Active Directory 2008 R2 Updates


Published on

Published in: Technology
  • nice to get this info
    Are you sure you want to  Yes  No
    Your message goes here

Active Directory 2008 R2 Updates

  1. 1. Active Directory Windows Server 2008 R2 Updates<br />Amit Gatenyo<br />Infrastructure & Security Manager, Dario<br />Microsoft Regional Director – Windows Server & Security<br />054-2492499<br /><br />
  2. 2. Session Objectives And Takeaways<br />Describe Active Directory features in Windows Server 2008 R2<br />Discuss the importance of these features to our customers<br />Demonstrate how some of these features will benefit our customers<br />
  3. 3. Agenda <br />What’s new in Active Directory for Windows Server 2008 R2?<br />PowerShell Cmdlets<br />Active Directory Administrative center<br />Best Practice Analyzer<br />Recycle Bin for AD<br />Managed Service accounts<br />Offline Domain Join<br />Authentication Assurance<br />Health Model and Management Packs<br />Active Directory Tour demonstration<br />Conclusion<br />
  4. 4. Powershell for ADCommand line scripting for administrative, configuration and diagnostic tasks<br />Past limitations<br />30+ command line tools for administering AD are not consistent in their usage<br />Difficult to compose these tools to achieve complex tasks<br />Feature takeaway<br />85+ AD cmdlets for comprehensive AD DS and AD LDS administration and configuration<br />Communicates using Web Service protocols<br />Can be used to manage Windows Server 2008 and 2003 domain controllers, using future AD Web Service download<br />
  5. 5. Powershell Advantages<br />Consistent vocabulary and syntax<br />Predictable discovery<br />Flexible output formatting<br />Cmdlets can be easily composed (pipe) to build complex operations<br />End-to-End manageability with Exchange, Group Policy, etc<br />
  6. 6. PowerShell Provider Model<br />Provides sessions, server context, security context and path context<br />Enables best practices sharing across connections<br />Combination of cmdlets & provider means familiar model for users<br />Perform operations in AD that are similar to the file system or registry, such as rename, move, etc<br />
  7. 7. Get-Command -CommandTypeCmdlet *-AD*<br />Add-ADComputerServiceAccount<br />Add-ADDomainControllerPasswordReplicationPolicy<br />Add-ADFineGrainedPasswordPolicySubject<br />Add-ADGroupMember<br />Add-ADPrincipalGroupMembership<br />Clear-ADAccountExpiration<br />Disable-ADAccount<br />Disable-ADOptionalFeature<br />Enable-ADAccount<br />Enable-ADOptionalFeature<br />Get-ADAccountAuthorizationGroup<br />Get-ADAccountResultantPasswordReplicationPolicy<br />Get-ADComputer<br />Get-ADComputerServiceAccount<br />Get-ADDefaultDomainPasswordPolicy<br />Get-ADDomain<br />Get-ADDomainController<br />Get-ADDomainControllerPasswordReplicationPolicy<br />Get-ADDomainControllerPasswordReplicationPolicyUsage<br />Get-ADFineGrainedPasswordPolicy<br />Get-ADFineGrainedPasswordPolicySubject<br />Get-ADForest<br />Get-ADGroup<br />Get-ADGroupMember<br />Get-ADObject<br />Get-ADOptionalFeature<br />Get-ADOrganizationalUnit<br />Get-ADPrincipalGroupMembership<br />Get-ADRootDSE<br />Get-ADServiceAccount<br />Get-ADUser<br />Get-ADUserResultantPasswordPolicy<br />Install-ADServiceAccount<br />Move-ADDirectoryServer<br />Move-ADDirectoryServerOperationMasterRole<br />Move-ADObject<br />New-ADComputer<br />New-ADFineGrainedPasswordPolicy<br />New-ADGroup<br />New-ADObject<br />New-ADOrganizationalUnit<br />New-ADServiceAccount<br />New-ADUser<br />Remove-ADComputer<br />Remove-ADComputerServiceAccount<br />Remove-ADDomainControllerPasswordReplicationPolicy<br />Remove-ADFineGrainedPasswordPolicy<br />Remove-ADFineGrainedPasswordPolicySubject<br />Remove-ADGroup<br />Remove-ADGroupMember<br />Remove-ADObject<br />Remove-ADOrganizationalUnit<br />Remove-ADPrincipalGroupMembership<br />Remove-ADServiceAccount<br />Remove-ADUser<br />Rename-ADObject<br />Reset-ADServiceAccountPassword<br />Restore-ADObject<br />Search-ADAccount<br />Set-ADAccountControl<br />Set-ADAccountExpiration<br />Set-ADAccountPassword<br />Set-ADComputer<br />Set-ADDefaultDomainPasswordPolicy<br />Set-ADDomain<br />Set-ADDomainMode<br />Set-ADFineGrainedPasswordPolicy<br />Set-ADForest<br />Set-ADForestMode<br />Set-ADGroup<br />Set-ADObject<br />Set-ADOrganizationalUnit<br />Set-ADServiceAccount<br />Set-ADUser<br />Uninstall-ADServiceAccount<br />Unlock-ADAccount<br />
  8. 8. Administrative Center for ADIncrease the productivity of IT Pros by providing a scalable, task-oriented UX for managing Active Directory<br />Past limitations<br />Non task-oriented UI causes customer pain<br />Example: resetting user passwords<br />Representation in MMC not scalable for large datasets<br />Feature takeaway<br />Tasks executed through PowerShell Cmdlets<br />Task oriented administration model, with support for larger datasets<br />Consistency between CLI and UI management capabilities<br />Navigation experience designed to support multi-domain, multi-forest environments<br />
  9. 9. Progressive disclosure<br />Task oriented<br />Powershell based instrumentation<br />Multi-Domains/Multi-Forests<br />
  10. 10. Best Practice Analyzer Identify deviations from best practices to help our customers better manage their Active Directory deployments<br />Past limitations<br />No easy and automated validation of AD configuration against best practices<br />Feature takeaway<br />Analyzes AD settings that cause most unexpected behavior in customer environments<br />Leverages PowerShellcmdlets to gather run-time data<br />Makes recommendations in the context of the deployment<br />Available through Server Manager BPA runtime tool<br />
  11. 11. Best Practice Analyzer first set of scenarios<br />Version 1.0 of the BPA focuses mostly on common DNS issues<br />Checking SRV records for DC are registered with its DNS Server<br />A/AAAA records of a DC are registered with its DNS Server<br />DC has a valid host name<br />Schema Naming Master and Domain Naming Master FSMO are recommended to be on same machine<br />RID and PDC recommended to be on same machine<br />Each domain is recommended to have at least two DCs<br />
  12. 12. Windows Server 2008<br />Windows Server 2008 R2<br /> Additions<br />GUI<br />GUI<br />CLIENT<br />ADUC/ADSS/ADDT<br />ADMUX<br />BPA<br />CLI<br />WSH<br />MMC<br />CLI<br />ADSI<br />AD PS<br />MUX<br />.NET<br />.NET<br />LDAP<br />DS RPC-Based Protocols<br />WCF<br />WPF<br />…<br />…<br />DSR<br />SAM<br />.NET<br />WCF<br />SERVER<br />AD Web Service<br />.NET<br />S.DS.P/S.DS.AM/S.DS.AD<br />DS RPC-Based Protocols<br />LDAP<br />…<br />…<br />DSR<br />SAM<br />AD Core<br />AD Core<br />
  13. 13. Recycle Bin for ADCustomer can undo an accidental deletion in Active Directory<br />Past limitations<br />Accidental object deletion causes business downtime – deleted users cannot logon or access corporate resources<br />Accidental deletions are the number #1 cause of AD DisasterRecovery scenarios<br />Feature takeaway<br />Recycle bin for AD DS and AD LDS objects<br />Feature enabled with a new forest functional level<br />Requires all DCs in the forest to be Windows Server 2008 R2 DCs<br />For AD LDS, all replicas must be running in a new ‘application mode’<br />
  14. 14. Recycle Bin for AD Object Life-cycle<br />180 Days<br />Tombstone Object<br />Garbage collection<br />Live Object<br />Windows Server 2008<br />Returns Tombstones<br />LDAP OID 1.2.840.113556.1.4.417<br />Windows Server 2008 R2 with Recycle Bin enabled<br />(If not enabled, behavior is similar to Windows Server 2008)<br />LDAP OID 1.2.840.113556.1.4.2064 <br />Returns Deleted<br />Returns Deleted and Recycled<br />Garbage collection<br />Live Object<br />Deleted Object<br />Recycled Object<br />180 Days<br />180 Days<br />
  15. 15. Managed Service AccountsSimple management of service accounts<br />Past limitations<br />Management of individual accounts for services is cumbersome<br />Periodic maintenance often causes outages <br />Example: resetting service account password<br />Feature takeaway<br />A manageable solution that addresses isolation needs for services <br />Better SPN management in Win7 Domain Functional Mode <br />Lower TCO from reduced service outages (for manual password resets and related issues)<br />One Managed Service Account per Service per box<br />No human intervention for password management!<br />
  16. 16. Offline Domain JoinEnable easier provisioning of machines in the data center<br />Past limitations<br />Reboot needed after domain join<br />Inability to prepare the machine to be domain joined while offline<br />Feature takeaway<br />Ability to pre-provision machine accounts in the domain to prepare OS images for mass deployment<br />Machines are domain joined on initial boot<br />Reduces steps and time needed to deploy in the data center<br />
  17. 17. Authentication AssuranceApplications can control resource access based on authentication strength and method<br />Past limitations<br />Customers cannot use authentication type or authentication strength to protect corporate data<br />Example: control access to resources based on claims such as use of smartcard for logon or the certificate used 2048 bit encryption<br />Feature takeaway<br />Administrators can map various properties, including authentication type and authentication strength to an identity<br />Based on information during authentication, these identities are added to Kerberos tickets for use by applications<br />Feature is enabled with a new domain functional level<br />All domain controllers in the domain need to be Window Server 2008 R2 DCs<br />
  18. 18. Health ModelEnable IT administrators to better diagnose and resolve Active Directory issues<br />Past limitations<br />Diagnostic information is incomplete and inconsistent<br />Feature takeaway<br />Continued investment towards completing the health model<br />A single authoritative source for information used in Management Packs, Best Practice Analyzer and online documentation<br />
  19. 19. Management PackProvide proactive monitoring of availability and performance of Active Directory<br />Past limitations<br />Current management pack lacks support for Windows Server 2008 and MOM 2007<br />Feature takeaway<br />Support for Windows Server 2008 domain controllers<br />Multiple replication latency groups<br />Ability to monitor multiple forests from a single management group<br />Management pack for MOM 2007<br />
  20. 20. The journey to Windows Server 2008 R2<br />Upgrading to Windows 7 client while keeping existing servers, you can use:<br />Off-line domain join <br />Once AD Web-service is available for existing servers, if you upgrade to Windows 7 client, you can use: <br />AD Powershell and ADAC with all your servers<br />Upgrading to Windows 7 client while installing one or more Windows Server 2008 R2 (one per domain), you can use:<br />Managed service account<br />If you change the domain functional level to Windows Server 2008 R2, you can use:<br />Authentication Assurance <br />Managed service account with an enhanced SPN management experience<br />If you change the Forest functional level to Windows Server 2008 R2, you can use:<br />AD Recycle-bin<br />
  21. 21. Thanks for listening!<br />Amit Gatenyo<br />Infrastructure & Security Manager, Dario<br />Microsoft Regional Director – Windows Server & Security<br />054-2492499<br /><br />