Large corporations today face the following
Finding a certain file.
Seeing everything from a single view
Windows NT server network
Offers directory services
Single network logon
Single point of administration and replication
Tools for organizing, managing and
locating objects in a computing system
Directory services are like a telephone
LANs and WANs grow larger and more
Active directory unifies and brings order to
diverse server hierarchies, or
Users and administrators do not know exact
The directory can run a query for an object by
one of its attributes
A directory service can
Enforce security defined by administrator
Replicate a directory
Partition a directory into multiple stores
A management and an end user tool
Included with Windows 2000 server
Works well in any size installation
Single server with few hundred objects
Thousands of server with millions of objects
Attributes for User Object:
Can include every single
object, every server and
Any bounded area in
which a given name can
A distinct, named set of
attributes that represents
such as a user, a printer
or an application.
An object which has
attributes and is part of
A hierarchy of objects
Endpoints on trees are
Shows how objects are
A single security
boundary of a
A tree comprised of
sharing a common
and forming a
A set of one or more trees that do not form a contiguous
All trees in a forest share a common schema, configuration and
A forest does not need a distinct name
Location in a network that contains Active Directory servers
Active Directory Features
Active Directory is tightly integrated with
Domain Name System.
Active Directory uses DNS as the location
An Enterprise can connect Active Directory
Servers directly to the Internet.
Support for LDAP
LDAP is Lightweight Directory Access
It was developed as a simpler
alternative to X.500 protocol
Active Directory supports both LDAP
version 2 and version 3.
Active Directory Schema defines two
Object Globally Unique Identifier, a 128 bit
number which is never changed if object is
moved or renamed.
User principal Name which is shorter than
DN and easy to remember
Supported protocols include:
Remote procedure call
Supported API’s include
GC enables users and applications to
find objects in an Active Directory
Domain tree if user knows one or more
attributes of target object.
GC holds a replica of every object in
the Active Directory, but only holds a
small number of their attributes.
All objects are protected by Access Control
An ACL is store as a binary value called a
It allows a higher administrative authority
to grant rights for containers and subtrees
to individuals and groups.
Trees and Forests
results in deep search
into child domains.
Windows 2000 domain
tree is a hierarchy of
consisting of a partition
of Active Directory.
Trust relationship is
joined domain and its
Domains are joined to
Domain tree during
Extending the Schema
New attributes can be added to the Schema
at any time , using name, OID, definition of
data, range limits.
New Objects can be added at any time
using name, oid, list of classes that can be
parents of object, class object is derived from,
and list of classes that apply to the object.
Easy Migration from Windows NT 3.5
Active Directory is designed to operate in
The migration process from Down level
servers to active directory take place one
domain controller at a time.
Win 4.x domain with single primary domain controller
and two Backup Domain controllers.
Windows NT 4.0