The document provides an overview of Active Directory including key elements such as domain controllers, the schema, security groups, SYSVOL, group policy objects, sites and subnets. It discusses features of Active Directory such as authentication, privileges, policies, auditing, replication, and trust relationships. It also describes important Active Directory elements in more detail including the roles of domain controllers, importance of the schema, best practices for assigning security groups and permissions, and functions of SYSVOL and group policy objects.

1. Eng Ing Eng !
<Insert tada.wav here>

2. About The Speaker
• Name: Pandu Poluan
• Email: pandu@poluan.info
• Experience:
– Senior Instructor (of instructors) for Cisco, Microsoft,
Certified Ethical Hackers
– IT Manager of Infrastructure,
PT Panin Sekuritas Tbk
• 25 branches, 500 employees, 1 domain
– Systems Administration Manager,
PT Carrefour Indonesia
• 85 branches, 10’000+ employees, 2 domains

3. Active Directory
An Introduction

4. What is Active Directory?
• Directory • Authentication
– Database of Objects in – Into the network
the Domain – Uses “Kerberos”
• Users mechanism
• Computers
•
• Privileges
Printers
• Scanners – For network resources
• Shares – For admin tasks
• Refrigerators • Active
• Coffee Makers
• Toilet

5. Why called “Active”
• Not just auth • Policies
• Grouping (Many-to- – Restrictions
Many) – Forced settings
– Based on Org Struct – “Push” installation
– Based on Functional • Audit
Team • Replication
– Based on Ad Hoc
– One way & Two way
needs
– Bandwidth-adapting
• Delegation
• ‘Trust’ Relationship
– Of admin tasks
– Of management tasks

6. Overview of AD Elements
• Domain Controllers
– Writable & RODC
• Schema
• Security Groups
• SYSVOL
• Group Policy Objects (GPO)
• Sites & Subnets
• ... (and many others, but let’s just focus on the
above for this “Introduction”)

7. Domain Controllers
• Where AD database(s) are kept
• Replicate between themselves
– Two way with writeable DCs, One-way to RODCs
– Also replicate “SYSVOL”
• MUST be secured at all costs!!
– Physical security
– Logical security  RODC
– Hardening:
• Allow only special ‘elevated’ accounts ‘administrator-level’
access to the DCs

8. The AD “Schema”
• Definition of Objects in AD
– Properties/Attributes
– ‘Nature’ of Object
• E.g., container, custom container, leaf object
• AMAT SANGAT VITAL SEKALI BANGET !!!
– *IMMEDIATELY* replicated to other DCs
– Feel free to commit suicide if someone gained
Schema-editing ability … and botched the schema

9. Security Groups
• Used to manage privileges/permissions
practically, systematically, and healthily
– Managing privileges per user in a big
enterprise is not good for your health
• Microsoft-recommended Best Practice:
A G U DL P
Account Global Universal Domain Local Permissions

10. A-P
• The Worst privilege-assignment strategy
– Imagine having to give 1’000 users the same
privileges …
– … to 100 network shares
• Only suitable for … nothing

11. A-G-P
• NEVER assign permissions directly to
accounts
• At least, assign permissions to Global SGs
• Then, gather user Accounts into Gs
• Only suitable for small domains

12. A-G-DL-P
• Good Enough™ for Most organizations
• In principle:
– Gather Accounts into Groups
– Assign Permissions onto Domain Locals
– Associate Groups into Domain Locals
A G DL P

13. A-G-U-DL-P
• Necessary for huge organizations
– Allows assignment of privileges for other ‘trusted’
domains
• Similar to A-G-DL-P, but
– Create Universal SGs spanning multi domains
– Put Global SGs in a domain inside a U
– Then, associate Us in DLs
U
A G DL P
A G DL P

14. SYSVOL
• The mysterious, enigmatic area where important AD
thingies are kept
– Group Policy Objects
– Startup/Shutdown/Logon/Logoff Scripts
– Other small-sized SysAdmin supporting files
• Employs mysterious “Junctions”
– Must be hosted on NTFS
– Please please please for the love of all things holy: Do not delete
any directory in here if you don’t understand its structure
• Automatically replicated to other DCs
– (Except SYSVOL on RODCs – won’t replicate, but will be
overwritten instead)
– FRS on Windows Server 2003, DFSR on Windows Server 2008
– Please do not put anything too big in SYSVOL …
• else, your NetAdmin is going to find you and hurt you…

15. Group Policy Objects
• A method to apply:
– Common restrictions
– Common settings
– Common applications
• Attached to one (or more) “Organizational Units”
• Two kinds of policies
– Machine policies – set on boot-complete
– User policies – set on login
• Machine policies *may* get re-applied when user login
• Can be selectively applied

16. Sites and Subnets
• Active Directory enables the definition of “sites”
– Basically, a grouping of subnets in the enterprise
– Also, a collection of DCs in those subnets
• Features enabled by “sites”
– Definition of replication topology
– Definition of replication connection “costs”
– Custom scheduling of replication
– Nearest-DC (for login, SYSVOL access, etc.)

17. Other Important Things You Should
Know If You Are A Windows
Systems Administrator
• FSMO Roles
• Time Synchronization
• Deployment tools
• Management tools
• Diagnostic tools

18. Tararengkiyu !

19. Sesi Tanya
dan (semoga di-) Jawab