0
Active Directory
Active Directory is a set of networking services made by Microsoft. Questions about using and configuring Active Directory belong here.
849 Questions
How do you get to the Internet if it's not avalible?
If it isn't available, you don't. If it isn't available through your network connection, then find a device in another network that does have a connection.
Who created a user account in Active Directory?
In domain the adminstrator/ admin group/enterprise admin has rights to create user.
What policy setting is set to audit successes in the Default Domain Controllers GPO?
account management events
What master database contains definitions of all objects in the Active Directory?
The NTDS.DIT
This is the main AD database. NTDS stands for NT Directory Services. The DIT stands for Directory Information Tree. The Ntds.dit file on a particular domain controller contains all naming contexts hosted by that domain controller, including the Configuration and Schema naming contexts. A Global Catalog server stores the partial naming context replicas in the Ntds.dit right along with the full Domain naming context for its domain.
Windows 2000 Active Directory data store, the actual database file, is %SystemRoot%\ntds\NTDS.DIT. The ntds.dit file is the heart of Active Directory including user accounts. Active Directory's database engine is the Extensible Storage Engine ( ESE ) which is based on the Jet database used by Exchange 5.5 and WINS. The ESE has the capability to grow to 16 terabytes which would be large enough for 10 million objects. Back to the real world. Only the Jet database can maniuplate information within the AD datastore.
For information on domain controller configuration to optimize Active Directory, see Optimize Active Directory Disk Performance
The Active Directory ESE database, NTDS.DIT, consists of the following tables:
* Schema table
the types of objects that can be created in the Active Directory, relationships between them, and the optional and mandatory attributes on each type of object. This table is fairly static and much smaller than the data table.
* Link table
contains linked attributes, which contain values referring to other objects in the Active Directory. Take the MemberOf attribute on a user object. That attribute contains values that reference groups to which the user belongs. This is also far smaller than the data table.
* Data table
users, groups, application-specific data, and any other data stored in the Active Directory. The data table can be thought of as having rows where each row represents an instance of an object such as a user, and columns where each column represents an attribute in the schema such as GivenName.
From a different perspective, Active Directory has three types of data
* Schema information
definitional details about objects and attributes that one CAN store in the AD. Replicates to all domain controllers. Static in nature.
* Configuration information
configuration data about forest and trees. Replicates to all domain controllers. Static as your forest is.
* Domain information
object information for a domain. Replicates to all domain controllers within a domain. The object portion becomes part of Global Catalog. The attribute values (the actual bulk of data) only replicates within the domain.
Although GUIDs are unique, they are large. AD uses distinguished name tag ( DNT ). DNT is a 4-byte DWORD value which is incremented when a new object is created in the store. The DNT represents the object's database row number. It is an example of a fixed column. Each object's parent relationship is stored as a parent distinguished name tag ( PDNT ). Resolution of parent-child relationships is optimized because the DNT and PDNT are indexed fields in the database. For more technical info on the AD datastore and its organization, a good starting point is the Active Directory Database Sizing document.
The size of ntds.dit will often be different sizes across the domain controllers in a domain. Remember that Active Directory is a multi-master independent model where updates are occuring in each of the ADs with the changes being replicated over time to the other domain controllers. The changed data is replicated between domain controllers, not the database, so there is no guarantee that the files are going to be the same size across all domain controllers.
Account
Linking
In Server 2003 domian security policy helps you to set Password Protection..
1)Password length
2)Password Complexity
3)Password Age (min age & max age)
In Server 2003 domian security policy helps you to set Password Protection..
1)Password length
2)Password Complexity
3)Password Age (min age & max age)
Default and Recommended Password Policy Settings
===============================================
Policy Default Recommended Comments
Enforce password history
24 passwords remembered
(No change)
Prevents users from reusing passwords.
Maximum password age
42 days
(No change)
N/A
Minimum password age
1 day
(No change)
Prevents users from cycling through their password history to reuse passwords.
Minimum password length
7 characters
(No change)
Sets minimum password length.
Password must meet complexity requirements
Enabled
(No change)
For the definition of a complex password, see "Creating a Strong Administrator Password" in the Establishing Secure Domain Controller Build Practices section.
Store password using reversible encryption
Disabled
(No change)
N/A
Default and Recommended Account Lockout Policy Settings
======================================================
Policy Default Recommended Reason
Account lockout duration
Not defined
0 minutes
The value 0 means that after account lockout an Administrator is required to reenable the account before account lockout reset has expired.
Account lockout threshold
0 invalid logon attempts
20 invalid logon attempts
The value 0 means that failed password tries never cause account lockout.
Because an account lockout duration of 0 minutes (administrator reset) is recommended, a small number for this setting can result in frequent administrator interventions.
Reset account lockout counter after
Not defined
30 minutes
This setting protects against a sustained dictionary attack by imposing a nontrivial delay after 20 unsuccessful attempts.
Default and Recommended Kerberos Policy Settings
================================================
Policy Default Recommended Comments
Enforce user logon restrictions
Enabled
(No change)
N/A
Maximum lifetime for service ticket
600 minutes
(No change)
N/A
Maximum lifetime for user ticket
10 hours
(No change)
N/A
Maximum lifetime for user ticket renewal
7 days
(No change)
N/A
Maximum tolerance for computer clock synchronization
5 minutes
(No change)
Maximum tolerance between the client's and server's clocks.
How many Domain Controllers can you have when using Microsoft SBS?
One, you may join other member servers but you may only have one domain controller.
Windows Embedded CE resolves host names into IPv6 addresses via queries to a DNS or WINS server, or via IPv6 link local multicast. Queries sent to DNS servers are performed over IPv6 and IPv4. Queries sent to WINS servers are performed over IPv4 even though they may return IPv6 addresses.
To use a host name as an alias for an IPv6 address, you must ensure that the name is unique and that it resolves to the correct IPv6 address. For IPv6 name-to-address entries, the IPv6 address is written by using standard colon-hexadecimal format. For more information, see IPv6 Addresses.
When using the getaddrinfo function, dual stack name resolution occurs. Domain names are resolved by sending DNS name queries to a configured DNS server. This is a computer that either stores domain name-to-IPv6 address mapping records or has records of other DNS servers. The DNS name resolution may yield both IPv4 and IPv6 addresses.
The DNS server resolves the queried domain name to an IPv4 or IPv6 address and returns the results. When configured for DHCP, the DHCP server provides IPv4 addresses of DNS and WINS servers used for both A and AAAA searches.
The DNS client in Windows CE .NET 4.1 and later also supports the processing of AAAA (quad-A) resource records. The Internet Protocol (TCP/IP)must be configured with the IPv4 address of a DNS server.
The Host name is resolved to an address by a DNS, WINS, or Link Local Multicast Name Resolution (LLMNR) resolver
After installation of active directory where do the user files get saved?
User files are never created during dc promotion, only database file is created at default %systemroot%\ntds.dit ntds.ini is created during the promotion of the dcpromo
What zones are stored in active directory?
Primary zone: This is the only zone type that can be edited or updated because the data in the zone is the original source of the data for all domains in the zone. Updates made to the primary zone are made by the DNS server that is authoritative for the specific primary zone. You can also back up data from a primary zone to a secondary zone.
Secondary zone: A secondary zone is a read-only copy of the zone that was copied from the master server during zone transfer.
Active Directory-integrated zone: An Active Directory-integrated zone is a zone that stores its zone data in Active Directory. DNS zone files are not needed. This type of zone is an authoritative primary zone. Zone data of an Active Directory-integrated zone is replicated during the Active Directory replication process. Active Directory-integrated zones also enjoy the security features of Active Directory.
Stub zone: A stub zone is a new Windows Server 2003 feature. Stub zones only contain those resource records necessary to identify the authoritative DNS servers for the master zone.
as well underscore zone _msdcs
Can Domains have many primary domain controllers?
No the reason it's called a primary Domain Controller is because it's the one controller that has all the domain names and address for that Domain.
What was the size of a big computer server in the 60's?
The most common computer in the 1960's was the ENIAC, it took up 680 square feet.
How do Active directory sites affect replication?
Active directory site replication occurs by using a KCC, Which is in avery site and creates a repliation topolgy to replicate the data from one domain to other domain and it uses RPC protocol to replicate data.
Thanks
Santosh Rawat
How do you join a Linux computer to a domain group?
First, make sure kerberos is installed:
# rpm -qa | grep krb
this should return at least 3 packages: krb5-devel, krb5-libs and krb5-workstation
Next, make sure the ldap development libraries are installed:
# rpm -qa | grep ldap-devel
If either of these returns nothing, you'll need to install them - which you can do from the Redhat CD.
make sure there's an entry for your active directory DC in your /etc/hosts file:
1.2.3.4 addc.example.com addc
Next, edit your /etc/krb5.conf to match your site. Everything should be fairly self-explanitory - and everything is case sensitive. Do not comment this file.
Once you've gotten to this point, you can try:
# /usr/kerberos/bin/kinit user@DOMAIN.COM
replacing *user* with a real user and DOMAIN.COM with a real domain (which must be UPPERCASE). If things are working, you'll be prompted for a password. If you enter the correct password, you'll come back to a bash shell, if not, you should be presented with:
"kinit(v5): Preauthentication failed while getting initial credentials"
or some such.
Note: If the clock time on the Linux machine is more than 5 minutes off from the time on the windows machine no ticket information will work. There are three wys to deal with this:
1. Have the Linux server act as a network time server, with the windows machine as a client
2. Have the windows machine act as a time server for the Linux client
3. Make both systems pull the time from the same 3rd server ( some are listed here - http://ntp.isc.org/bin/view/Servers/NTPPoolServers )
Next, uninstall samba if it's installed:
# rpm -e samba
get the latest version of samba:
$ wget "http://us1.samba.org/samba/ftp/samba-latest.tar.gz" things to do
{
01.$ tar -zxvf samba*.tar.gz
02.
03.$ CD samba-3.0.13
04.
05.$ ./configure --prefix=/usr/local/samba --with-ldap --with-ads --with-krb5 --with-pam --with-winbind
06.
07.# make && make install }
In your smb.conf:
netbios name = LINUX_SERVER_NAME
realm = DOMAIN.COM
ads server = 123.123.123.123
security = ADS
encrypt passwords = yes
start samba:
# /etc/RC.d/init.d/smb start
To add the Linux computer to the AD, you need to log into the DC and add it as a user with such privledges, so (from the Linux system):
# /usr/local/samba/bin/net ads join -U Administrator
it should prompt you for Administrator's password. Note that Administrator should be a user with the right to add a computer to the AD.
you should see something like:
Joined 'LINUX_MACHINE_NAME' to realm 'DOMAIN.COM'
To verify this worked, go to the windows DC and open Active Directory->Users and Computers and look for your Linux machine to be listed there.
That's all you absolutely need to connect to the AD. If you want to map users to the AD (which is probably why you're doing this), open /etc/nsswitch.conf and change this:
passwd: files
shadow: files
group: files
to this:
passwd: compat winbind
shadow: compat
group: compat winbind
start the winbind daemon:
# winbindd
make sure it's running:
# PS -ae | grep winbindd
if nothing gets returned, you probably didn't configure samba with kerberos and ldap support. If it shows winbindd running, you're all set. To make sure everything starts on reboot:
open /etc/RC.d/init.d/smb and /etc/RC.d/init.d/winbindd and make sure the line:
# chkconfig: 345 NN NN
exixts (NN will be different numbers pertaining to priority), it should be on line 3 of both files. if these lines don't exist, add them. If they read:
# chkconfig: - NN NN
change the - to 345
save and close those files and run chkconfig:
# chkconfig smb reset
# chkconfig winbindd reset
you can check the runlevels they will start at with
# chkconfig smb --list
# chkconfig winbindd --list
in your smb.conf [global] section: (for name resolution)
Code:
wins support = Yes
name resolve order = wins lmhosts hosts bcast
wins server = wins_server_ip_address
01. wins support = Yes
02. name resolve order = wins lmhosts hosts bcast
03. wins server = wins_server_ip_address
What is the function of a LDAP port?
An LDAP (Lightweight Directory Access Protocol) port is simply an application for distributing, accessing, and maintaining information through an IP (Internet Protocol).
Active Directory Latency
If you are asking this question because you go to ITT tech the answer they are looking for is "convergence".
My sediments excactly! It's on p. 63, Lesson 3. A lot of these need to be corrected...(Mr. ITT student)
Read Only
I called my insurance company related to "vehicle rating group". They told me various makes and models are rated by the IRG (Insurance Rating Group) based on their safety statistics, e.g. if a certain make, model and year vehicle is involved in a proportionately higher number of accidents, the comprehensive and collision portion of your rate is increased.
What are the advantages and disadvantages of hydroponics?
Hydroponics has taken plant cultivation to the next level. In fact, people who were never interested in gardening or growing plants are now doing so, simply because they are intrigued by the concept of growing plants without soil.
But, what are the advantages and the disadvantages of hydroponics cultivation?
Lets take a look at the advantages of growing plants using hydroponics cultivation technique. There are quite a few benefits that comes with growing plants in soilless culture like:
- Less space required
- Less growing time required
- Labor and garden maintenance is reduced
- Water conservation
- Nutrients are recyclable
- Save money by recycling nutrients
- Pest, weed, and disease problems can be controlled easier
- Plants grown hydroponically avoids soil borne pests
- More control over the plants rooting environment (Easily manipulate the root zone's temperature, humidity, darkness, et).
- Higher and better quality Yields
Although hydroponics is probably the future norm of plant cultivation, it still has its disadvantages, including:
- High set up cost
- Growers require skill and knowledge to maintain optimum production in commercial applications
- Because each plant in a hydroponics system is sharing the exact same nutrient, diseases and pests can easily affect each plant.
- Plants react quicker to changes in the environment, however, if this change is for the worst, plants will quickly react to it; showing signs of deficiency or trouble.
- Hot weather and limited oxygenation may limit production, and can result in lost crops
- Needs constant supervision from the grower.
As with most things, it's important to understand the advantages and disadvantages of hydroponics. This will allow you to make informed decisions on what application is "right" for your individual requirements.
AnswerThis may be a more efficient method of growing food on long space journeys, in future space stations or on other planets.For more information visit advancednutrients.com
Zone has only the bare necessities for DNS functions?
The Domain Name System (DNS) is basically a large database which resides on various computers and it contains the names and IP addresses of various hosts on the internet and various domains. The Domain Name System is used to provide information to the Domain Name Service to use when queries are made. The service is the act of querying the database, and the system is the data structure and data itself. The Domain Name System is similar to a file system in Unix or DOS starting with a root. Branches attach to the root to create a huge set of paths. Each branch in the DNS is called a label. Each label can be 63 characters long, but most are less. Each text word between the dots can be 63 characters in length, with the total domain name (all the labels) limited to 255 bytes in overall length. The domain name system database is divided into sections called zones. The name servers in their respective zones are responsible for answering queries for their zones. A zone is a subtree of DNS and is administered separately. There are multiple name servers for a zone. There is usually one primary nameserver and one or more secondary name servers. A name server may be authoritative for more than one zone.
DNS names are assigned through the Internet Registries by the Internet Assigned Number Authority (IANA). The domain name is a name assigned to an internet domain. For example, mycollege.edu represents the domain name of an educational institution. The names microsoft.com and 3Com.com represent the domain names at those commercial companies. Naming hosts within the domain is up to individuals administer their domain.
Access to the Domain name database is through a resolver which may be a program or part of an operating system that resides on users workstations. In Unix the resolver is accessed by using the library functions "gethostbyname" and "gethostbyaddr". The resolver will send requests to the name servers to return information requested by the user. The requesting computer tries to connect to the name server using its IP address rather than the name.
The zone has all the essential and required records to help the dns server resolve the network queries to resolve ip to FQD and vice versa records like ns,soa, unscore zone etc contains all the information about the network.
Replication between two sites is known as Intersite Replication. Since bandwidth two different sites is usually very limited, so intersite replication is used to manage and control replication traffic.
The enterprise admin.
Enterprise Admins (only appears in the forest root domain)
Members of this group have full control of all domains in the forest. By default, this group is a member of the Administrators group on all domain controllers in the forest. By default, the Administrator account is a member of this group. Because this group has full control of the forest, add users with caution.
Access this computer from the network; Adjust memory quotas for a process; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Enable computer and user accounts to be trusted for delegation; Force shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Allow log on locally; Manage auditing and security log; Modify firmware environment values; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
The number of elements of a principal ideal domain can be?
The number of elements of a pid may be finite or countably infinite...or infinite also....but a finite field is always a pid
