Download to read offline
Uploaded byRafał Kucharski
Active directoryfinal
This document discusses Microsoft Active Directory (AD), a directory service that centrally manages network resources and users. AD utilizes a distributed architecture that replicates information across domain controllers to provide redundancy and availability. Key features of AD include integrating with DNS, providing user and resource management capabilities, and supporting authentication. The document also provides an example of how AD was implemented at a company to reduce IT costs and improve security. Open directory services from Apple are mentioned as an open source alternative to AD.
Active directoryfinal
- 1. Microsoft Active Directory(AD) A presentationby Robert, Jasmine, Val and Scott IMT546 December 11, 2004
- 2. What are directoryservices? All Directory services use a hierarchical structure that stores information about objects on the network. What differentiates the various implementations are the types of objects that they track.
- 3. What objects aretracked via Directory Services? • Shared Resources: – – – – Servers, Shared volumes, Printers; Applications • Administration of: – – – – Users User/Group access Network resources Management of domains, applications, services, security policies, and just about everything else in your network.
- 4. Directory Services Common Features: •Provide file shares • Authenticate users • Provide services, such as Email, Access to the internet, Print services etc. • Control access to services and shares.
- 5. Key Features ofActive Directory • AD as a namespace that is integrated with the Internet's Domain Name System (DNS). • AD - A new directory service central to the Windows 2000 Server operating system, runs only on domain controllers. Some directory services are integrated with an operating system, and others are applications such as e-mail directories. Operating system directory services, such as AD, provide user, computer, and shared resource management.
- 6. Active Directory utilizesa distributed architecture • Active Directory, in addition to providing a place to store data and services to make that data available, also protects network objects from unauthorized access and replicates information about objects across the entire network so that information about objects is not lost if one domain controller fails.
- 7. Terminology • Site: Asite is a physical location, or LAN. This is different from a web site, which is an organization’s internet presence. • Domain: – (1) A sub-network comprised of a group of clients and servers under the control of one security database. Dividing LANs into domains improves performance and security. – (2) All resources under the control of a single computer system.
- 8.
- 9. Basic Network IdentityServices – – – – – – – Dynamic Host Configuration Protocol (DHCP) Domain Name System (DNS) Lightweight Directory Access Protocol (LDAP) Public Key Infrastructure (PKI) Remote Authentication Dial-In User Service (RADIUS) Microsoft's Active Directory Novell Directory Services (NDS)
- 10. Identity Service Providers SERVICESPECIFICS • Most mid-sized to large enterprises today are likely to run about a half dozen network identity services to connect their business applications and network infrastructure. • These services each have specific roles to play in the network. But they often also interact with one another, too. • Network identity services each perform specific tasks and also frequently interact. Managing interactions becomes challenging when multiple internal organizations administer the various services, which may be duplicated in numerous locations throughout the network and use different data stores.
- 11. DNS Domain Name System •DNS is a globally distributed database that manages IP addresses on the internet. • DNS uses a hierarchy of domains on the internet. – Top level domains use the familiar names like .com, .edu, .gov. – The second level are registered to organizations who have a presence on the web. Active Directory is designed to exist within the scope of the Global DNS Namespace.
- 12.
- 13. LDAP • Lightweight DirectoryAccess Protocol (LDAP) -- a protocol used to access a directory service. • Lightweight Access Directory Protocol is the primary access protocol for Active Directory.
- 14. Active Directory's Global Catalog •The global catalog is the mechanism that tracks all of the objects managed across the network, across all domains within the organization. • Elements of the catalog are replicated across all of the domain controllers within all domains across the org.
- 15. Global Catalog -ServiceDiscovery • For Active Directory to function properly, DNS servers must support Service Location (SRV) resource records. • SRV resource records map the name of a service to the name of a server offering that service. Active Directory clients and domain controllers use SRV resource records to determine the IP addresses of domain controllers.
- 16. Domain authority • ActiveDirectory replicates its administration information across domain controllers throughout the “forest” utilizing a “multi-master” approach. • Multi-master replication among peer domain controllers is impractical for some types changes, so only one domain controller, called the operations master, accepts requests for such changes.
- 17. Authentication • Each domaincontroller has information for the entire forest to support authentication and access control. • This provides the ability for local domain controllers (the “tree”) to provide a quick local lookup of authority. • Not just users but every object authenticating to Active Directory must reference the global catalog server, including every computer that boots up
- 18. An example ofan Active Directory implementation PING North America Benefits from using Active Directory • Reduced one IT staff member’s workload by 40 percent, freeing 800 hours per year to work on new projects • Significant cost savings due to server consolidation and elimination of mainframe and NetWare • Increased security and stability through centralized desktop management • Active Directory also gives PING a single repository for all types of information. Source: Microsoft
- 19. Time Savings Before • PCs thatwere still running Windows NT Workstation or Windows 98, it would take as much as 40 hours of effort to manually visit each desktop and install the patch. After • Desktops that are running Windows XP Professional, A group policy can be created that will push a new security patch out to all of them in less than 30 minutes.
- 20. Repository of Information Before • Spreadsheetshad to be created and spreadsheets maintained for user locations, office numbers, phone numbers etc. After • All of the information is now managed in a single place and is updated using a single interface.
- 21. Increased Security • Since ActiveDirectory will provide a single point of management for all systems. Desktops can be locked down in a known, secure state and kept current with software updates and security patches with minimal time and effort.
- 22.
- 23. Mac OS XServer v10.3 Open Directory 2 • The latest version of Apple’s standards-based directory and authentication services architecture. • The Open Directory architecture makes it easy to integrate Mac OS X client and server systems to into your existing network infrastructure. It’s compatible with other standards-based LDAP servers, and can even plug into environments that use proprietary services such as Microsoft’s Active Directory and Novell’s eDirectory.
- 24. Open Directory Features: •Support for mixed-platform environments • Strong authentication options -Kerberos • Reliability and scalability -
- 25. References: • • • • • • Mac Os XOpen Directory: http://www.apple.com/server/macosx/open_directory.html Microsoft Active Directory: http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory /deploy/projplan/adarch.mspx Ping: http://www.microsoft.com/resources/casestudies/CaseStudy.asp?CaseStudyID=15304 General: http://www.microsoft.com Gaining Control of Your network Identity infrastructure… http://www.bitpipe.com/detail/RES/1082474885_246.html
Editor's Notes
- #10 Network Identity services are used to access user credentials, access rights, and permissions. They are basically designed to link business applications to physical network devices.
- #11 Any mix of network identity services might be present in your enterprise, depending on the preferences of personnel in charge of application servers and network infrastructure equipment. DNS &LDAP
- #12 The server locates host computers by converting names that users enter into IP addresses that computers use to communicate. Hierarchy of domains basically makes the internet in one big Namespace.
- #14 DNS helps you find the computer that you are trying to locate and tells the domain controller what kind of services the computer offers. Such as print and files services and applications.
- #15 Active directory’s Domain Controllers act as PEERS. Each domain controller can host only one domain (possibly a site, portions of a site, or multiple sites) The global catalog is administered on a single domain controller called the OPERATIONS MASTER, but relevant information from that is propagated to all of the domain controllers across the organization.
- #16 The operations master periodically queries each domain controller across the organization to keep the global catalog up to date on the services currently available in any given domain. It uses DNS, and LDAP to discover services run by other servers across the network. The OPERATIONS MASTER then sends this information in a condensed format to each domain controller on the network. Active Directory is designed specifically to work with DNS. SRV files are Described in the Internet Engineering Task Force (IETF) Internet Draft called draft-ietf-dnsind-rfc2052bis-02.txt, "A DNS RR for specifying the location of services (DNS SRV)". (Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups.)
- #17 Since all domain controllers are PEERS, they have been given the same information by the OPERATIONS MASTER. System administrators can give some of their administrative functions to regular users if the choose to, to enable people like HR representatives to reset passwords, or edit group membership. As object (user account, group membership) status is modified by people with administrative privileges anywhere on the network, that information is modified directly on the OPERATIONS MASTER, and then propagated to the rest of the domain controllers. This means there is a single machine that handles all administrative changes centrally, then distributes the modified picture of to all of the other domain controllers as soon as the changes are made. Most medium to large companies would have backup/redundant operations master machines, so if one went down, another machine would take on that role.
- #18 So what the client pc’s or end users mostly see is the interaction with their local domain controller. The distributed nature of all authentication information means that users would be able to log in at any site and access the resources they have rights to, whether its their main office or an office across the country. I’m going to hand it over to Robert who will now cover a real-world implementation of Active Directory
- #23 We looked for open source implementation of Active Directory, or similar directory services. Its not like Microsoft would allow anyone to use the name Active Directory in an open source project so we had to read between the lines to find anything
- #24 What we found was that Mac OS provides a similar service to Active Directory
- #25 They have integrated a number of open source projects to create Open Directory, using OpenLdap, Berkeley Database for object management, an Kerberos for security The Open Directory architecture allows Mac OS X Server to work seamlessly in virtually any managed network environment. Using the built-in directory access modules, Mac OS X Server can read and write data stored in any LDAP server — even Microsoft’s proprietary Active Directory. The server can also access records in legacy directories such as NIS, NetInfo, and local BSD configuration files (/etc).
- #26 Any Questions?