–64 DNS installation and configuration, 277–284, 375–376 domain controller (DC) implementation, 377–381 domain installation, 284–297 forest management and, 338–341 forest plan implementation and, 329–334 gap analysis and, 65–66 595

596

Index

integration with DNS and, 100, 106–108, 298 object management and, 300–308 Organizational Unit (OU) creation and, 382–384 project timeline for, 61–63 risk analysis and, 66–67 role-based administration and, 308–310 setting milestones for, 63 site component creation, 348–356 site implementation, 384–385 site structure implementation, 356–361 sizing of Active Directory Store, 334–338 staff communications and, 64–65 time synchronization and, 362–363 TravelToppers, Inc. case study of, 370–385 Active Directory installation, 251–257, 276–277 with Active Directory Wizard, 107, 108, 126, 251–254, 276 contact of domain controllers (DCs) with DNS server and, 106, 107 DNS server configuration and, 107 DNS support of SRV RRs and, 106–107 mixed-mode domains and, 240, 255–256 native-mode domains and, 240, 256–257 scenarios for, 251–254 storage and replication of DNS zones, 106, 108

See also server migration Active Directory Installation Wizard, 107, 108, 126, 251, 276 Active Directory integrated zones, 109–112, 298 changing to primary or secondary zones, 299 creation of, 299 Dynamic DNS (DDNS) updates and, 111, 112 Multi-Master database replication and, 109–110, 111 name conflicts and, 111 Active Directory Migration Tool (ADMT), 141, 261–262, 308, 377, 530 Active Directory Names and Trusts console, 85 Active Directory SDK, 17 Active Directory Services Interface (ADSI), 89, 320, 460–462 directory objects, 461 naming conventions, 461 schema management objects, 89, 461 scripting and, 74, 461 Active Directory Sites and Services MMC bridgehead server designation and, 181 Global Catalog (GC) server designation and, 172–173 IP subnet creation with, 351–352 site creation with, 348, 349–350 site link object creation with, 353–354 site management with, 122, 170 Active Directory Sizer Tool, 285, 334

Active Directory Store, 334–338 defragmentation of, 337–338 garbage collection and, 336–337 minimum size reserved for, 337–338 tombstones and, 335–336 Active Directory Users and Computers MMC, 155, 156 Organizational Unit (OU) creation with, 300–301 publishing folders with, 452–453 Active Directory Wizard (Dcpromo.exe), 76, 107, 108, 126, 251, 276, 289–296 domain controller (DC) creation, 289–296, 384 execution of, 251, 289–290 forest creation and, 290, 318–319 server promotion to domain controller (DC) with, 248–249 synchronization of domain controllers (DC) by, 265–266 Windows NT and SRV RR support and, 245 Add Printer wizard, 459–450 Add/Remove Programs utility, 287–288 adjusting desktop toolbars, disabling, 511 .adm files, 400–402 administration Active Directory model, 35 administration, role-based, 308–310 management of with MMC utility, 308–309

Index

tiered structure for, 309–310 administrative duties, Organizational Units (OUs) and, 35, 76–77, 121, 122 Delegation of Control Wizard and, 156–158 migration from Win NT to Win 2000 and, 264–265 resetting passwords and, 159 verifying transfer of duties, 158 See also Organizational Units (OUs) administrative templates (.adm), 400–402 Administrator accounts, 123, 124 Administrator password, 296 Adminpak.msi file, 394–395 ADMT. See Active Directory Migration Tool (ADMT) ADSI. See Active Directory Services Interface (ADSI) ADSI Edit utility, 335–336 garbage collection and, 336–337 tombstone lifetime and, 335–336 viewing Schema container with, 491, 492 Adsizer tool, 285 aging, zone, 112–113, 283–287 aliases, directories and, 12 Anonymous Logon group, 428 answer file, creation of, 288, 289 Application Compatibility Toolkit, 266

application deployment files, 400 Application Programming Interfaces (APIs), 16–17 Application Service Providers (ASPs), 215–216 Application Stub RPC component, 462 applications assignment of, 416, 417, 580–581 best practices for deployment of, 417 defining installation of, 416–417 Distributed File System (Dfs) and, 418 group policies and, 416, 418 installation options for, 418–419 publishing of, 416, 417, 580–581 removal of, 419–420 RPC-enabled, 462 arcs, 486 ARPANET, 85, 101 asset management tools, 55, 57 ATTCACHE table, 492 attributes, 320, 474, 488–490 creation of new, 488–489, 490 modification of, 489 relationship to objects, 474–475 replicating to Global Catalog (GC), 494 syntax of, 474, 488 attributeSchema object, 320, 474 .au domain name, 102 Authenticated Users group, 428–429

597

authentication, Active Directory and, 22–23 Kerberos security and, 22, 34–35, 84–85, 256, 324 site configuration and, 32 Windows NT v. 3.51 upgrades and, 248 authoritative data restores, 563–564 authoritative zones, 103, 104–105

B back-out back-up domain controllers (BDC), 244 backup domain controllers (BDC), 7–8, 76, 82 creation of back-out, 244 migration of from Win NT to Win 2000, 242, 246 synchronization of with PDC, 246–247 upgrade of, 237 Backup utility, 560–562 BDC. See backup domain controllers (BDC) benefits, Active Directory project, 51–52 bidirectional trusts, 30–31, 84–85, 323–324 Bridge all site links option, 178 bridgehead servers, 22, 28, 181 budgets, Active Directory implementation and, 63–64 Builtin container, 428 business objectives gap analysis of, 65–66 identifying through interviews/questionnai res, 44–45 importance of defining, 43–44

598

Index

Insurance, Inc. (case study), 139 internally vs. externally focused, 46–47 Kings Vineyards (case study), 200–203 matching with available technology, 45–46 ones Active Directory can meet, 47–49 Tekkietech.com (case study), 137

C case insensitivity DNS name, 102 legacy system integration and, 125 case studies, 136 DNS implementation, 375–376 domain controller (DC) implementation, 377–381 domain design, 145–147, 210–213, 370–372 forest design, 141–143, 208–209, 370 Govern.com case study, 502–515 group policy solutions, 504–514 initial site establishment, 222–226 Insurance, Inc. overview, 138–140 Kings Vineyards overview, 198–226 Organizational Unit (OU) creation, 382–384 Organizational Unit (OU) plan, 148–150, 214–222, 373 site implementation, 384–385 site topology plan, 373–375

Tekkietech.com overview, 136–138 TravelToppers, Inc. overview, 370–385 tree structure, 145–147, 210–213 See also specific cases CCMS. See SAP Computing Center Management System (CCMS) Certificate Authority (CA) service, firewalls and, 191 certificates, 440 Certification Authority (CA), 440, 441, 458–459 /check switch, MOVETREE tool, 339 checkpoints, 559 child domains, 333–334 group policies and, 334 trust relationships and, 333–334 circular logging, 559 Cisco Networking Services for Active Directory (CNS/AD), 537–541 partnership with Microsoft, 88 Service Management System (CSM), 538 Citrix MetaFrame, 205 Class containers, ADSI, 461 CLASSCACHE table, 492 classes, object. See object classes classSchema object, 320, 474 clients, 266–268 upgrading to Windows 2000, 266, 267–269 upgrading to Windows XP, 266–267 ClonePrincipal utility, 261, 264, 331

cloud connections, site links for, 352–353 Cluster Administrator, 557 cluster.exe, 557 clustering, 47, 556–557 Active—Active mode, 557 Active—Passive mode, 557 CNS/AD (Cisco Networking Services for Active Directory), 537–541 Collaborative Data Objects (CDOv2) interface, 22 .com domain name, 102 Common.adm template, 401 communications, need for during Active Directory project, 64–65 Complete Trust domain model, 8 component migration, 257–264 Active Directory Migration Tool (ADMT) for, 261–262 ClonePrincipal and, 261 domains, 239–243, 257–258, 259 forests, 257 global groups, 264 machine accounts and, 262 Organizational Units (OUs), 258, 264–265 splitting domains, 258 user accounts, 260–262 computer accounts, creating new, 306–307, 383–384 Computer Association, 57 Computer Management MMC, 307, 451 Computer Migration Wizard, 261 Computer Node policies, 508–509

Index

computer objects, adding new, 306–307 Computing Center Management System (CCMS), 542 Conf.adm template, 401 Configuration containers, 491, 580–581 changing tombstone lifetimes and, 335–336 forests and, 318, 320 group policies and, 83, 397, 402–403, 404 naming context and site topology, 182 replication of, 173–174 scripts in, 413 configuration management, 504–505 connection objects, 175–176 creation of, 175–176, 350–351 establishment of replication schedule by, 351 Knowledge Consistency Checker (KCC) tool and, 174–175, 176, 350–351 consistency checks, 490 containers, 29 ADSI, 461 Configuration. See Configuration containers Control Panel, 511 desktop, 511 Dialup Connections, 511 linking Group Policy Objects (GPOs) to, 412–413 replication of, 173–174 virtual, 128 contiguous namespaces, 20, 322, 331–332. See also DNS namespaces Control Panel container, 511

convergence, network, 13–14 cost-benefit analysis, Active Directory project, 50–51, 50–52 budgeting and, 63–64 capital expenditures, 50 expense reductions, 51 labor costs, 50 ongoing costs, 51, 52 productivity increases, 51 projected savings, 51–52 real estate costs, 50–51 revenue increases, 52 training costs, 51 costs, site link, 176, 177, 178, 353 Create Shared Folder wizard, 451 CSM (Cisco Service Management System), 538 custom Microsoft Management Consoles (MMCs), 309, 576–577

D DAP. See Directory Access Protocol (DAP) data, restoring, 563–564 database directories, 13–14 administration of, 15 Extensible Storage Engine (ESE) and, 16 replication of, 14 database store, 13–14 database update protocols, 14 DC. See domain controllers (DC) Dcdiag.exe, 119, 277 DCOM (Distributed Component Object Model), 463 Dcpromo.exe, 76, 107, 108, 126, 251, 265–266, 276, 289–296

599

domain controller (DC) creation, 289–296, 384 execution of, 251, 289–290 forest creation and, 290, 318–319 server promotion to domain controller (DC) with, 248–249 synchronization of domain controllers (DC) by, 265–266 Windows NT and SRV RR support and, 245 Debugging mode,Windows 2000, 565 decentralized administrative features, Active Directory, 76–77 Default-First-Site-Name site, 170, 174, 357 defragmentation, 16, 336–337 defragmentation utilities, 16, 336–337 ADSI Edit utility, 336–337 NTDSUTIL utility, 337 Delegation of Administration wizard, 300 Delegation of Control wizard, 156–158, 264–265 Desktop container, 511 desktops adding new to Active Directory, 306–307 assessment of during planning stage, 57 providing software to, 48–49 upgrading to Windows 2000 Professional, 266 upgrading to Windows XP, 266–267 Dfs. See Distributed File System (Dfs) DHCP addresses, changing static, 286–287

600

Index

DHCP (Dynamic Host Configuration Protocol), 112, 283 Dialup Connections container, 511 Dialup group, 429 digital certificates, 440 digital signatures, 440 directories, 11–12 accounts and, 11, 12 resources and, 11, 12 schemas and, 13 services and, 11, 12 Directory Access Protocol (DAP), 10–11 directory database. See directory store Directory Enabled Networks (DEN), 5–6 Directory Information Shadowing Protocol (DISP), 10–11 Directory Information Tree (DIT), 10 Directory Operational Binding Management Protocol (DOP), 10–11 Directory Service Client Setup Wizard, 531–532 Directory Service Restore mode, 296–297 directory services Access Control Lists (ACLs) and, 12 for Directory Enabled Networks (DEN), 5–6 distributed, 13 hierarchy of objects in, 12 history of development of, 6–10 interfacing non-Active Directory with Active Directory, 460–468 organization of, 13 purpose of, 4, 6

resources and, 11, 12 types of information stored in, 4–5, 11–12 X.500 directory standard, 10–11 Directory Services Restore mode,Windows 2000, 565 directory store, 13–14. See also Active Directory store Directory Synchronization Services (MSDSS), 89 Directory System Agent (DSA), 10 Directory System Protocol (DSP), 11 DirXML, 89 Disable and remove links to Windows Update option, 510 Disable drag-and-drop context menus on the Start Menu option, 510 Disable user tracking option, 510 disaster recovery, 54–55, 87, 550–566 Backup utility and, 560–562 clustering and, 556–557 Distributed File System (Dfs) and, 558 emergency repair disks for, 562 File Replication Service (FRS) and, 557 log files and, 558–560 RAID systems and, 555–556 Recovery console and, 566 recovery of failed domain controllers, 562–563 restoring data, 563–564

restoring deleted objects, 563–564 site architecture and, 550–554 startup options and, 564–566 interruptible power sources and, 554–555 disk quotas, 422 “Disk writing caching on drive E: has been disabled to prevent possible data loss during system failures” message, 583 disks, emergency repair, 562 DISP. See Directory Information Shadowing Protocol (DISP) display specifier, 494–495 distinguished name (DN), 25–26 Distributed File System (Dfs), 418, 457–458, 558 Dfs root creation and configuration, 582–283 Dfs utility, 558 fault-tolerant configuration, 457, 458 standalone configuration, 457, 458 Distributed Management Task Force (DMTF), 5 distributed network management, 308–310 Distribution groups, 303 Distributed Object Component Model (DCOM), 463 DIT. See Directory Information Tree (DIT)

Index

DMTF. See Distributed Management Task Force (DMTF) DN. See distinguished name (DN) DNS domain names. See domain names, DNS DNS Microsoft Management Console (MMC), 127, 284 DNS namespaces. See namespaces, DNS DNSCMD tool, 109 dnsHostName attribute, 129 dnsNode objects, 111, 298, 299 dnsRecord attributes, dnsNode objects and, 298, 299 dnsZone object, 111, 112 domain controllers (DC), 7–8, 13, 17 Active Directory Store and, 334 Active Directory Wizard installation of, 289–296 adding first in Active Directory, 285–288 connection objects between, 176 contact of Active Directory with DNS server during installation of, 106, 107, 118 Default-First-Site-Name site for, 170, 174 demotion of, 75–76, 251 domain partitions and, 332 File Replication Service (FRS) and, 557 garbage collection and, 336–337 InterSite Topology Generator (ISTG) and, 184, 186–187

Kings Vineyards case study and, 224–225 Knowledge Consistency Checker (KCC) tool and, 174–175 migration of from Win NT to Win 2000, 241–242, 377–378 number of servers for, 120, 144 number per site, 190, 224–225 promotion of, 75–76 recovery of failed, 562–563 replication of domain partitions and, 171, 172 replication of Schema and Configuration containers and, 173–174 resource record (RR) registration and, 291–293 root domains and, 119–120 self-publishing of with DDNS, 112–113 sizing capacity requirements for, 285, 334 SRV RRs and, 106–107, 108–109, 118, 144 tombstones and, 335–336 upgrading of, 378–379 Domain Global groups, 263 Domain Group policies, 82, 397 Domain Local groups, 263, 304–305, 427 Domain Name Service (DNS), 101–104 Active Directory-integrated zones and, 109–112, 298, 299 checking infrastructure of, 119, 277 configuration of, 281–282

601

contact with Active Directory domain controllers and, 106, 107, 118 DNSCMD tool for, 109 Dynamic DNS (DDNS) and. See Dynamic DNS (DDNS) dynamic updates of, 283, 576 hardware requirements for, 117 hierarchical nature of, 102–103 installation of on Windows 2000 Server, 278, 375–376 integration of Active Directory with, 85–86, 100, 106–108, 298 Kings Vineyards case study, 226 master name servers, 104–105 Microsoft Management Console (MMC) management of, 109, 110 migration of Win NT to Win 2000 domain controllers and, 245 name resolution and, 102–104 number of servers for domain controllers, 120–121, 144 primary DNS name servers, 103 referral process, 103–104 resolvers and, 103–104 scalability and, 101–102 secondary DNS name servers, 103 server availability and, 120–121, 144

602

Index

server compatibility and Active Directory, 277–278 server migration and, 584–585 SRV RR registration and, 284 SRV RR support and, 106–107, 108–109, 118, 144, 277 translation of IP addresses by, 4, 5, 18 TravelToppers, Inc. case study and, 375–376 versions used with Active Directory, 109 Windows Internet Naming System (WINS) and, 108 zones and, 103, 104–105, 106, 282–284 domain names. See DNS domain names domain names, DNS, 5, 18, 23, 102–103 defining, 125–126 registration of with InterNIC, 127, 145 rules for, 125 virtual containers and, 128 See also namespaces, DNS Domain Naming Master, 480, 590 Domain Operations Master, 186 domain partitions, 27–28, 78, 171, 172, 332 domain plan document Insurance, Inc. case study, 146–147 Kings Vineyards domain plan, 210–213 server migration planning and, 235–236 Tekkietech.com case study, 145–146

domain restructuring, 237–239, 242–243, 405–406 domain security policies Domain Security Policy console, 429–434 restricted groups and, 423 verifying before PDC migration, 243 domain trees, 20, 24, 30–31, 78, 79, 331–333 Active Directory design issues and, 59 contiguous namespaces and, 322, 331–332 creation of with Active Directory Wizard, 290, 291 distinguished name (DN) of objects and, 25–26 Kings Vineyards case study and, 210–213 migration of from Win NT to Win 2000, 240–241 MOVETREE tool for, 120, 338–339 structure of, 331–333 trust relationships and, 332 viewing namespaces, 31–32 viewing trust relationships in, 30–31 domain upgrades, 237–239 domains, 20, 30, 117–118, 144–145 avoiding errors when migrating, 592 components of, 8 directory service elements of, 9 domain forests. See forests domain plan documents for, 116–121, 136, 235–236 domain trees. See domain trees

globally unique identifier (GUID) and, 144 group policies and, 405–406 installing in Active Directory, 276, 284–296, 379–381 interim-mixed, 240, 255 LDIFDE.exe import/export tool and, 120, 340–341 linking Group Policy Objects (GPOs) to, 412–413 merging legacy, 242–243, 258 migration of from Win NT to Win 2000, 239–240, 241–242, 257–258, 375–376 mixed-mode, 240, 255–256 MOVETREE tool for, 120 multiple domain structures, 8, 9 naming context and site topology, 182 native-mode, 240, 255, 256–257 NetBIOS names for, 294 number of servers for, 120–121 object security policies and, 117 Organizational Units (OUs) and, 20–21 phantom, 587–588 renaming, 294, 583 replication of domain partitions, 171, 172 restructuring, 237–239, 242–243, 405–406 root. See root domains rules for, 144–145 scalability of, 78–80 security policies and, 117–118

Index

sizing capacity requirements for, 285, 334, 337–338 spanning of by sites, 167 spanning of sites by, 168 splitting legacy, 242–243, 258 switching mode of, 257 traffic issues, 143–144 trust relationships and, 323–329, 332 upgrading, 237–239 user authentication and, 118 Domains and Trusts MMC, 327–329, 338, 339 DOP. See Directory Operational Binding Management Protocol (DOP) DS (Directory Services) Client, 268 DSA. See Directory System Agent (DSA) DSASTAT, 362 DSClient file, 531–532 DSP. See Directory System Protocol (DSP) Dynamic DNS (DDNS), 102, 109, 112–113 Active Directory-integrated zones and, 111, 112 enabling after DNS upgrade, 576 migration of Win NT to Win 2000 domain controllers and, 245

E e-mail addresses, 128 edb.chk, 559 edb.log, 559 .edu domain name, 102 emergency repair disks, 562 empty root domains, 145

Enable Boot Logging Windows 2000 startup option, 565 Enable VGA mode Windows 2000 startup option, 565 encoding characters, 124–125 Encrypted File System (EFS), 458–459 encrypted files, EFS and, 458–459 Entivo asset management tools, 55 envisioning, 42–44 escalation planning, 65 Everyone group, 429 Exchange Server, 16, 465–468 distribution groups, 303 migrating design of, 129 Exchange Server Active Directory Connector, 463–465 expense reductions, estimating, 51 eXtensible Markup Language (XML), 414 Extensible Storage Engine (ESE) database, 16, 74, 465, 558

F “Failed to open the Group Policy object” error, 425 FastLane Technologies, 55, 88, 532–537 FastLane Administrator, 534–535 FastLane Consolidator, 537 FastLane Developer, 537 FastLane Migrator, 535–537 FastLane Reporter, 533–534

603

fault-tolerant Distributed File System (Dfs), 457, 458 File Replication Service (FRS), 557 file systems, converting to NTFS, 289 Find utility, 456 firewalls, 188, 191 Flexible Single Master of Operations (FMSO), 81, 186, 285, 479–481 Fluke, 55 folders browsing and querying for shared, 454–457 Distributed File System (Dfs) and, 457–458 Encrypted File System (EFS) and, 458–459 offline, 421 publishing, 452–454 redirected, 83, 420–422 sharing, 451 ForestPrep command, 467 forests, 20, 21, 24, 30, 78, 319 Active Directory design issues and, 59, 60, 114–116 Configuration containers and, 318, 320 creation of new with Active Directory Wizard, 290, 291 domain tree structure in, 331–333 Domains and Trusts MMC and, 338 Global Catalog (GC) and, 318, 320–322 Insurance, Inc. forest plan, 142–143 Kings Vineyards forest plan, 208–209 LDIFDE.exe import/export tool and, 116

604

Index

management tools for, 338–341 migration process for, 239–241, 257, 259 multiple, 115–116, 329–331 namespaces and, 141, 322 plan for, 114–116, 136, 140–143, 235–236, 329–331, 370 root domains and, 119–120, 140, 318 rules regarding, 140–141, 331 scalability and, 78 schema of, 318, 320 selecting first to migrate, 236–237, 240 sites specific to, 168 trust relationships in, 323–324, 381 forward-lookup zones, 282–283 Forwarders, enabling of, 280 FRS. See File Replication Service (FRS) Full control, assigning to another Administrator, 156–158 fully qualified domain name (FQDN), 102

G gap analysis, 65–66 garbage collection Active Directory Store and, 336–337 log files and, 560 generic management agent, MMS, 529 Global Catalog (GC), 28, 78, 171–173, 320–322 designation of domain controllers as, 321 Infrastructure FMSO and, 191

Kings Vineyards case study and, 226 multiple forests and, 330 naming context and site topology, 182 number GC servers per site, 171, 191, 226 replicating attributes to, 494 replication of, 21, 171–173, 180, 182, 183, 321 rules for, 321–322 scope of, 321 setting server as, 172–173 sizing domain capacity requirements and, 285 Universal groups and, 171–172, 173 user principle name (UPN) logons and, 321–322 Global groups, 304 assigning rights to OUs with, 426–427 migration of, 260, 264 globally unique identifier (GUID), 144 .gov domain name, 102 Govern.com case study, 502–515 group policy implementation, 507–514 group policy planning, 504, 506–507 Logon/Logoff scripts, 514–515 Organizational Unit (OU) creation, 505 overview of, 502–504 Gray unavailable Windows Installer programs Start Menu shortcuts option, 510 Group Mapping and Merging Wizard, 261

Group Migration Wizard, 261 group policies, 48–49, 76, 121, 122, 148, 155, 394–397, 505 administrative templates (.adm) for, 400–402 assigning to groups, 513–514 blocking inheritance of, 398 Computer Configuration containers and, 83, 397, 402–403, 404 confirming application of, 508 creation of new, 409–410, 513 deployment of applications with, 416–420, 580–582 design issues, 405–406 disabling, 399 domain group policies, 397 DS Client software and, 268 extended logons and, 426 Govern.com case study and, 504–514 incorrect execution of, 425 inheritance of, 222 Intellimirror and, 48–49, 82–83 Kings Vineyards case study and, 217–221 linking of with containers, 412–413 local group policies, 396 managing size of with restricted groups, 423 mode function and, 256 nonexecution of, 424–425 order of application of, 397 Organizational Unit (OU) group policies, 397

Index

quick application of new, 583 refresh interval for, 397–398 restricted groups and, 423 restriction of snap-ins by, 310 scripts for, 413–416 securing of Microsoft Management Console (MMC) with, 408–409 site group policies, 397 slow WAN links and, 406–408 stopping blocking or overwriting of, 398–399 storage of in Group Policy Template (GPT), 400 types of containers for, 396–397 User Configuration containers and, 83, 397, 402, 403–404 viewing root container of, 412–413 Group Policy container, 512 Group Policy Editor, 83, 410 launching, 396, 408 redirecting folders in, 421–422 Group Policy Objects (GPOs), 394–395, 505 blocking, 398 creating new, 409–410, 513 deleting, 399, 411–412 Domain GPOs, 397 editing of, 410–411 extended logons and, 426 incorrect execution of, 425 inheritance of, 394–395 linking to containers, 412–413 Local GPOs, 396

managing administrative group size with, 423 nonexecution of, 424–425 refresh interval for, 397–398 Site GPOs, 397 stopping blocking or overwriting of, 398–399 storage of in Group Policy Template (GPT), 400 viewing root container of, 412–413 Group Policy Template (GPT), 400–402 groups adding users to, 306 assigning group policies to, 513–514 consolidating before PDC migration, 243 creating new, 303 directories and, 12 directory services and, 5 migration of, 261 native mode and, 304–305 nesting, 263, 305 removing empty before PDC migration, 243 scope of, 303, 304 types of, 303

H hackers, 123 hardware-based RAID, 525–526 hardware, DNS server requirements for, 117 hardware manufacturers, impact of release of Windows 2000 on, 88 hidden Organization Units (OUs), 215–217 Hide Internet Explorer option, 511

605

Hide My Network Places option, 511 high watermark vectors, 578–579 HKEY_CURRENT_USER, 403 HKEY_LOCAL _MACHINE, 403 host file, 101 host names, 17–18, 101 hot spare support, RAID 5 and, 526 hot swap support, RAID 5 and, 526

I Incremental Zone Transfers (IXFRs), 102 index, Active Directory. See Global Catalog (GC) Inetres.adm template, 401 Infrastructure Operations Master, 186, 191, 481, 588–589 instances, object class, 474 Insurance, Inc. case study, 136 business requirements of, 139 company organization, 139, 140 company overview, 138–139 domain plan document for, 146–147 forest plan document, 142–143 Organizational Units (OUs) and, 150 integrated zones, Active Directory, 109–112, 298 changing to primary or secondary zones, 299 creation of, 299 Dynamic DNS (DDNS) updates and, 111, 112

606

Index

Multi-Master database replication and, 109–110, 111 name conflicts and, 111 Intellimirror, 48–49, 82–83, 394 group policies and, 82–83 redirected folders and, 83 Interactive group, 429 International Telecommunications Union (ITU-T), 10 Internet Active Directory capabilities and, 16–17, 85 DNS namespaces of servers connected to, 114 Internet forest, Kings Vineyards, 208–209 Internet Information Services, 27 Internet Protocol (IP), 17 Internet Protocol Security (IPSec), 48, 441 InterSite Topology Generator (ISTG), 184, 186–187 interviews, determining business objects through, 44–45, 201–203 invalid objects, 477–478 IP addresses changing static, 286–287 format of, 17, 101 host names and, 17–18 translation of by DNS, 4, 5 IP protocol stack. See TCP/IP IP Security (IPSec), 441 IP subnets, 174 assigning to other sites, 352 creation of new, 351–352, 358–359 site configuration and, 32, 80, 174

well-connected, 348–349 ipconfig/resisterdns command, 283 IPSec, 48, 441

J Joint Deployment Program (JDP), 89–90 JScript, 414

K KCC. See Knowledge Consistency Checker (KCC) Kerberos, 22, 34–35, 85, 440 authentication and, 256, 324 trust relationships and, 30, 77, 84–85, 256, 323–325 Key Distribution Center (KDC), 440 Kings Vineyards case study, 198–226 business objectives and, 200–203 company overview, 198–200 domain design, 210–213 forest design plan, 208–209 initial site establishment, 222–226 Organizational Units (OUs) structure and, 214–222 pre-Active Directory infrastructure, 204–208 Knowledge Consistency Checker (KCC), 80, 174–175, 356 connection object creation and, 174–175, 176, 350–351, 356 connection object destruction and, 356

intrasite replication and, 356 replication scheduling and, 186–187, 351 replication topology configuration and, 182, 184, 265–266

L LanMan Replication (LMREPL) service, 255 Last Known Good Configuration mode, Windows 2000, 565 Layer 2 Tunneling Protocol (L2TP), 48 LDAP. See Lightweight Directory Access Protocol (LDAP) LDIFDE.exe import/export tool, 116, 120, 340–341, 492–493 leaf objects, ADSI, 461 legacy domains restructuring, 237–239 upgrading, 237–239 legacy system naming conventions, 124–125, 126–127 Lightweight Directory Access Protocol (LDAP), 17, 22, 74–75, 85, 128 LDIFDE.exe import/export tool and, 339–341 naming conventions for, 128 querying of Active Directory and, 579–580 virtual containers and, 128 Linux, 89 local DNS namespaces, 113 .local domain, 113

Index

Local group policies, 82, 396, 397 Local Group policy objects, 396–397 Local groups, 262, 263 locations, assessment of for Active Directory, 58 log files, 558–560 checkpoints, 559 circular logging, 559 garbage collection and, 560 patch files, 559–560 reserved logs, 559 selecting location of Active Directory, 295 transaction logs, 559 Logoff script, 413, 414, 514–515 Logon/Logoff container, 512 Logon script, 413, 414, 514–515 logons, use of UPNs for, 27 LostAndFound container, 338

M machine accounts, migration of, 262 maintenance costs, 51 major sites, assessment of, 58 Mandatory attributes, 474 Master Domain model, 8, 9, 205–206 Master domains, migration of, 324 master name servers, 104–105 Master-Slave database replication method, 14, 15 mayContain attributes, 474 member servers Dcpromo and, 248–249 promotion of, 252–254 metadirectories, 524–529

identity management with, 525–526 Microsoft Metadirectory Services (MMS) and, 89, 526–529 metaverses, 528–529 Microsoft Corporation competitors of, 88–89 technology vendors and partners with, 88 Windows 2000 customer support and, 89–90 Microsoft Directory Synchronization Services (MSDSS), 572–573 Microsoft Exchange Server, 16, 465–468 distribution groups, 303 migrating design of, 129 Microsoft Management Console container, 512 Microsoft Management Console (MMC), 18, 308–309 author mode, 309 creation of custom, 309, 576–577 DNS management via, 109, 110 use of group policies to secure, 408–409 user mode, 309 Microsoft Message Queuing (MSMQ), 428 Microsoft Metadirectory Services (MMS), 89, 526–529 MMS architecture, 528–529 obtaining, 529 Microsoft Mobile Information Server (MMIS), 542–543 Microsoft Services for NetWare v. 5.0, 572

607

migration, component. See component migration migration, server. See server migration migration tools, 377 FastLane Technologies products for, 532–537 Microsoft Directory Synchronization Services (MSDSS), 572–573 NDS Migrator, 574 NetIQ NetWare migrator, 574 See also Active Directory Migration Tool (ADMT) .mil domain name, 102 milestones, Active Directory project, 63 Mission Critical Software, 261 mixed-mode domains, 240, 255–256 MMIS. See Microsoft Mobile Information Server (MMIS) mobile devices, assessment of during planning stage, 57 mobile users, Active Directory planning and, 48, 58 MOVETREE tool, 120, 338–339 MSDSS. See Microsoft Directory Synchronization Services (MSDSS) Multi-Master database replication, 14, 15, 21–22 Active Directory-integrated zones and, 109–112 group policy settings and, 406

608

Index

mode function and, 256 multiple domain structures, 8 namespaces and, 20 trust relationships and, 8, 9 WAN performance and, 9 multiple forests impact on administration, 330 interdomain trust relationships and, 330, 331 limitations of, 331 user logons and, 331–332 when to use, 330–331 Multiple Master Domain model, 8 multiple network operating systems, DENcompliant, 5–6 mustContain attributes, 474 My Network Places icon, 454

N name resolution, DNS and, 4, 5, 18, 23, 102–104 namespace design issues, 100, 113 delegation of DNS zone to each domain, 120 DNS server requirements and, 116–117 forest planning, 114–116 number of DNS servers for domain controllers and, 120–121 Organizational Units (OUs) and, 121–122 root domains and, 119–120 site topology and, 122 namespaces, DNS, 20, 23, 78, 100, 113 change management issues and, 123

contiguous, 20, 322, 331–332 hierarchical nature of, 102–103, 322 Internet-connected servers and, 114 local, 113 name resolution and, 4, 5, 18, 23, 102–104, 102–104 naming conventions for, 123–125 Split Brain DNS and, 213 subdomain delegation and DNS installation and, 279–281 viewing domain tree, 31–32 naming contexts, 27–28, 182 naming conventions Active Directory, 17, 128 distinguished name (DN), 25 DNS names, 123–124, 127 user principle name (UPN), 26–27 X.500 directory standard and, 10 Native Mode, Active Directory, 57 native-mode domains, 240, 255, 256–257 nested groups in, 263 PDC Emulator and, 577–578 NDS Migrator tool, 574 nested groups, 263, 305 .net domain name, 102 .NET platform, 4, 16–17 NET START W32TIME command, 363 NET TIME command, 363 NetBIOS, 254, 294 NETDOM BDC command, 326

NETDOM MASTER command, 326 NETDOM MEMBER command, 326 NETDOM QUERY command, 326–327 NETDOM RESOURCE command, 326 NETDOM utility, 262, 268, 325–327 command options available, 326 command syntax, 326 establishing trust relationships with, 325 Help display, 325 major commands in, 326 server migration and, 327 NetIQ asset management tools, 55 NetWare migrator, 574 Netlogon replication, 256 NetLogon service, 106, 292–293 NETLOGON share, 295, 296 Netscape, 89 NetWare Migrator utility, NetIQ’s, 574 NetWare, Novell’s, 88–89, 454 Network container, 511 Network group, 429 network operating systems (NOS), 4 DEN-compliant directories for, 5–6 development of directory services and, 7–10 network resources Access Control Lists (ACLs) and, 12 accessing with Active Directory, 86–87

Index

published resources, 19, 450–457 relationship with services and, 11, 12 network services, directory services and, 4 network users, directory services and, 5 networks assessing current during Active Directory planning, 52–58, 65–66, 204–208 convergence of, 13–14 development of directory services and, 6–10 homogenous, 74–75 single-server, 6 New Object-Group dialog box, 303 New User Wizard, 302 no-refresh interval, resource record, 283 non-authoritative data restores, 563 nontransitive trusts, 31, 323, 381 Novell Directory Services (NDS), 29, 88–89 Microsoft Directory Synchronization Services (MSDSS) migration tool, 572–573 migrating existing design of, 129, 572–574 NDS Migrator tool, 574 NetIQ NetWare migration tool, 574 ntbtlog.txt file, 565 NTDS Event number 1094, 583 NTDS Settings, Global Catalog and, 172–173 NTDS.dit file, 16, 491–492, 558

NTDSUTIL utility, 16, 337 changing Infrastructure Master with, 588–589 changing PDS FSMO role with, 588 NTFS converting files to, 289 migration of Win NT to Win 2000 domain controllers and, 246 upgrading, 246

O object classes, 320, 474 adding attributes to, 485 attributes of, 474 changing inheritance of, 486–487 contents of, 474 creation of new, 481–485 deactivation of, 488 modification of, 485–486 selecting/deselecting attributes of, 487 objects, Active Directory, 29, 474 Active Directory design issues and, 59 adding attributes to, 484–485 adding new to schema, 80–81, 481–485 attributes of, 320, 474, 475 authoritative restore of deleted, 563–564 changing inheritance of, 486–487 cloning of, 261 containers and, 29 creation of invalid during schema modification, 477–478 deactivation of, 488 deleting, 308

609

display specifiers and, 494–495 distinguished name (DN) of, 25–26 flexibility of in Organizational Units (OUs), 122 hidden, 260 LDIFDE.exe import/export tool and, 340–341 migration of, 261–262 modification of, 485 moving, 308, 338–339 naming conventions, 125 phantom objects, 586–587 properties of, 29 relative distinguished name (RDN) of, 25 renaming, 308 schemas and, 33–34 selecting/deselecting attributes of, 487 values of, 29 objects, directory service, 11, 12 offline folders, 421 Optional attributes, 474 Organizational Unit (OU) group policies, 82, 397 Organizational Unit (OU) Group Policy Objects, 397 Organizational Unit (OU) trees, 20 Organizational Units (OUs), 13, 15, 20–21, 78–79, 258 Active Directory design issues and, 59, 60 assigning rights to OU Global groups, 426–427 contents of, 148, 155 creation of new, 300–301, 382

610

Index

delegation of administrative duties by, 35, 76–77, 121, 122, 148, 155–158, 214–215, 264–265 flexibility of, 122, 148 group policies and, 82, 121, 122, 148, 155, 217–221, 405–406 hidden, 215–217, 260 hierarchical nature of, 121–122, 148, 154–155, 300 Insurance, Inc. design plan for, 149 Kings Vineyards case study and, 214–222 linking Group Policy Objects (GPOs) to, 412–413 migration of from Win NT to Win 2000, 258 migration of Novell Directory Services design and, 129 mode function and, 256 MOVETREE tool and, 338 moving user accounts between, 302 plan for structure of, 121–122, 136, 148–150, 235–236 restoring deleted, 563–564 rules for, 148 scalability and, 78 Tekkietech.com design plan for, 148–149 TravelToppers, Inc. design plan for, 373 viewing properties of, 155 Original Equipment Manufacturers (OEMs), impact of release of Windows 2000 on, 88

OUs. See Organizational Units (OUs)

P parent domains child-parent trust relationships and, 333–334 group policies and, 334 partitions, 27–28, 78, 171, 172, 332 password policies, 124 passwords administration of, 159, 309, 310 setting user, 302 patch files, 559–560 PDC. See primary domain controllers (PDCs) PDC Emulator, 186, 244, 255–256, 480–481 changing FSMO role of, 588–589 native mode and, 577–578 Peregrine asset management tools, 55, 57 peripherals, assessment of during planning stage, 57 phantom domains, 587–588 phantom objects, 586–587 planning process, Active Directory, 42–43 architecture considerations, 59–60 assessment of current environment, 52–58 budgeting, 63–64 business objectives and, 43–49 design tips, 153–154 domain plan document, 116–121, 136, 143–147 estimating Active Directory benefits, 51–52

forest plan document, 114–116, 136, 140–143 gap analysis and, 65–66 meetings and notifications, 64–65 namespace plan and, 100 Organizational Units (OU) organization, 121–122, 136, 147–150 project costs and, 50–51 project timeline, 61–63 risk analysis and, 66–67 server migration strategies and, 235–236 setting milestones, 63 site topology plan, 122, 136, 150–153 plugging in, 86–87 point-to-point WAN connections, site links and, 352–353 policy-based administration, 76 Power Users local group, 428 Pre-Boot Execution Environment (PXE), 267 primary DNS name servers, 103, 104–105 primary domain controllers (PDC), 7, 76, 82 backup of, 243 clean-up of before migration, 243–244 migration of from Win NT to Win 2000, 241–242 upgrade of, 237, 244, 377 primary zones, 299 printers, publishing of, 48, 459–450 production forest, Kings Vineyards, 208 productivity, estimating increase of, 51 project team meetings, 64

Index

project timeline, Active Directory implementation, 61–63 Property objects, ADSI, 461 propagation dampening, 578–579 protocol analyzers, 55 Proxy group, 429 Public Key Infrastructure (PKI), 22, 440 published resources, 19, 450–460 browsing and querying for shared folders, 454–457 Distributed File System (Dfs) and, 457–458 Encrypted File System (EFS) and, 458–459 placement of resources and, 451 publishing folders, 452–454 publishing printers, 459–460 sharing folders, 451 pubprn.vbs, 450 punctuation marks, DNS names and, 124–125 PXE chips, 267

Q Quest Software. See FastLane Technologies questionnaires, determining business objectives through, 44–45

R RAID systems, 338, 555–556 RAM, DNS server requirements, 117 Rapid Deployment Program (RDP), 89–90 RAS servers, 296–297 RDN. See relative distinguished name (RDN)

rDNAttID attribute, 491 Recovery console, 566 Red Hat Linux, 89 redirected folders, Intellimirror and, 83 referral process, LDAP, 579–580 referral service,WINS, 212–213 refresh intervals, 283–284, 397–398 RefreshPolicy API, 398 registry.pol file, 400, 402 relative distinguished name (RDN), 25 Relative Identifier Operations Master (RID), 186, 439 Remote Installation Services (RLS), 49 Remote Procedure Calls (RPCs), 22, 179, 265, 462, 592–593 Remote Procedure RPC component, 462 Remote Procedure Stub RPC component, 462 remote sites, assessment of during planning, 58 Remove My Documents option, 511 REPADMIN, 362 replicas, database, 13–14 replication, Active Directory database, 14–15, 28, 166, 180–181 bridgehead servers and, 181 Configuration containers and, 173–174, 180–181 connection objects and, 175–176 domain partitions and, 171, 180–181 Global Catalog (GC) and, 171–173, 180–181

611

Knowledge Consistency Checker (KCC) tool for, 174–175 levels of replication data, 180 Master-Slave database replication, 14 Multi-Master database replication, 14, 15, 21–22, 109–112, 256, 406 replication topology for, 181–187 Schema containers and, 173–174, 180–181 single-point administration and, 15, 18–19 site link bridges and, 177–178 site links and, 176–177 site objects and, 174 Replication Administrator (REPADMIN), 362 replication frequency, site link objects and, 176, 177, 188–190 replication monitor utility, 361 replication protocols, 166, 179 replication topology, 166, 181–187 bridgehead servers and, 182 creation of site components for, 348–356 implementation of, 356–361 InterSite Topology Generator (ISTG) and, 184, 186–187 Knowledge Consistency Checker (KCC) and, 174–175, 182, 184, 350–351, 356 migration of Win NT to Win 2000 domain

612

Index

controllers and, 265–266 for multiple DCs within same domain, 182–183 naming context and, 182 problems with due to schema modifications, 478 for single site with two domains, 183, 184 for two sites with two domains, 183–187 utilities for, 361–362 replication traffic, 166 container objects and, 175–176 domain partitions and, 171 Global Catalog (GC) and, 171–173 Knowledge Consistency Checker (KCC) tool and, 174–175 managing through sites, 166, 167–170 protocols for, 166, 179 Schema and Configuration containers and, 173–174 site link bridges and, 177–172 site link objects and, 176–177 site objects and, 174 sites and, 167–170 replication utilities, 361–362 REPLMON, 361 report management agent, MMS, 529 Reporting Wizard, 261 res1.log, 559 res2.log, 559 reserved logs, 559 resolvers, 103–104 Resource domains, migration of, 324

resource records (RR), 102–103 dynamic updates of, 112–113, 283 management of with MMC utility, 127 RAM requirements and, 117 registration of, 283, 291–293 scavenging of with DNS, 112–113, 283–284 timestamping of, 112–113, 283 resources, network Access Control Lists (ACLs) and, 12 accessing with Active Directory, 86–87 published resources, 19, 450–457 relationship with services and, 11, 12 Restore Console, 296–297 restricted groups, administrative group size and, 423 revenue, estimating increased, 52 reverse lookup zones, 283 revision number, SID, 439 RFC 1123, 127 RFC 2052, 109 RFC 2136, 109 RID Master, 480, 588 RIS, 267 risk analysis, 66–67 risk avoidance plans, 54–55 RLS. See Remote Installation Services (RLS) role-based administration, 308–310 management of with MMC utility, 308–309 tiered structure for, 309–310

root domains, 119–120, 140, 141 creation of new, 240, 284, 290, 291 empty, 145 installation of, 285–288 registration of namespace, 125 server migration and, 239–240 root servers, 280, 281 RPC errors, 592–593 RPC Run Time component, 462 RPCs. See Remote Procedure Calls (RPCs) Run As feature, 441–442

S Safe Mode,Windows 2000, 565 Safe Mode with Command Prompt mode, Windows 2000, 566 Safe Mode with Networking, Windows 2000, 566 safety checks, 490 SAP Computing Center Management System (CCMS), 542 schedule, site link object, 176, 177, 188–190 Schema Administrator console, 81 Schema Admins global group, 476–478 schema cache, 491–492 Schema containers, 491–492 ADSI, 461 naming context and site topology, 182 replication of, 173–174, 491 schema cache and, 491–492 viewing, 491, 492

Index

schema management ADSI objects, 461 Schema Management console, 478–481 Schema Manager, 478–479 changing class inheritance with, 486–487 creation of a new attribute with, 489–490 creation of new class in, 483–485 deactivating a class with, 488 modifying a class in, 485–486 Schema Master FSMO, 591 schema objects, 474 Schema Operations Master, 186 schema partitions, 320 schema utilities ADSIEdit utility, 492 CSVDE, 492–493 LDIFDE.exe, 492–493 Schema Manager, 492 SCHEMA.ini file, 491 schemas, 13, 27–28, 33–34, 78, 474 attributes and, 474–475, 488–490 checking of after modification, 490 deciding when to modify, 476 extension of, 34, 80–81 Flexible Single Master of Operations (FMSO) and, 479–481 forests and, 318, 320 object classes and, 474–475, 481–488 problems caused by modification of, 477–478 reading information from with ADSI, 320

reasons for modifying, 475–476 replicating attributes to GC and, 494 Schema Admins global group and, 476–478 schema cache and, 491–492 Schema Management console and, 478–479 single master for, 81 scope, Active Directory, 24–25 scripts, group policy, 400, 413–416, 514–515 secedit /RefreshPolicy MACHINE_POLICY /Enforce command, 583 secedit /RefreshPolicy USER_POLICY /Enforce command, 583 secondary DNS name servers, 103, 104, 105 secondary logons, 441–442 secondary zones, 299 Secure Sockets Layer (SSL), 22 security Access Control Entries (ACE) and, 437–438 Access Control Lists (ACLs) and, 436–437 Account policies and, 429, 430–434 assigning rights to OU Global groups, 426–427 Domain Security Policy console, 429–430 event logs and, 434 file system policies and, 435–436 groups and, 427–429 IP security policies, 436 IPSec and, 441

613

Kerberos and. See Kerberos Local policies and, 434 Public Key Infrastructure (PKI) and, 22, 440 public key policies, 436 registry policy settings, 435 restricted groups and, 434–435 secondary logon and, 441–442 security descriptors and, 438 Security Identifiers (SID) and, 438, 439 security principals, 426 security templates for, 436 smart cards and, 22, 441 system services and, 435 Security Account Manager (SAM), 238 security architecture, 20 security descriptors, 438 security groups, 303, 505 Domain Local groups, 426 Global groups, 426 mode function and, 256, 426 as security principals, 426 Security Identifiers (SID), 438, 439 security policies, 117–118 security principals, 12, 261, 264, 426 Security Settings MMC utility, 117 server-centric networks, 6 server installation,Windows 2000, 276 server migration,Windows NT to 2000, 234–268 backup domain controllers (BDC) and, 246–247 checking system compatibility, 250–251

614

Index

clean-up of PDC before, 243–244 creation of a back-out BDC, 244 DNS migration and, 584–585 DNS service and SRV RRs and, 245 domain migration process, 241–242 domain restructuring, 237, 238, 242–243 domain tree migration, 240–241 domain upgrades, 237 FastLane Technologies products for, 532–537 forest migration, 240–241 installation of Active Directory Services, 251–257 member server promotion, 248–249 NTFS conversions, 246 phases of migration project, 234–235 primary domain controller (PDC) migration and, 243–246 selecting first forest to migrate, 236–237, 240 testing in pilot migration, 244 upgrading servers with Windows 2000 Setup Wizard and, 249–250 use of design documents in planning, 235–236 Windows NT v. 3.51 and, 247–248 Service Account Migration Wizard, 261 Service Location Resource Record (SRV RR), 18, 102, 106–107

DNS support of and Active Directory installation, 106–107, 108–109, 118, 277 fields of, 106–107 migration of Win NT to Win 2000 domain controllers and, 245 NetLogon service and, 292–293 registration of new, 284, 285 ServicePrincipalName attribute, 129 setup files, automated Windows 2000 Active Directory installation and, 288–289 Setup Manager tool, 289 shared folders, 450, 451–457 browsing and querying, 454–457 Distributed File System (Dfs) and, 457–458 Encrypted File System (EFS) and, 458–459 keywords for, 453, 454 properties of, 453 publishing, 452–454 setting up sharing, 451 Shell.adm template, 401 shutdown scripts, 413, 414 SIDHistory, 248, 439 Simple Mail Transfer Protocol (SMTP), 22, 179, 190 Single Domain model, 8 Site Group policies, 82, 397 Site Group policy objects, 397 site link bridges, 177–178, 355 costs of, 355 creation of new, 355–356 in hub and spoke configuration, 188–190

Kings Vineyards case study and, 224 Knowledge Consistency Checker (KCC) tool and, 174–175 site link objects, 176–177 changing attributes of, 354 costs of, 176, 177, 178, 353, 360 creation of new, 352–354, 359 editing, 360 fault tolerance and, 188 frequency of, 176, 353 Kings Vineyards case study and, 223–224 Knowledge Consistency Checker (KCC) tool and, 174–175 number per site, 190 properties of, 176–177, 188 schedule of availability, 176, 177, 353 transport types, 353 site objects, 174–175 site topology, 122 implementing in Active Directory, 356–361 Insurance, Inc. plan for, 152–153 Kings Vineyards plan for, 223–224 plan for structure of, 122, 136, 152–153, 235–236 Tekkietech.com plan for, 152 TravelToppers, Inc. design plan for, 373–375 site walkthroughs, 58 sites, 32, 80, 150, 167–170, 348–349, 384–385 Active Directory design issues and, 60, 122 adding server to two different simultaneously, 586

Index

assigning IP subnets to, 352 authentication traffic and, 32 benefits of using multiple, 187–188 bridgehead servers and, 181 configuration of, 32 creation of new, 349–350, 357–358 Default-First-Site-Name site, 170, 174, 357 disaster recovery planning and, 550–554 DNS server placement and, 226 domain controllers (DC) and, 190–191, 224–226, 349 forests and, 168 Global Catalog (GC) servers and, 191, 226, 349 importance of, 348 Kings Vineyards case study and, 222–226 Knowledge Consistency Checker (KCC) tool and, 174–175, 350–351, 356 linking Group Policy Objects (GPOs) to, 412–413 management of with MMC utility, 122 no DNS namespace for, 170 number of domain controllers per site, 190, 224–225 number of site links per site, 190 planning structure of, 187–190 problems with due to improper creation of, 168–170

reassigning IP subnets, 352 rules for, 150–151 scalability and, 78 spanning of by domains, 168 spanning of domains by, 167 TravelToppers, Inc. case study and, 384–385 slow link detection, disabling, 411 smart cards, 22, 441 SMTP. See Simple Mail Transfer Protocol (SMTP) snap-in, MMC, 309, 310 social security numbers, use as user ID, 124 software development kit (SDK),Windows 2000 and Active Directory, 16 software manufacturers, impact of release of Windows 2000 on, 88 Split Brain DNS, 213 split transactions, 559 SQL Server 2000, 543 SRV RR. See Service Location Resource Record (SRV RR) SSL. See Secure Sockets Layer (SSL) standalone Distributed File System (Dfs), 457, 458 star configuration, 176 startup modes,Windows 2000, 564–566 startup scripts, 413 static IP addresses, changing, 286–287 status notification messages, 64 subarcs, 486 subdomains delegating, 279–281

615

naming of, 125 subtrees, 28 synchronization, database, 13–14, 82 Syntax objects, ADSI, 461 system policies, 76 System State data, 561, 563 system volume folder, 295 System.adm template, 401 Systems container, 512 Systems Management Server (SMS), 57 SYSVOL folder, 295, 400

T Tally Systems asset management tools, 57 TCP/IP, 17–18 integration of Active Directory with, 85 Internet Protocol (IP) and, 17 synchronous replication of Active Directory updates and, 22 Transmission Control Protocol (TCP) and, 17 Tekkietech.com case study, 136 business requirements of, 137 company organization, 138 company overview, 136–138 domain plan document for, 145–146 forest plan document, 141–142 Organizational Units (OUs) and, 148–149 Terminal Server, 48 3Com, 88 Ticket Granting Ticket (TGT), 440

616

Index

time clients, 363 time servers, 363 time synchronization, Active Directory and, 362–363 timeline, Active Directory implementation, 61–63 timestamps, resource record, 112–113, 283 Tivoli asset management tools, 55 tombstone lifetime, 335–336 tombstones, 335 deleting expired, 336–337 restoration of objects from, 563–564 setting lifetime of, 335–336 top-level domain names, 102 traffic, replication. See replication traffic training costs of, 51 planning for, 64 transaction logs, 559 transaction-oriented database update protocols, 14 transitive trusts, 30–31, 84–85, 323–324 Transmission Control Protocol (TCP), 17 TravelToppers, Inc. case study, 370–385 DNS and domain plan for, 370–372 DNS implementation, 375–376 domain controller (DC) implementation, 377–381 forest plan document, 370, 371 Organizational Unit (OU) establishment, 382–384 Organizational Unit (OU) plan, 373

site implementation, 384–385 site topology plan, 373–375 trees, domain. See domain trees Trust Migration Wizard, 262 trust relationships, 30, 323–329 cross-forest, 324–325 domain migration and, 324–325 establishing with Active Directory Domains and Trusts MMC, 327–329 establishing with NETDOM, 325–327 Kerberos security and, 22, 77, 84–85, 323–324 multiple domain structures and, 8, 9 multiple forests and, 330 nontransitive trusts, 31, 323, 381 transitive trusts, 30–31, 84–85, 323–324 TravelToppers, Inc. case study, 381 viewing, 30–31, 85 trust utilities Active Directory Domains and Trusts MMC and, 327–329 NETDOM utility, 262, 268, 325–327

U .uk domain name, 102 underscores, DNS names and, 127 Unicode characters, 127, 298 Uniform Resource Locators (URLs), 128 uninteruptible power sources (UPS), disaster planning and, 554–555

Universal groups, 263, 304, 305, 427 Global Catalog and, 171–172, 173 mixed mode and, 304 native mode and, 304–305 Universal Naming Convention (UNC), 128 UNIX, 89 UNIX BIND servers, 109, 212, 278 Up-to-date vectors, 578–579 Update Sequence Numbers (USNs), 578–579 upgrades, server. See server migration,Windows NT to Windows 2000 UPS service, 554–555 UPS (uninteruptible power sources), 554–555 .us domain name, 102 User Account Properties dialog, 302, 303, 306 user accounts cloning of, 331 creation of new, 301–302, 383 deleting old before PDC migration, 243 directories and, 11, 12 making changes to, 302, 303 migration of from Win NT to Win 2000, 260–262 moving between forests, 331 moving from one OU to another, 302, 382–383 as security principals, 426 User Configuration containers group policies and, 83, 397, 402, 403–404 scripts in, 413

Index

User Configuration Software Installation package, 580–581 User Migration Wizard, 262 User Node Administrative Templates, 509–510 User Node policies, 508, 509–513 User Principle Names (UPNs), 26–27, 171, 173 users adding to groups, 306 logon of and multiple forests, 330–331 Users container, 427, 428 Users local group, 428

V VBScript, 414 vendors, impact of release of Windows 2000 on, 88 virtual containers, 128 Virtual Private Network (VPN), 48

W W32TIME service, 363 Web pages, integration of Active Directory with, 16–17 Web servers, reducing number of, 47 Web sites disaster recovery planning, 550 Distributed Management Task Force (DMTF), 5 FastLane Technologies, 141 Microsoft Developer Network, 16 Netiq, 141 using UPNs to logon to, 27 well-connected IP subnets, 348–349

Wide Area Networks (WAN) Kings Vineyards infrastructure and (case study), 204–205 performance of and multiple domains and, 9 Wide Area Networks (WAN) links, 352–353 group policies and, 406–408 identification of, 55 Windows 2000 Advanced Server, 19 Windows 2000 Certificate Services, 440 Windows 2000 DataCenter Server, 19 Windows 2000 Professional, 266–268 Windows 2000 Server, 19 default installation, 20 DNS configuration on, 281–282 DNS installation of, 277–279 DNS names and, 129–130 DSClient file, 531–532 impact on customers, 89–90 impact on Microsoft competitors, 88–89 impact on Microsoft Corp., 90 impact on technology vendors, 88 initial configuration of, 287–288 installation of, 276, 288–289 integration of Active Directory into, 19 root domain installation, 284–287 scalability of, 19

617

service record registration, 284 startup modes, 565–566 subdomain delegation and, 279–281 transitive trusts and, 31 Windows NT 5.0 and, 4 zone aging/scavenging and, 283–284 Windows 2000 Setup Wizard, 249–250 Windows 2000 source share, 289 Windows 9x desktops, Active Directory and, 57 Windows Components container, 512 Windows Explorer, 451 Windows Explorer container, 512 Windows Installer container, 512 Windows Installer package, 416, 581 Windows Internet Naming System (WINS), 108 referral service, 212–213 Windows 2000 DNS support of, 278 Windows NT, 102 domain architecture of, 7–8 migrating domain structure of from v. 4.0, 237–239 migration to Windows 2000 from v. 3.51, 247–248 See also server migration Windows NT 4 RAS servers, 296–297 Windows Scripting Host (WSH) tools, 414 Windows Sockets, 463 Windows XP, 266–267 Windows.adm template, 401 WINN32 setup file, 249–250, 276

618

Index

Winnt.adm template, 401 WinSock, 463 Wired for Management (WfM protocol), 267 Wmp.adm template, 401 workstations adding new to Active Directory, 306–307, 383–384 assessment of during planning stage, 57 DNS names for, 129–130 migration of to Windows 2000 or XP, 266–268 WSH. See Windows Scripting Host (WSH)

X X.500 directory standard, 10–11, 17, 85, 486 X.500 Object ID, 482, 486, 487

Z .zap files, 581–582 zone transfers, 104, 282 zones, DNS, 103, 104–105, 282–284 Active Directoryintegrated, 109–112, 298, 299 adding new, 127 aging/scavenging properties, 112–113, 283–284 changing type of, 299 converting to different types of, 111 defining, 127 delegation of separate to each domain, 120 forward lookup, 282–283 Kings Vineyards case study and, 211–213

primary DNS name servers and, 104–105 reverse lookup, 283 secondary DNS name servers and, 104, 105 storage and replication of by Active Directory, 106, 108 Zoomit Corporation, 89, 526

Train with Global Knowledge The right content, the right method, delivered anywhere in the world, to any number of people from one to a thousand. Blended Learning Solutions™ from Global Knowledge.

Train in these areas: Network Fundamentals Internetworking A+ PC Technician WAN Networking and Telephony Management Skills Web Development XML and Java Programming Network Security UNIX, Linux, Solaris, Perl Cisco Enterasys Entrust Legato Lotus Microsoft Nortel Oracle

www.globalknowledge.com

Every hour, every business day all across the globe Someone just like you is being trained by Global Knowledge. Only Global Knowledge offers so much content in so many formats—Classroom, Virtual Classroom, and e-Learning. This flexibility means Global Knowledge has the IT learning solution you need. Being the leader in classroom IT training has paved the way for our leadership in technology-based education. From CD-ROMs to learning over the Web to e-Learning live over the Internet, we have transformed our traditional classroom-based content into new and exciting forms of education. Most training companies deliver only one kind of learning experience, as if one method fits everyone. Global Knowledge delivers education that is an exact reflection of you. No other technology education provider integrates as many different kinds of content and delivery.

www.globalknowledge.com

this could be you

Win a 2002 Chrysler PT Cruiser It’s simple to sign up to win. Visit globalknowledge.com. Completely fill out the form and you’re entered! See our web site for official rules. www.globalknowledge.com. Not valid in Florida and Puerto Rico.

Blended Learning Solutions from Global Knowledge

™

The Power of Choice is Yours. Get the IT Training you need— how and when you need it. Mix and match our Classroom, Virtual Classroom, and e-Learning to create the exact blend of the IT training you need. You get the same great content in every method we offer.

Self-Paced e-Learning

Virtual Classroom Learning

Classroom Learning

Self-paced training via CD or over the Web, plus mentoring and Virtual Labs.

Live training with real instructors delivered over the Web.

Train in the classroom with our expert instructors.

1-800-COURSES

www.globalknowledge.com

9000 Regency Parkway, Suite 500 Cary, NC 27512 1-800-COURSES www.globalknowledge.com

At Global Knowledge, we strive to support the multiplicity of learning styles required by our students to achieve success as technical professionals.We do this because we know our students need different training approaches to achieve success as technical professionals.That’s why Global Knowledge has worked with Syngress Publishing in reviewing and recommending this book as a valuable tool for successful mastery of this subject. As the world’s largest independent corporate IT training company, Global Knowledge is uniquely positioned to recommend these books.The first hand expertise we have gained over the past several years from providing instructor-led training to well over a million students worldwide has been captured in book form to enhance your learning experience.We hope the quality of these books demonstrates our commitment to your lifelong learning success.Whether you choose to learn through the written word, e-Learning, or instructor-led training, Global Knowledge is committed to providing you the choice of when, where and how you want your IT knowledge and skills to be delivered. For those of you who know Global Knowledge, or those of you who have just found us for the first time, our goal is to be your lifelong partner and help you achieve your professional goals. Thank you for the opportunity to serve you.We look forward to serving your needs again in the future. Warmest regards,

Duncan M. Anderson President and Chief Executive Officer, Global Knowledge

P.S.

Please visit us at our Web site www.globalknowledge.com.

Enter the Global Knowledge Chrysler PT Cruiser Sweepstakes This sweepstakes is open only to legal residents of the United States who are Business to Business MIS/IT managers or staff and training decision makers, that are 18 years of age or older at time of entry.Void in Florida & Puerto Rico.

OFFICIAL RULES No Purchase or Transaction Necessary To Enter or Win, purchasing will not increase your chances of winning. 1. How to Enter: Sweepstakes begins at 12:00:01 AM ET May 1, 2001 and ends 12:59:59 PM ET December 31, 2001 the (“Promotional Period”). There are four ways to enter to win the Global Knowledge PT Cruiser Sweepstakes: Online, at Trade shows, by mail or by purchasing a course or software. Entrants may enter via any of or all methods of entry. [1] To be automatically entered online, visit our web at www.globalknowledge.com click on the link named Cruiser and complete the registration form in its entirety. All online entries must be received by 12:59:59 PM ET December 31, 2001. Only one online entry per person, per e-mail address. Entrants must be the registered subscriber of the e-mail account by which the entry is made. [2] At the various trade shows, during the promotional period by scanning your admission badge at our Global Knowledge Booth. All entries must be made no later than the close of the trade shows. Only one admission badge entry per person. [3] By mail or official entry blank available at participating book stores throughout the promotional period. Complete the official entry blank or hand print your complete name and address and day & evening telephone # on a 3”x5” card, and mail to: Global Knowledge PT Cruiser Sweepstakes, P.O. Box 4012 Grand Rapids, MN 55730-4012. Entries must be postmarked by 12/31/01 and received by 1/07/02. Mechanically reproduced entries will not be accepted. Only one mail in entry per person. [4] By purchasing a training course or software during the promotional period: online at http://www.globalknowledge.com or by calling 1-800-COURSES, entrants will automatically receive an entry onto the sweepstakes. Only one purchase entry per person. All entries become the property of the Sponsor and will not be returned. Sponsor is not responsible for stolen, lost, late, misdirected, damaged, incomplete, illegible entries or postage due mail.

2. Drawings: There will be five [5] bonus drawings and one [1] prize will be awarded in each bonus drawing. To be eligible for the bonus drawings, on-line entries, trade show entries and purchase entries must be received as of the dates listed on the entry chart below in order to be eligible for the corresponding bonus drawing. Mail in entries must be postmarked by the last day of the bonus period, except for the month ending 9/30/01 where mail in entries must be postmarked by 10/1/01 and received one day prior to the drawing date indicated on the entry 625

chart below. Only one bonus prize per person or household for the entire promotion period. Entries eligible for one bonus drawing will not be included in subsequent bonus drawings. Bonus Drawings

Month starting/ending 12:00:01 AM ET/11:59:59 PM ET

Drawing Date on or about

1 2 3 4 5

5/1/01-7/31/01 8/1/01-8/31/01 9/1/01-9/30/01 10/1/01-10/31/01 11/1/01-11/30/01

8/8/01 9/11/01 10/10/01 11/9/01 12/11/01

There will also be a grand prize drawing in this sweepstakes. The grand prize drawing will be conducted on January 8, 2002 from all entries received. Bonus winners are eligible to win the Grand prize. All random sweepstakes drawings will be conducted by Marden-Kane, Inc. an independent judging organization whose decisions are final. All prizes will be awarded. The estimated odds of winning each bonus drawing are 1:60,000, for the first drawing and 1:20,000 for the second, third, fourth and fifth drawings, and the estimated odds of winning the grand prize drawing is 1:100,000. However the actual odds of winning will depend upon the total number of eligible entries received for each bonus drawing and grand prize drawings.

3. Prizes: Grand Prize: One (1) PT Cruiser 2002 model Approx. Retail Value (ARV) $18,000. Winner may elect to receive the cash equivalent in lieu of the car. Bonus Prizes: Five (5), awarded one (1) per bonus period. Up to $1,400.00 in self paced learning products ARV up to $1,400.00 each. No substitutions, cash equivalents, except as noted, or transfers of the prize will be permitted except at the sole discretion of the Sponsor, who reserves the right to substitute a prize of equal or greater value in the event an offered prize is unavailable for any reason.Winner is responsible for payment of all taxes on the prize, license, registration, title fees, insurance, and for any other expense not specifically described herein.Winner must have and will be required to furnish proof of a valid driver’s license. Manufacturers warranties and guarantees apply.

4. Eligibility: This sweepstakes is open only to legal residents of the United States, except Florida and Puerto Rico residents who are Business to Business MIS/IT managers or staff and training decision makers, that are 18 years of age or older at the time of entry. Employees of Global Knowledge Network, Inc and its subsidiaries, advertising and promotion agencies including Marden-Kane, Inc., and immediate families (spouse, parents, children, siblings and their respective spouses) living in the same household as employees of these organizations are ineligible. Sweepstakes is void in Florida and Puerto Rico and is subject to all applicable federal, state and local laws and regulations. By participating, entrants agree to be bound by the official rules and accept decisions of judges as final in all matters relating to this sweepstakes. 5. Notification: Winners will be notified by certified mail, return receipt requested, and may be required to complete and sign an Affidavit of Eligibility/Liability Release and, where legal, a Publicity Release, which must be returned, properly executed, within fourteen (14) days of 626

issuance of prize notification. If these documents are not returned properly executed or are returned from the post office as undeliverable, the prize will be forfeited and awarded to an alternate winner. Entrants agree to the use of their name, voice and photograph/likeness for advertising and promotional purposes for this and similar promotions without additional compensation, except where prohibited by law.

6. Limitation of Liability: By participating in the Sweepstakes, entrants agree to indemnify and hold harmless the Sponsor, Marden-Kane, Inc. their affiliates, subsidiaries and their respective agents, representatives, officers, directors, shareholders and employees (collectively, “Releasees”) from any injuries, losses, damages, claims and actions of any kind resulting from or arising from participation in the Sweepstakes or acceptance, possession, use, misuse or nonuse of any prize that may be awarded. Releasees are not responsible for printing or typographical errors in any instant win game related materials; for stolen, lost, late, misdirected, damaged, incomplete, illegible entries; or for transactions, or admissions badge scans that are lost, misdirected, fail to enter into the processing system, or are processed, reported, or transmitted late or incorrectly or are lost for any reason including computer, telephone, paper transfer, human, error; or for electronic, computer, scanning equipment or telephonic malfunction or error, including inability to access the Site. If in the Sponsor’s opinion, there is any suspected or actual evidence of electronic or non-electronic tampering with any portion of the game, or if computer virus, bugs, unauthorized intervention, fraud, actions of entrants or technical difficulties or failures compromise or corrupt or affect the administration, integrity, security, fairness, or proper conduct of the sweepstakes the judges reserve the right at their sole discretion to disqualify any individual who tampers with the entry process and void any entries submitted fraudulently, to modify or suspend the Sweepstakes, or to terminate the Sweepstakes and conduct a random drawing to award the prizes using all non-suspect entries received as of the termination date. Should the game be terminated or modified prior to the stated expiration date, notice will be posted on http://www.globalknowledge.com. Any attempt by an entrant or any other individual to deliberately damage any web site or undermine the legitimate operation of the promotion is a violation of criminal and civil laws and should such an attempt be made, the sponsor reserves the right to seek damages and other remedies from any such person to the fullest extent permitted by law. Any attempts by an individual to access the web site via a bot script or other brute force attack or any other unauthorized means will result in the IP address becoming ineligible. Use of automated entry devices or programs is prohibited.

7. Winners List: For the name of the winner visit our web site www.globalknowledge.com on January 31, 2002.

8. Sponsor: Global Knowledge Network, Inc., 9000 Regency Parkway, Cary, NC 27512. Administrator: Marden-Kane, Inc. 36 Maple Place, Manhasset, NY 11030.

627

SYNGRESS SOLUTIONS… AVAILABLE SEPTEMBER 2001 ORDER at www.syngress.com

Windows 2000 Server Security, Second Edition The first edition of this book was an Amazon Windows 2000 bestseller and the first book out on the topic. Updated to cover Service Pack 2 and new information on Kerberos and Public Key Infrastructure, this book also covers Virtual Private Networks (VPNs), remote access, and Web site security. ISBN: 1-928994-65-2 Price: $49.95 US, $77.95 CAN

AVAILABLE NOW ORDER at www.syngress.com

Configuring Windows 2000 WITHOUT Active Directory Active Directory (AD) is complex and invasive, and as a result many IT professionals struggle with comprehensive Windows 2000 deployments that are contingent upon AD. Configuring Windows 2000 WITHOUT Active Directory is about making the most of those Windows 2000 features and services that can be used independently of AD—whether in an existing NT4 domain environment, Novell’s NDS, UNIX, or even in a standalone workgroup. ISBN: 1-928994-54-7 Price: $49.95 US, $77.95 CAN

AVAILABLE FEBRUARY 2001 ORDER at www.syngress.com

Configuring ISA Server 2000: Building Firewalls for Windows 2000 The much anticipated upgrade to Proxy Server delivers the Internet to your enterprise! ISA Server 2000 provides administrators with a revolutionary management infrastructure that addresses the two greatest needs of Enterprise-wide Internet connectivity: security and speed. Written by best-selling authors of several MCSE 2000 study guides, Dr. Tom Shinder and Deb Shinder, this book will provide seasoned system administrators with an in-depth understanding of the features of Microsoft’s flagship Internet Server. The book covers ISA Server in the Enterprise, ISA Server security, installing and configuring ISA Server, and configuring ISA firewall functionality. ISBN: 1-928994-29-6 Price: $49.95 US, $77.95 CAN

[email protected]