welcome to this technet event
DESCRIPTION
Welcome to this TechNet Event. FREE bi-weekly technical newsletter FREE regular technical events hosted across the UK FREE weekly UK & US led technical webcasts FREE comprehensive technical web site Monthly CD / DVD subscription with the latest technical tools & resources - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/1.jpg)
Welcome to this TechNet Event
FREE bi-weekly technical newsletter
FREE regular technical events hosted across the UK
FREE weekly UK & US led technical webcasts
FREE comprehensive technical web site
Monthly CD / DVD subscription with the latest technical tools & resources
FREE quarterly technical magazine
We would like to bring your attention to the key elements of the TechNet programme; the central information and community resource for IT professionals in the UK:
To subscribe to the newsletter or just to find out more, please visit www.microsoft.com/uk/technet or speak to a Microsoft representative during the break
![Page 2: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/2.jpg)
Understanding the Active Directory Platform in the Real World
John Howard, Mark Cribben, Mike Brannigan
Microsoft UK
![Page 3: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/3.jpg)
Today’s Sessions
Architectural Overview
Recommended design practices
In-place upgrades
Lunch: The Business case for Active Directory
Directory migration
Extending the value of the directory
Managing and Securing Active Directory
![Page 4: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/4.jpg)
Today’s Sessions
Architectural Overview
Recommended design practices
In-place upgrades
Lunch: The Business case for Active Directory
Directory migration
Extending the value of the directory
Managing and Securing Active Directory
![Page 5: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/5.jpg)
Introduction to Directories
What is a directory?–At a basic level a structured way of organising useful information.
The classic example is that of a telephone directory.
What a directory is not.– It is not a database. Although they share common features the
emphasis between the two is different.
Types of directory.–NOS based directories
–Application directories
–General purpose directories
![Page 6: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/6.jpg)
Directories vs. Databases
![Page 7: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/7.jpg)
Common uses for directories
NOS– Core directory service for network management and administration
– Authentication of network users
– Examples such as Active Directory and eDirectory
Application– Specific applications that store configuration information without the need
for a database
– Examples include firewalls, HR applications
General purpose– Internal white pages
– A driver for provisioning
– Simple applications for which a directory is better suited than a database
![Page 8: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/8.jpg)
Introduction to LDAP
Firstly it is a protocol defined through RFC’s
Secondly it is a set of four models–An information model to describe what you can put in the
directory
–A naming model that describes how data is arranged within the directory
–A functional model that describes what you can do with the data
–A security model that defines how the data in the directory can be protected from unauthorised access
![Page 9: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/9.jpg)
LDAP Protocol - 1
A message oriented protocol
The LDAP protocol consists of 9 basic operations divided into 3 categories:
– Interrogation Operations:search, compare
–Update Operations:add, delete, modify, modify DN (rename)
–Authentication and control:bind, unbind, abandon
![Page 10: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/10.jpg)
1. Open connection and bind
2. Result of bind operation
3. Search operation
4. Entries returned
5. Result of search operation
6. Unbind operation
7. Close connection
LDAP Protocol - 2
A typical LDAP exchange
![Page 11: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/11.jpg)
LDAP compliance
Common request these days but what does it mean?
–As with all things it depends on a number of things. Principally though the question is “do you conform to the LDAP standards as defined in RFC’s”
–Open Group / DIF test certifications: LDAP Ready and LDAP Certified.
–Dependent on the standards. Compliant does not mean you implement every possible RFC for a technology. Rather that you meet the required standards.
![Page 12: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/12.jpg)
Providers of directories
There are a number of commercial LDAP directory products available today including:
– Microsoft Active Directory and ADAM
– Computer Associates eTrust Directory 8
– IBM Tivoli Directory Server 5.x
– Nexor Directory 5.1
– Novell eDirectory 8.7.x
– Oracle Internet Directory v 10g
– Sun Microsystems Sun ONE Directory Server 5.2
Plus there are non commercial products:
– OpenLDAP
![Page 13: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/13.jpg)
Typical Company scenario
Network
– Probably a directory of some description providing authentication services and network management for all users in the company
HR
– A significant number of companies have an HR system that is separate from the Network directory.
Firewall
– Several firewall products use authentication to determine internet access permissions. These are stored in a directory
Applications
– Commercial applications may be deployed that provide a specific function in the company and ships with its own directory.
– In house applications such as a provisioning application or a white pages or “global directory”
Without realising it most organisations are now awash with directories.
![Page 14: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/14.jpg)
The directory challenges! (1)
Management
– How accurate is the data? Who is responsible for inputting the data? How current is the data? How available is the directory?
Information consistency
– Identities that are shared between multiple directories can become inconsistent. Representation of common data.
Interoperability
– How accessible is the data?
Synchronisation
– Do we have the right information? Where is the authoritative data stored? Synchronisation rules? Synchronisation logic?
![Page 15: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/15.jpg)
The directory challenges! (2)
Ownership
– Who owns the data? Are they happy to share it?
Security
– How do we secure the data in the directory? Is access control important for the data stored?
Extending the directory
– How do we extend the directory? Do schema extensions clash? Are the extensions universally important?
Use
– How do we use the directory effectively? Are we doing all that we can with the directories we have?
![Page 16: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/16.jpg)
What is Active Directory?
Microsoft’s core directory service offering
–Enterprise capable NOS Directory Service providing network authentication, authorisation, location and application services
–Available since 2000 as part of Windows 2000 Server
–Supports LDAP v2 and v3 industry standards
–Ships free as part of the Windows Server Operating System
![Page 17: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/17.jpg)
AD concepts – 1(Logical)
Boundaries– Security
– Administrative
Forest– A forest is the security boundary for a single Active Directory deployment.
– Shared schema and configuration
– A single, logical entity
– Comprised of one or more domain trees
Domain– A Domain is an administrative boundary within an AD forest.
– Boundary for password / security policy
– Partition / control replication of AD data
![Page 18: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/18.jpg)
Ad.microsoft.com
Eu.ad.microsoft.com Na.ad.microsoft.com
AD concepts – 2 (Logical)
Tree
–AD domains a logically organised in trees
A contiguous DNS based name space eg. Ad.microsoft.com is the forest root domain. It has two child domains that form a single domain tree within the forest: eu.ad.microsoft.com and na.ad.microsoft.com
![Page 19: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/19.jpg)
AD concepts – 3 (Logical)
Organisational Units (OU’s)
–A way of further partitioning data within a domain for the purposes of delegating administration or applying Group Policy
–Hierarchical within the domain
–Can be easily moved or renamed
![Page 20: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/20.jpg)
AD concepts – 4 (Logical)
Schema
–The definition of the objects that can be created within a forest. Eg. Users, computers, printers.
–The boundaries of the individual attributes.
–Default permissions on attributes
–Unique OID’s essential.
–Once defined cannot be removed from AD
–Objects and attributes can be deactivated in Windows Server 2003
![Page 21: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/21.jpg)
AD concepts – 5 (Logical)
Trusts. Defines the relationship between different logical components of an AD installation.
–Within a forest all domains are trusted.
–External trusts
–Forest trusts
–Kerberos trusts
![Page 22: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/22.jpg)
AD concepts – 6 (Physical)
Sites– A logical representation of the physical nature of your underlying network
infrastructure.
– Used for controlling authentication process, replication and accessing “local” resources.
– Requires defining IP subnets.
Domain Controllers (DC’s)– Servers that physically host the Directory.
– Replicate directory information
– Authoritative for their domain NC
– Writable (operations such as creating new objects or updating existing objects)
Global Catalog (GC)– A DC that holds read only copies of other domain NC’s within the forest as well as
the writable copy of the domain NC for which it is authoritative.
– Easy and known way to search the forest for information
![Page 23: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/23.jpg)
AD and DNS
DNS is a name resolution service and is separate from AD.
–Used to provide the name space rules for AD
–Used to locate AD and AD resources
DNS information can be stored in AD
–Can improve the security of DNS information
– Improves replication / transfer of zone data
![Page 24: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/24.jpg)
How AD distributes data
Domain Controllers
–DC’s are distributed around the organisation to facilitate local operations
Replication
–The mechanism for ensuring all DC’s contain up to date information
–Multimaster loose consistency with convergence
– Intra site replication for DC’s in the same site
– Inter site replication between sites
![Page 25: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/25.jpg)
Roles for AD
NOS
– Primary role for managing the network, users and machines
Authentication
– Provides the authentication service for the network.
– Default in Active Directory is Kerberos
– Can also be utilised as an authentication service for other applications
Application
– AD can be extended to support applications
– A number of MS applications utilise AD (Exchange, SMS, ISA to name a few)
![Page 26: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/26.jpg)
Scalability
AD as a NOS Directory has the capacity to handle any organisation
– Tested with millions of objects
– Technically could support 1 billion objects!
– Currently supporting many of the largest companies in the world
There are some technical limitations for some objects
– Number of DC’s in a domain
– Number of DNS Name Servers
– Number of Groups a user can belong to
– Number of users in a group*
![Page 27: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/27.jpg)
The Microsoft directory strategyD
irec
tory
Arc
hit
ectu
reD
irec
tory
Arc
hit
ectu
re
Dir
ecto
ry T
ech
no
log
ies
Dir
ecto
ry T
ech
no
log
ies
Active DirectoryActive Directory
ADAMADAM
MIISMIIS
IIFPIIFP
ADFSADFS
GPMCGPMC
FederationFederation
SynchronisationSynchronisation
AuthorisationAuthorisation
ProvisioningProvisioning
SecuritySecurity
ManagementManagement
AuthenticationAuthentication
![Page 28: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/28.jpg)
Getting to a Single Directory
Very difficult in the enterprise
–Existing application requirements
–Scope of application (local vs. global)
–Schema requirements
–Control of application/identity information
How to deal with multiple account stores
– Infrastructure Directory – Global
–Application Directories – Local to Application
–Meta-Directory – Integration/Business Process
![Page 29: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/29.jpg)
Where We Are Today
Directories deployed per-app; little re-use
Provisioning, sync are ad-hoc
Active Directory
Portal Portal applicationapplication
WhitepagesWhitepages
GenericGenericLDAP-basedLDAP-based
appappHR/ERP HR/ERP
appappLDAPLDAP
Centralized Centralized managementmanagement
Policy & SSOPolicy & SSOfor Windowsfor Windows
DatabaseDatabase
LDAPLDAP
Generic Generic dumpdump
(Non-existent)(Non-existent)
Ad-hoc Ad-hoc syncsync
iPlanetiPlanet
eDirectoryeDirectory
Outlook/Outlook/ExchangeExchange
LDAPLDAP
iPlanetiPlanetMAPIMAPI
![Page 30: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/30.jpg)
The Solution
DS-enabledDS-enabledappapp
HR/ERP HR/ERP appapp
CentralizedCentralizedidentity identity
managementmanagement
DatabaseDatabase
MIIS 2003MIIS 2003
IntegrationIntegrationServicesServices
App DSApp DS
App DSApp DSADAMADAM
Infrastructure Directory
ActiveActiveDirectoryDirectory
DS-enabledDS-enabledappapp
App DSApp DSADAMADAM
DS-enabledDS-enabledappapp33rdrd-party DS-party DS
accessaccess
syncsync
![Page 31: Welcome to this TechNet Event](https://reader035.vdocuments.site/reader035/viewer/2022062314/568148fe550346895db62192/html5/thumbnails/31.jpg)
Today’s Sessions
Architectural Overview
Recommended design practices
In-place upgrades
Lunch: The Business case for Active Directory
Directory migration
Extending the value of the directory
Managing and Securing Active Directory