Please enable JavaScript.

Coggle requires JavaScript to display documents.

CHAPTER 4 Network Directory Service : Active Directory (UPDATE ON…

- - - - Objects in Domain
        
        Group (Hafiz)
        
        Groups are created so that users and other groups may be managed as a collective instead
        of as individuals.
        
        Computers (SYAKIL) -
        
        Computers represent individual computing machines on the network. The computers
        
        may be physical machines or they may be virtual machines running in Windows Virtual PC,
        
        Microsoft Hyper-V, or some other virtualization solution. For the most part, AD knows no
        
        difference between a physical and virtual machine
        
        Servers :pen:(anis ) Servers are really just computer objects, but AD detects that they are running the server
        version of the OS and places them in the Servers container.
        
        Organizational Units :pen: (irfan) - is a container within a Microsoft Active Directory domain which can hold users, groups and computers. It is the smallest unit to which an administrator can assign Group Policy settings or account permissions. :check:
        
        Built-in Containers :pen:(syahirah ) several buitl-in containers exist.These container hold the user accounts and group by defaults,the computer accounts and the server accounts. :!:
        
        User account(Syakil)
        
        Domain account
        
        Domain accounts are created and stored in the AD database. They are used by users to log on to the
        
        domain and by services that must run in the context of an account with domain access. You cannot
        
        create domain accounts unless you have first created a forest and within it, a domain. Additionally,
        
        you must have the permissions required to create domain accounts. The Domain Admins group has
        
        sufficient permissions to create domain accounts. For more information on the different groups built
        
        into the AD installation, see the section titled “Working with Groups.”
        
        Local account
        
        Local accounts are created in the local database on a Windows computer. The Windows computer
        
        may be running Windows Server operating systems or Windows client operating systems. Both
        
        operating systems support local accounts. Local accounts are created by using the Computer
        
        Management interface on the machine
        
        User account
        
        The users are account objects stored in the AD database. These account objects are
        
        used to allow users to log on to the network. When a user logs on to a domain, the user has access
        
        to resources within that domain based on the permissions assigned to those resources. Users may
        
        also be given access to resources in other domains within the forest. This will all become clearer
        
        as the AD logical architecture unfolds.
      - What is Domain --> all user accounts, computers, printers and other security principals, are registered with a central database located on one or more clusters of central computers known as domain controllers
      - Why we need more than 1 domain?:pen:(Syafiq) There are several reasons to have more than one domain. For example, you might want to improvedomain performance for the users in those domains. By creating separate domains, you partition thepool of users into smaller groups, which results in smaller domain database sizes. While some properties and objects are replicated to all domain controllers (DCs) in the forest that run the Global Catalog functions, the majority of a domain’s objects are stored only within that domain. :!:
    - - Example of Domain Trees (include a Picture) :pen:dilla :!:
      - Definition of Domain Trees :pen:dilla --> Is a group of domain that share same root namespace :check:
    - - Definition of Forest :pen: (izzat)
        AD forest is a collection of one or more domain trees sharing the same Global catalog and any schema. in many cases , they also share the same root namespace; however, a shared root namespace is not required for the domains to exist in the same forest. in AD , the forest acts as the default trust boundary :check:
      - Example of Forest (include a Picture) :pen: (irfan)
        :!:
  - - - Physical Architecture
        •The physical architecture includes the servers that make up the AD implementation and the sites used to define replication procedures. This section discusses the servers,and the later section titled "Exploring Sites and Replication" addresses the sites.
      - Logical Architecture
        
        The Logical architecture is a domain that can be implemented with one physical server or with dozens of physical servers
        The servers may he in a single data center ir they may be distributed accross the world using WAN links
    - - Domain Controllers
        
        Definition of Domain Controllers :pen: (Athilya) A domain controller is a server that responds to authentication requests and verifies users on computer networks. Domains are a hierarchical way of organizing users and computers that work together on the same network. The domain controller keeps all of that data organized and secured. :check:
        
        Functions of Domain Controllers
        
        User Account Provisioning : (sarah) The DCs store the AD database, which contains the user accounts.These accounts are used to allow logons.The user account include dozens of properties that define the users and the network resources they use, such as profile storage locations and home directories for data storage.
        
        Database Replication :pen: (faez) --> Database replication is the frequent electronic copying of data from a database in one computer or server to a database in another -- so that all users share the same level of information. :check:
        
        Resource Access Processing --> DC is also responsible for granting the STs so that users may access network resources. This only applies to clients using the Kerberos authentication protocol; however, the vast majority of clients do use this protocol today. Kerberos is used when any client from Windows 2000 or later accesses a DC running Windows 2000 or later
        
        Logon Processing :pen: (faez) :-> This process is known as authentication, and the primary authentication protocol in Windows domains is Kerberos. When the user logs on to the network, the Kerberos authentication process provides the user with a ticket called the User Ticket or the Ticket Granting Ticket (TGT).
        
        Logon Types:
        
        Interactive Logon
        
        Network logon
        
        Biometric logon
        
        Smart card logon
        
        step to create domain controller :pen:(anis) :check:
        
        Create the domain controller machine. Choose an OS (Server 2008 R2 or Server 2016) ...
        
        Add the Active Directory Domain Services Role. ...
        
        Complete the Active Directory domain setup. ...
        
        Reset the Administrator user password. ...
        
        Submit the AD form from the Paperspace console. ...
        
        Wait for confirmation.
        
        Other Domain Controller function in forest and domain environment
        
        Define Operations Master (OM) :pen: (dina) Operations master roles (also known as flexible single master operations, or FSMO) are special roles assigned to one or more domain controllers in an Active Directory domain. Changes to the directory database can be made simultaneously at multiple domain controllers in same network. Operations masters are needed for deleting a domain or changing the schema. :check:
        
        Operations Master (OM) Roles
        
        Schema Master :pen:(Alisa) The Schema Master is the only DC that can make changes to the schema. All other DCs learn of the schema structure from the Schema Master. A single DC in the entire forests plays this role.❗
        
        Domain Naming Master (ajiq) =Domain Naming Master The Domain Naming Master role is used to ensure that no two domains are created with the same name in the same forest. A single DC plays this role for the entire forest.
        
        Infrastructure Master (ajiq)=Infrastructure Master The Infrastructure Master ensures that group changes are updated properly across DCs. A single DC plays this role in each domain.
        
        RID Master :pen: (Alisa) The Relative ID Master assigns block of Security Identifiers (SID) to different DCs they can use for newly created objects .Each object in AD has an SID, and the few last digits of the SID are the Relative portion. In order to keep multiple objects from having the same SID, the RID Master grants each DC the privilege of assigning certain SIDs. :check:
        
        PDC Emulator :pen: (mukmin) = Primary Domain Controller (PDC) Emulator performs two domain roles
        1.acts as the PDC for any Windows NT Backup DCs (BDCs). 2.acts as the primary change password. When a password is changed, it is changed on the PDC role DC, and then it is replicated out to other DCs. One DC in each domain plays this role :!:
        
        Reasons for Installing more than 1 Domain Controllers :pen: (mukmin) 1.use for fault tolerance 2.sub domain is created automatically and this allows reading information across areas 3.they will replicate the Active Directory information between them and can provide services if the other is unavailable :check:
        
        Functional Level Overview :pen: (dina)
        *The functional level defines the support for older Active Directory versions and newer Active Directory features
        *Lower functional levels support older Active Directory versions and Domain Controllers.
        *Higher functional levels support newer Active Directory features.
        
        :!:
      - Supporting Servers
        
        What is Supporting Servers :pen:(hanis) additonal server are required to make AD work. These servers are used to provide the name resolution for the network and the IP configuration for the clients on the network. The DNS server providing the name resolution for the network, which is discussed in detail in the next section titles "planning a DNS Namespace". The Dynamic Host Configuration Protocol (DHCP) service provide dynamic configuration of IP protocol for the computers on your network.
        
        What is DHCP Servers (faris) :pen: --> Dynamic Host Configuration Protocol. Dynamic Host Configuration Protocol (DHCP) is a network management protocol used to automate the process of configuring devices on IP networks, thus allowing them to use network services such as DNS, NTP, and any communication protocol based on UDP or TCP. :check:
        
        What is DNS Servers :pen:(hanis)A DNS server is a computer server that contains a database of public IP addresses and their associated hostnames, and in most cases serves to resolve, or translate, those names to IP addresses as requested. DNS servers run special software and communicate with each other using special protocols. :check:
        
        Basic terminology
        related to DNS
        
        Hostname :pen: (damia) A DNS hostname is a name that uniquely and absolutely names a computer; it's composed of a host name and a domain name. DNS servers resolve DNS hostnames to their corresponding IP addresses. :check:
        
        Fully Qualified Domain Name (FQDN) :(sarah) A fully qualified domain name (FQDN) is the complete domain name for a specific computer, or host, on the internet. The FQDN consists of two parts: the hostname and the domain name. For example, an FQDN for a hypothetical mail server might be mymail.somecollege.edu. The hostname is mymail, and the host is located within the domain somecollege.edu. :check:
        
        Name server :pen:(fatin)the name server is the DNS server that resolve hostname to IP address.Windows server has the capability to function as a DNS server service can communicate with other standards-based DNS servers on the the internet
        
        Hosts file :pen: (damia) This is a text file that statically maps hostname to IP address. This file is located in c:\windows\system32\drivers\etc for standards Windows Server 2012 R2 installations and can be used as an entry-level alternative to a DNS server for name resolution in small environment with static hosts file entries though, because it will quickly turn into an administrative nightmare. :!:
        
        Forwarding server :pen:(fatin)A forwarding server is a server that can perform lookups when the local DNS server cannot resolve the requst
        
        Recursion :pen:(syahirah )recursion simply means that the DNS server starts at the root and contacts the top-level domain server(example: .com server) :!:
    - - 2 Methods in Hierarchical Structure with the example :pen:
        (athilya) :red_cross:
        
        Single domain
        can represent the organization’s hierarchy using OUs
        
        Separate domain
        represent the hierarchy. When you use separate domains, you are creating a namespace
        hierarchy.
        As an example : You can create a corporate domain called company.local. It will become the root namespcace. Next, you could create a domain for each department. The results could include such as domains as ;
        sales.company.local
        marketing.company.local
        manufacturing.company.local
        executive.company.local
        Now, you could further break some departments domains into functional domains. So you can create functional domains such as the following;
        inside.sales.company.local
        outside.sales.company.local
        In this case, sales.company.local daomain is referenced as a child domain of the company.local domain. company.local would be referenced as the parent domain . Futhermore, the domain inside.sale.company.local is a child domain to sales.company.locl and grandchild domain to company.local
      - what is Trust Relationship? :pen: (syafiq) Trust relationship is a secure communication channel between two domains in Microsoft Windows Server Operating Systems. Trust relationships allow users in one domain to access resources in another domain. Trusts work by having one domain trust the authority of the other domain to authenticate its user accounts :check:
        
        Transitive Trust vs Shortcut Trust with the example :pen: (hafizh) Transitive Trust : A transitive trust is when a trust can be extended outside of the two domains in which it was created. A domain connected via a transitive trust can thus access any other domain when there is a path of transitive trusts between that domain and the target domain. Example : if domain A trusts B, and B trusts C, then A automatically trusts C. :check:
        Shortcut Trust : If you have two domains that communicate with each other on a regular basis you can create a shortcut trust. This is the same as a transitive trust but is manually created by an administrator to reduce the number of trusts a user needs to travel over to get from one domain to another. Example : when a one-way, shortcut trust is established between domain A and domain B, authentication requests that are made in domain A to domain B can use the new one-way trust path. However, authentication requests that are made in domain B to domain A must still travel the longer trust path.
        
        :check:
    - - What is Replication --> Replication is important because it allows objects to be synchronized among multiple domain controllers within a domain. Active Directory replication ensures that the information or data between domain controllers remains updated and consistent.
        
        2 ways of AD replication
        
        intrasite replication. --> This replication occurs within an AD site. Intrasite replication is completely configured automatically. You do not have to configure anything for the DCs to replicate among themselves
        
        intersite replication --> This replication occurs between AD sites.
        
        All domain objects are replicated to all DCs within the domain; however, some objects are stored in a special part of the AD called the Global Catalog (GC). The GC contains a partial replica of all objects in the domain. It contains a reference to every user and group with a small subset of attributes. This is done to allow faster searches of the forest. Universal groups are stored in the GC and are stored only there.
        
        In a domain with multiple DCs, not every DC will also host the GC role. By default, only the first DC is configured as a GC. If you want more DCs to act as GC servers, you will have to enable the GC role on the additional DCs. This provides fault tolerance so that the GC is always available even if a DC goes down. In an environment with only two DCs, each DC should run the GC.
      - What is AD Site --> Microsoft defines a site as a group or collection of well-connected computers. When an organization is small enough to have a single location and only that one location, the entire network is typically the AD site. In larger organizations, multiple locations are likely to exist, and each location may be configured as a separate site.
        
        Sites are built from 3 primary components
        
        Subnets --> The IP subnets are used to define the sites. A site includes one or more IP subnets. For example, at one location, you may use the 10.10.10.0 and 10.10.11.0 subnets, while at another location you use the 192.168.1.0 subnet. These IP subnets are the core of AD sites.
        
        Site Links --> Site links define the connections between sites. They can be configured with varying costs and can be used to define the replication schedule between the sites.
        
        Bridgehead servers -->The bridgehead servers are the servers at either end of the site links. All intersite replication (replication between sites) occurs through bridgehead servers.
        
        You can install a single domain with DCs at multiple physical locations that are separated by some distance without configuring an AD site; however, many benefits can be achieved through the use of sites. For example, when you define sites you can create Group Policies that apply only to a specified site rather than applying the policies to the entire domain.
- - - - STEP 1: Determining the number of forests required
      - STEP 4: Select the forest root domain
      - STEP 5: Detailed design (GROUP 2)
        
        Subtasks in detailed design
        
        Determining placement of domain controllers (DCs)
        
        -Plan the placement of those DCs.
        
        -Microsoft defines DC locations as hub locations and satellite locations. :
        
        *Hub locations are the centralized locations where DCs are located, and these DCs serve many users within the organization while often acting as replication partners to satellite locations.
        
        *Satellite locations are those DC locations serving fewer users (typically, a branch office location) and are often connected to a hub DC.
        
        -Administrators also often place DCs as close to users as possible.
        
        Determining the number (DCs)
        
        Two DCs are considered the minimum number for fault tolerant purposes
        
        Always start with two DCs and add additional DCs as needed
        
        -For example, if you have two DCs and logons are processing slowly, you may have to add additional DCs to improve logon performance
        
        Additional DCs should be added as the workload demands it.
        
        Consider deploying two DCs per site in order to provide local logon capability and retain fault tolerance within the site in the event of a single server failure
        
        Selecting Operations Master role placement.
        
        PDC Emulator Role
        Configure a DC with accessibility from all areas of the domain to play this role. When passwords are changed, users can log on immediately when this server is available.
        
        RID Master Role
        This DC can be less powerful and even unavailable at times. It gives out RIDs in pools of more than 500 to every other DC
        
        Infrastructure Master Role
        This DC should be performing well because it is responsible for the synchronization of all group membership updates.
        
        Schema Master Role
        This DC will make all changes to the schema. Because the schema is not frequently modified, it can be a less powerful server. You must ensure it is online before you can change the schema.
        
        Domain Naming Master Role
        This DC must be online when you create or remove a domain or site.
        
        OU Planning
        
        OU planning : 2 primary consideration
        
        Administrative Deligation:
        
        Think of an OU as a folder
        
        You can assign permission to OUs to allow users to manage users , computers , and other objects in those OUs
        
        Assigning permissions to the OU is called administrative delegation
        
        For example, you can delegate the ability to reset password for user account to an individualwho is not a member of the domain admins group
        
        2.Group Policy Application :
        may be linked to several level at AD topology
        For example: domains, sites, OUs, and local machines that are AD domain members
        When group policy linked to container,it applies to container and to object in that contain by default
        For example you have 2 different OU name
        you can deploy each OU to computer or user
        the point is you can create seperate OUs that can be configure the object in differently or deploy different software through group policies
        
        after this you can begin planning OU structure . structure may be based on organization hierarchy or based on administrative needs alone .Its common to mixed these 2
        
        a Mixed Ou structure allow to administer department defferently sub-OUs all based on permission capabilities . power user have more capabilities than standard user contractors can be adminstered differently either power user or standard user
        
        Planning the site design
        
        define sites for each physical location where replication should be managed
        
        AD sites are not for replication only; they are also used to locate nearest resources to a client for services such as logon and the Distributed File System (DFS)
        
        In network deployment,an AD sites is important to create for each physical location
        
        Expectation of highly available bandwith in order to support the frequency of intrasite replication and when two locations are connected by a low-bandwith connection,they should be broken into separate sites within AD
        
        Sites may be connected with links not owned by your organization
        
        Sites are based on IP subnets or collection of IP subnets
        
        Assigning the Global Catalog (GC) Placement
        
        The Global Catalog (GC) role
        
        The GC contains a partial replica of all objects in every domain in the forest.
        
        This subset of data is
        used to provide faster searches of the directory.
        
        The GC also contains the Universal Groups and their membership lists.
        
        In a forest that contains a single domain deployment, Microsoft recommends that all DCs in the domain be configured as GC servers.
        
        In this situation, no additional requirements for storage, CPU usage, or replication traffic are generated by adding the GC role because all of the domain information is contained on each DC anyway.
        
        In large multiforest deployments, you will select a few DCs in each forest to play the role of the GC.
        
        In environments this large, the GC data set can become quite large and may cause heavy replication traffic.
        
        You should also know that some applications store data within AD, such as Microsoft Exchange.
        These applications may place increased demands on the required number of GC servers.
      - STEP 3: Assign domain names
        
        Please refer to this link
      - STEP 2: Determine the number of domains
    - - 3 phases of AD installation
        
        PHASE 1: add the DNS Server role and configure it to manage the AD domain name required. The DNS Server role is the component that allows a Windows server to act as a DNS server and provide hostname resolution for clients. If you are adding the DNS Server role to a new server, you will need to configure the server to act as the primary server for the zone you want to it to manage. The zone that you configure will be for the namespace of your first AD Domain. For example, if you plan to install a domain name "company.com" you would create a zone with the same name on the DNS Server.
        
        Preparing to install DNS
        
        First, you should ensure that you have a proper DNS domain name for your AD domain.If you plan to use a public DNS domain name, you will need to register it with the InterNIC (Internet Network Information Center) to avoid problems later.If you register the domain, no one else can set up a website with the same domain name. The InterNIC tracks registered domain names and resolves domain name transfer disputes
        
        Configuring the DNS Zone
        
        The preceding section showed you how to add the DNS Server role; however, it still is not configured to provide hostname resolution for the DNS zone training.local.
        
        Click Start ⇒ All Programs ⇒ Administrative Tools ⇒ DNS. 2. When the DNS Manager loads, double-click on the server name in the left pane to expand the local server. 3. Because you want to create a forward lookup zone to resolve hostnames to IP addresses, rightclick on Forward Lookup Zones and choose New Zone. You may have to click on the Forward Lookup Zones node before the right-click action will work. 4. In the New Zone Wizard, click Next to begin creating the forward lookup zone. 5. On the Zone Type page, choose the Primary Zone because this is the first DNS server to manage the training.local zone. If you add another DNS server for fault tolerance later, you will configure it to be the Secondary Zone server. 6. After selecting Primary Zone, click Next
        
        On the Zone Name page, enter the Zone Name value of training.local8. On the Zone File page, accept the default file for zone storage (training.local.dns) and click Next. 9. On the Dynamic Update page, select to Allow Both Nonsecure And Secure Dynamic Updates so that clients can automatically register their hostnames and IP addresses with the DNS server, and then click Next, 10. On the Completing the New Zone Wizard page, click Finish to create the zone. After following these steps, you will see a new child node (named training.local) in the Forward Lookup Zones node. You may want to create a reverse lookup zone as well, so that you can discover the hostname belonging to a known IP address
        
        Configuring the IP Settings and Primary DNS Suffix
        
        Now that DNS is up and running on the server, you need to configure the server to use the DNS
        service. To do this, you will have to modify the IP configuration on the server.The final task before installing the AD DS role is to configure the primary DNS suffix on the server. The primary DNS suffix is used to define the FQDN of the server. The server name (hostname) is the first part of the FQDN, and the primary DNS suffix is the second. To configure the primary DNS suffix to be training.local, follow these steps
        
        Adding the DNS server Role
        
        The DNS Server role is added to a Windows Server 2008 R2 server by using the Server Manager console. To launch the Server Manager and add the DNS Server role, follow these steps: 1. Log on to the server as an administrator. 2. Click Start ⇒ All Programs ⇒ Administrative Tools ⇒ Server Manager.3. Select the Roles node in the left pane (which is called the Console Tree) of Server Manager. 4. Click the Add Roles link to launch the Add Roles Wizard.5. If the Before You Begin screen is displayed, click Next to select the DNS Server role. 6. On the Select Server Roles page of the wizard, select the DNS Server role by checking the box next to it.
        
        Read the overview information presented on the DNS Server page of the wizard and, when ready, click Next to continue. 8. On the Confirm Installation Selections page, click Install to add the DNS Server role. 9. On the Installation Results page, click Close to exit the wizard
        
        After you perform this procedure, the Server Manager interface will change to reflect the newly added DNS Server role, as shown in Figure 6-5. If you no longer need the role, you can remove it by clicking the Remove Roles link. Click the Go to DNS Server link in the DNS Server section of the Roles page to view the DNS Server role administration interface. Close the Server Manager when you have finished adding roles.
        
        PHASE 2: Add the Active Directory Domain Services (AD DS) server role to the DC server. Like other roles, it is installed from within Server Manager. You will find the instructions for adding AD DS Server role to a Windows Server in the section tilted "Installing the AD DS Roles".
        
        PHASE 3: Configure AD using the DCPROMO wizard to be a new domain in a new forest or an additional DC in an existing domain.
        
        One final task is required to get AD up and running on your server. You must run the DCPROMO Wizard to configure the domain and install the local server as a DC for the domain. You can run the DCPROMO Wizard from within Server Manager or from the Start menu’s Search field.
        
        If you want to run DCPROMO from Server Manager, simply open the Server Manager, expand the Roles node, click on the Active Directory Domain Services node, and then click the link that reads Run the Active Directory Domain Services Installation Wizard (dcpromo.exe)
        
        To verify that AD is running and accessible, open the Active Directory Users and Computers application in Administrative Tools on the Start menu. You should see the training.local domain with child nodes under it, including a Users container containing the Administrator and Guest user accounts.
- - - - Architecture management (hafiz)
        
        The architecture management tools allow you to configure the AD architecture sites,replication,Operation Master Roles, and administration :3
      - Object management(fatin)
        -object management tools allow you to create and work with users, groups, computers, printers,
        and other AD objects.
        -allow to create and manage organizational hierarchies.
    - - Active Directory Sites and Services
        
        Function of Active Directory Sites and Services (Fad)
        
        It is used to create and manage sites
        
        It could define subnets and link them with the site
        
        Site Replication (Fad)
        
        To control the replication, you can create new Inter -Site Transports
        
        It is to define the schedule of replication and the frequency within that schedule
        
        You can also configure SMTP for replication to remote sites without active WAN connections
      - Active Directory Domains and Trusts
        
        Function of Active Directory Domains and Trusts tool (Hafiz)
        
        The function is used to create trust relationships and manage the domain functional level.
        
        By default,transitive trust relationships exist that allow communications between all domains within a forest; however, you may want to create shortcut trusts directly between domains within a forest or even create a forest trust between two separate forests(afzal)
        
        is actually a collection of tools or commands(afzal)
      - Active Directory Module for Windows PowerShell
        
        Function of Active Directory Module for Windows PowerShell (syafiq):
        The Active Directory Module for Windows PowerShell provides dozens of cmdlets for general AD administration. A cmdlet is a command in the Windows PowerShell interface. Think of cmdlets as traditional commands at the
        DOS prompt or Windows Command Prompt. for example "sconfig" command
        
        Several cmdlets are available for AD architecture management:
        
        Get-ADDomain (Alisa)
        
        Retrieves the AD domain information from the domain to which the currently accessed machine belongs
        
        Get-ADForest (Alisa)
        
        Retrieves the information about the forest specified or, if no forest is specified, the forest to which the currently accessed machine belongs.
        
        Get-ADDomainController (Faisy)
        
        Retrieves the information about the DC specified or, if no DC is
        specified, the currently accessed DC.
        
        Get-ADRootDSE (Faisy)
        
        Retrieves the root of a directory server information tree. This provides
        information about the configuration and capabilities of the directory server.
        
        Set-ADForest (Faisy)
        
        Used to modify global parameters in the forest.
        
        Set-ADForestMode(ajiq)
        
        Used to set the forest functional level.
        
        Set-ADDomain(ajiq)
        
        Used to modify global parameters in the domain
        
        Set-ADDomainMode(ajiq)
        
        Used to set the domain functional level
    - - Active Directory Users and Computers (ADUC) tool,
      - Active Directory Administrative Center (ADAC)
      - Active Directory Module for Windows PowerShell.
        
        cmdlets
        
        computer objects in the domains(FARIS)
        
        New-ADComputer
        
        creates a new Active Directory computer object.
        
        Get-ADComputer
        
        gets a computer or performs a search to retrieve multiple computers.
        
        Remove-ADComputer
        
        removes an Active Directory computer
        
        Set-ADComputer
        
        modifies the properties of an Active Directory computer object.
        
        user objects in the domains(FARIS)
        
        New-ADUser
        
        creates an Active Directory user.
        
        Get-ADUser
        
        gets a specified user object or performs a search to get multiple user objects.
        
        Remove-ADUser
        
        removes an Active Directory user.
        
        Set-ADUser
        
        modifies the properties of an Active Directory user.
        
        other objects in the domains(sarah)
        
        New-ADObject
        
        Get-ADObject
        
        Remove-ADObject
        
        Set-ADObject
        
        group memberships in the domains(IZZAT)
        
        Get-ADGroupMember
        
        Remove-ADGroupMember
        
        group objects in the domains(IZZAT)
        
        New-ADGroup
        
        Get-ADGroup
        
        Remove-ADGroup
        
        Set-ADGroup
  - - - local accounts
        
        What is local account (athilya)
        
        Local accounts are created in the local database on a Windows computer.The Windows computer may be running Windows server operating systems or windows client operating systems. Both operating systems support local accounts.
        
        Reason/scenario to create local accounts (syafiq):
        -When we need local accounts on Windows clients that are not part of a domain
        -When we need accounts locally on Windows clients that log on locally instead of to the domain
        -When you have a stand-alone Windows server that is not part of a domain
        -When you have a service that must run as a user, but you do not want to run the service with a domain account
      - domain accounts.
        
        What is domain account(dilla)
        
        Created and stored in the AD Database
        
        Used by users to log on to domain and by services that must run in the context of an account with domain access
        
        roaming profiles vs mandatory profiles. (athilya)
        
        roaming profiles : can be modify by the user and are stored on the network so that they can be accessed from any windows client.
        
        mandatory profiles : Cannot be modified by the user, but they are stored on the network as well.
      - information needed to create a new account (dina)
        
        User Last Name
        
        User Principal Name ( looks like an email address) Example : (jo.doe@domain.com)
        
        User First Name
        
        Password
        
        User Logon Name ( in the User Creation dialog.) Example : DOMAIN \ USERNAME (TRANNING\FREDR)
      - Tabs in user account
        
        General (NAJ)
        
        The General tab is used to configure basic account settings, including a description, telephone number, email address, web page, and user display names.
        
        Address (NAJ)
        
        The Address tab is a nontechnical properties tab. It allows you to specify the street or P.O. Box address of the user, including city, state, and zip code settings
        
        Account (SYAKIL)
        
        The Account tab is used to configure settings specific to account operations. These settings include the UPN and NetBIOS logon names, the allowed logon hours, the machines to which the user may log on, the account lockout status, and various additional account options. You can also set an account expiration date on this tab
        
        Profile(syafiq):
        The Profile tab includes the user profile path, the logon script, and the Home folder settings.The user profile path is used to enable networked roaming user profiles.The logon script is used to specify a process that should run each time the user logs on to the network and may include batch files, executables, or Windows PowerShell scripts. The Home folder is intended to be the default location for user data. Although you can still manage these settings on this tab, most of the settings are managed through Group Policy.
        
        Telephone (athilya)
        
        the telephone number that can be set on the general tab, the telephone tabs allows you to set a home, pager, mobile, fax or IP phone number, and you can use it to add notes to describes the numbers.
        
        Member of(sarah)
        
        Used to manage group membership from the user
        Can set a primary group on this tab (required only to order Macintosh Client or POSIX)
        
        Remote Desktop Service Profile (mukmin)
        
        Used to set up a separate user profile for accounts that use a Terminal Services server or access a server with Remote Desktop enabled. You can specify the profile path as a network path. You can also specify a separate Home folder for Remote Desktop Services connections, or you can indicate that this account is denied the user permissions to log on to Remote Desktop Session Host servers.
        
        COM+(damia)
        
        COM+ is a partition that allows applications to be organized in logical containers. These application runs independently of configurations in other partition. It's a configuration boundary. The COM+ partition mostly deployed for web-based applications. It can be configured differently for different pool of users and then placed into different partitions. The COM+ tabs allows to select the appropriate COM+ partition for the current user account.
        
        Dial-in (mukmin)
        
        Used to configure remote access network properties for both dial-in users and VPN connections. You can set network access permissions to allow access, deny access, or use the Network Policy Server role. For true dial-in users, you can define a caller ID value verification and requires callbacks to the user's telephone number. Additionally, you can assign static IP Address and static routes to control the reachable destinations for remote connections
        
        Session (mukmin)
        
        Session tab is only relevant only to Remote Desktop Services connections. It use to set properties for the connections (session) include set a delay timer to end a disconnected session and set the delay timer to end active or idle sessions
        
        Remote Control(SYAKIL)
        
        The Remote Control tab is relevant only to Remote Desktop Services connections. On this tab, you can designate whether to allow remote control. Remote control allows an administrator to take over the user’s session for troubleshooting purposes or to demonstrate an action. You can also define whether the administrator can only view the session or also interact with the session.
        
        Personal Virtual Desktop (hanis)
        
        the personal virtual desktop is used to assigned a specific virtual machine to the user account for the user's virtual desktop. Personal virtual desktop require the deployment of the remote desktop (RD) virtualization host on a hyper -v server. RD virtualization host is a new role service included with windows server 2008 R2. you cannot use this feature with windows server 2008 servers.
        
        Organization (hanis)
        
        The organization tab provides fields for information related to organizational hierarchies and positions. You can enter the user's job title, department and company on this tab. you may also specify the user's manager and view any other user's who are managed by current user as direct report
        
        environment(hanis)
        
        environment tab is relevant only to Remote Desktop Service connections. You can Specify a program to satart automatically at logon, and you can control whether client devices (drives and printers) show up in the remote desktop session.
    - - What is group(dilla)
        
        Used to manage multiple users and other groups as a unit
      - Group type
        
        Domain local (dina)
        
        Used to assign permissions within a domain.
        Cannot assign permission resources outside of the domain
        
        global(syahirah)
        
        global groups have a forest-wide scope.They can be assigned
        permission for any resources in any domain in the forest,and they can include the following member:
        
        global groups from any domain in the forest
        
        User accounts from the same domain
        
        Universal(dilla)
        
        Can include members from any domain in the forest
        
        Also can be assigned permission to any resource in the forest
      - security group vs distribution group (dina)
        
        When create group it have option either security or distribution.
        
        A security group is a group that may
        be assigned permissions
        
        A distribution group is a group
        not be assigned permission.
    - - lists the built-in groups included with Windows Server 2012(fatin)
        
        -access control assistance
        -account operators
        -administrators
        -Allowed RODC Password Replication Group
        -Backup Operators
        -Certificate Service DCOM Access
        -Cert Publishers
        -Cloneable Domain Controllers
        -Cryptographic Operators
        -Denied RODC Password Replication Group
        -Distributed COM Users
        -DnsUpdateProxy
        -DnsAdmins
        -Domain Admins
        -Domain Computers
        -Domain Controllers
        -Domain Guest
        -Domain Users
        -Enterprise Admins
        -Enterprise Read-Only Domain Controllers
        -Event Log Readers
        -Group Policy Creators Owners
        -Guests
        -Hyper-V Administrators
        -IIS_IUSRS
        -Incoming Forest Trust Builders
        -Network Configuration Operators
        -Performance Log Users
        -Performance Monitor Users
        -Pre–Windows 2000 Compatible Access
        -Print Operators
        -Protected Users
        -RAS and IAS Servers
        -Read-Only Domain Controllers
        -Remote Desktop Users
        -Remote Management Users
        -Replicator
        -Schema Admins
        -Server Operators
        -Terminal Server License Servers
        -users
        windows authorization access group
        -WinRM Remote wmi users
  - - - Domain (damia) This is a domain itself. In the example, it is training.local
      - Builtin (hafizh) This container holds the default service administrator accounts and several default groups.
      - Users (syahirah) This container is the default location for newly created user accounts and groups within the
        domain.
      - Computers (hafizh) This container holds the default service administrator accounts and several default groups.
      - Domain Controllers (Faez)
        
        benefits of OUs (Faez)
        
        The ability to create hierarchy representing your organization
        
        The ability to delegate administrative capabilities to a specific user account or group for an OU or hierarchy of OUs
        
        The ability to customize the containers name
        
        The ability to link different Group Policy Objects to different OUs
        
        object types in OUs (Faez)
        
        Users
        
        Groups
        
        Other Ous
        
        Contacts
        
        Shared Folders
        
        Computers
        
        Printers
        
        It actually is an OU that was created by default
- - - - -A resource forest is a forest that contains shared items that all users from other forests will require. For example, Exchange email servers may exist in a resource forest. Typically, resource forests are needed only in implementations that demand many forests forother previously listed reasons.
- - - - applications are not always upgradeable,and this can impact your AD planning
      - Simply to mirror the organizational

The Enterprise Admins and Schema Admins group will contain users or groups who should have forest-wide administrative capabilities.

If the forest root domain is selected, which is the first domain that installed in the forest, the name of the domain cannot be change

- - - - 5.Many administrators use the .local top-level domain as a private domain name for temporary testing.This is fine for testing temporary installations or for learning purposes
        
        6.other top-level domain such as .test , .localhost ,.example , .invalid