Please enable JavaScript.
Coggle requires JavaScript to display documents.
Servers & Services Security MGT: Windows Security (Active Directory…
Servers & Services Security MGT: Windows Security
Active Directory
Microsoft’s new directory service
ADS
NTDS
successor to LAN Manager Domains
Goals
Open Standards
LDAP
X.500
DNS
Kerberos
High Scalability
Simplified Administration
Compatability to existing Windows NT systems & applications
Inheritance
from top to bottom
can only be blocked completely
no IRF like Novell
Active Directory Structure
“old friends”
user
group
computer
new elements
distribution lists
system policies
application defined custom objects
Schema
definition of all AD
object-types (classes)
attributes
data-types (syntaxes)
can be compared to a database schema
one consistent schema inside a single forest
extensible
Domain
AD base element (building block)
NT 4 compatible
physically implemented on domain controllers (DC)
border for
replication traffic
system policies
administration
Organisational Unit (OU)
implements a structure inside a domain
can be nested as needed
cannot be assigned any rights
typically used for administrative reasons
system policies
Tree
heirarchical domain structure inside a single namespace
adiscon.com
la.adiscon.com
ny.adiscon.com
transitive trusts created automatically
sub-domain must be added to root-domain
Forest
combination of trees
disjunct namespaces
adiscon.de
adiscon.com
transitive trusts created automatically
one single tree-root
sub-tree must be added to root-tree
The Tree-Root
Modelling the Physical Structure
not related to logical structure
modelled via “sites”
a site is well connected via fast Network Links
one site via home multiple domains
one domain can spread across many sites
domain database is stored on domain controllers
Server
Member Server
Domain Controller
Global Catalog
FSMO
special roles carried out by only a limited set of serves
PDC Emulator
Schema Master
Domain Controller
stores a physcial copy of the active directory database
currently a single domain per DC supported
ESE95 database (MS exchange)
Logon services
kerberos
LAN manager authentication
always have at least 2 domain controlelrs
Multi Master Replication
updates can be applied to any domain controller
will be replaced to each other domain controls within 15 minutes
optimised algorithm reduces replication traffic
not time based
triggered on demand only
Intra-Sites Replication
all domain database involved
changes are transmitted compressed via IP (RPC) or SMTP
time replication occurs can be configured
volume of replication traffic cannot be restricted
Mixed Vs Native
Mixed
supports coexistence with NT4
default
NT 4 BDCs continue to work
enables “fallback scenario” during mitigation
Native
supports all AD featured
more than 40MB domain database size
mostly problem-free “movetree”
universal groups, group nesting
once switched to native mode, no way back to mixed mode
Are There Still Trusts Available?
old fashioned NT 4 Trusts can still be used
no additional functionality
most be used to connect different forests
shortcut trusts
Vital for AD: DNS
DNS: AD’s locator service
can be hosted on non MS-DNS
minimum BIND version 8.1.2
no special characters in computer names
not really an option
delegate a separate “AD-Zone” on non-MS-DNS & use MS-DNS for that zone
What are Directory-Enabled Applications?
applications directly using & accessing the AD
Exchange 2000
typically extend the schema
may dramatically change usage patten for AD Resources
replication traffic
AD Queries
Active Directory Security
improved authentication
permission applied via ACLs
to object as whole
to specific attributes
fine-tuning of access permissions possible
tool-support to visualise security settings currently weak
Kerberos
“age-old” internet-standard
commonly used under Unix
secure authentication thanks to encryption
standard-authentication model under Windows 2000
microsoft Kerberos not fully compatible to other Kerberos implementations
Delegation of Administration
admin rights can be delegated to users or groups
delegation via Wizards
currently “admin nightmare” – very hard to detect who has rights
all objects must be viewed separately & manually
currently no good tools
microsoft plans to provide additional tools
Groups
basically, like under NT 4
local groups assigned permissions
global groups contain Users
from a single domain
global groups are members in local groups for permission assignment
new: universal groups
can be used everywhere in every domain
implemented via GC
replication traffic limits usability
Active Directory Problem Spots
DNS Dependency
no “merge-tree”
no partitioning
limited tool-support
forest global schema
schema-modifications can not be undone
