0
Active Directory
Active Directory is a set of networking services made by Microsoft. Questions about using and configuring Active Directory belong here.
849 Questions
What is intersite replication?
Replication between two sites is known as Intersite Replication. Since bandwidth two different sites is usually very limited, so intersite replication is used to manage and control replication traffic.
What is the OU active directory object?
Organisational Unit: A part of Active Directory used to Organise and Manage the objects of AD
An organizational unit (OU) is a subdivision within an Active Directory into which you can place users, groups, computers, and other organizational units. You can create organizational units to mirror your organization's functional or business structure. Each domain can implement its own organizational unit hierarchy. If your organization contains several domains, you can create organizational unit structures in each domain that are independent of the structures in the other domains.
The term "organizational unit" is often called as "OU" in casual conversation. "Container" is also often applied in its place, even in Microsoft's own documentation. All terms are considered correct and interchangeable.
What object of active directory identifies its location within the directory structure?
Distinguished Name{DN)
A DN is a sequence of relative distinguished names (RDN) connected by commas.
An RDN is an attribute with an associated value in the form attribute=value; normally expressed in a UTF-8 string format
DC domainComponent
CN commonName
OU organizationalUnitName
O organizationName
STREET streetAddress
L localityName
ST stateOrProvinceName
C countryName
UID userid
examples of distinguished names.
Distinguished Name{DN)
A DN is a sequence of relative distinguished names (RDN) connected by commas.
An RDN is an attribute with an associated value in the form attribute=value; normally expressed in a UTF-8 string format
DC domainComponent
CN commonName
OU organizationalUnitName
O organizationName
STREET streetAddress
L localityName
ST stateOrProvinceName
C countryName
UID userid
examples of distinguished names.
Distinguished Name{DN)
A DN is a sequence of relative distinguished names (RDN) connected by commas.
An RDN is an attribute with an associated value in the form attribute=value; normally expressed in a UTF-8 string format
DC domainComponent
CN commonName
OU organizationalUnitName
O organizationName
STREET streetAddress
L localityName
ST stateOrProvinceName
C countryName
UID userid
examples of distinguished names.
What is the function of the active directory federation services?
Active Directory Federation Services(AD FS for short) is a software component developed by Microsoft that can be installed on Windows Server operating systems to provide users withSingle Sign-Onaccess to systems and applications located across organizational boundaries. It uses a claims-based access control authorization model to maintain application security and implementfederated identity.
Claims based authentication is the process of authenticating a user based on a set of claims about its identity contained in a trusted token. Such a token is often issued and signed by an entity that is able to authenticate the user by other means, and that is trusted by the entity doing the claims based authentication.
What is the purpose of the Primary Domain Controller on a Windows network?
The server holding the PDC emulator role will cause the most problems if it is unavailable. This would be most noticeable in a mixed mode domain where you are still running NT 4 BDCs and if you are using downlevel clients (NT and Win9x). Since the PDC emulator acts as a NT 4 PDC, then any actions that depend on the PDC would be affected (User Manager for Domains, Server Manager, changing passwords, browsing and BDC replication).
In a native mode domain the failure of the PDC emulator isn't as critical because other domain controllers can assume most of the responsibilities of the PDC emulator.
How do you view replication properties for AD partitions and domain controlers?
Windows Server 2003 introduced the DomainDNSZones application partition, which is replicated to all DCs running the DNS service within a domain (so each domain has its own version of the DomainDNSZones partition) and the ForestDNSZones application partition, which is replicated to all DCs running the DNS service within the entire forest. To determine which directory partitions a DC running DNS is registered as part of the replica set, run the command dnscmd /enumdirectorypartitions which on my system resulted in the following output: Enumerated directory partition list: Directory partition count = 2 DomainDnsZones.savilltech.com Enlisted Auto Domain ForestDnsZones.savilltech.com Enlisted Auto Forest Command completed successfully. This example shows that the DC is enlisted in both the domain (DomainDNSZones) and forest (ForestDNSZones) application partitions. Alternatively, the status could show as "Not-Enlisted Auto Domain/Forest". To add the server to a partition's replica set, use the /enlistdirectorypartition parameter, as this example shows dnscmd /enlistdirectorypartition domaindnszones.savilltech.com Running this command displays the following output: DNS Server . enlisted directory partition: domaindnszones.savilltech.com Command completed successfully. To view all the members of the replica set of a partition, use the ntdsutil command as shown below (enter the commands in bold): ntdsutil ntdsutil: domain management domain management: connection server connections: connect to server savdaldc01 Binding to savdaldc01 ... Connected to savdaldc01 using credentials of locally logged on user. server connections: quit domain management: list Note: Directory partition names with International/Unicode characters will display correctly only if appropriate fonts and language support are loaded Found 6 Naming Context(s) 0 - CN=Configuration,DC=savilltech,DC=com 1 - DC=savilltech,DC=com 2 - CN=Schema,CN=Configuration,DC=savilltech,DC=com 3 - DC=DomainDnsZones,DC=savilltech,DC=com 4 - DC=ForestDnsZones,DC=savilltech,DC=com 5 - DC=child,DC=savilltech,DC=com domain management: list nc replica dc=forestdnszones,dc=savilltech,dc=com The application directory partition dc=forestdnszones,dc=savilltech,dc=com's Replicas are: CN=NTDS Settings,CN=VPC2003ROOTDC2,CN=Servers,CN=Smallville,CN=Sites,CN=Configuration,DC=savilltech,DC=com CN=NTDS Settings,CN=SAVDALDC02,CN=Servers,CN=Smallville,CN=Sites,CN=Configuration,DC=savilltech,DC=com * CN=NTDS Settings,CN=SAVDALDC01,CN=Servers,CN=Smallville,CN=Sites,CN=Configuration,DC=savilltech,DC=com The *'ed items are currently uninstantiated replicas. domain management: list nc replica dc=domaindnszones,dc=savilltech,dc=com The application directory partition dc=domaindnszones,dc=savilltech,dc=com's Replicas are: CN=NTDS Settings,CN=VPC2003ROOTDC2,CN=Servers,CN=Smallville,CN=Sites,CN=Configuration,DC=savilltech,DC=com CN=NTDS Settings,CN=SAVDALDC01,CN=Servers,CN=Smallville,CN=Sites,CN=Configuration,DC=savilltech,DC=com domain management: quit ntdsutil: quit Disconnecting from savdaldc01... The sample code and output first shows starting the domain management functions of the NTDSUTIL command, then connecting to a DC. Next you use the list command to tell ntdsutil to show all the partitions that exist, then to display the members of the forestdnszones replica set and the domaindnszones replica set (for the savilltech.com domain). If the output shows any DCs listed as uninstantiated replicas, it means no replication object is configured to allow the replication of the information. You can force the Knowledge Consistency Checker (KCC) to run to create the replication objects, as needed. To do so, type the command repadmin /kcc and then force replication by running the command repadmin /syncall
What is the file name for the Active Directory Database Where is it located?
Windows 2000 Active Directory data store, the actual database file, is %SystemRoot%\ntds\NTDS.DIT
Disadvantages of active directory in comparison to other directory services?
1. Active Directory is a Flat File Database, and as such does not scale well to distributed locations. On very slow links site replication can take upwards of 4hrs, or fail to complete before next replication which will cause errors.
2. Active Directory fails full LDAP compliance, which limits what open source or 3rd party products can be deployed (as such, costs increase exponentially)
3. Active Directory is OS dependent and cannot be installed on any platform other than Windows server. (This increases licensing costs and reduces reliability).
TO ADD OR CREATE
Dsadd is a command-line tool that is built into Windows Server 2008. It is available if you have the Active Directory Domain Services (AD DS) server role installed. To use dsadd, you must run the dsadd command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.
Dsadd computer:Adds a single computer to the directory
Dsadd contact:Adds a single contact to the directory
Dsadd group:Adds a single group to the directory.
Dsadd ou:Adds a single organizational unit to the directory.
Dsadd user:Adds a single user to the directory
Dsadd quota:Adds a quota specification to a directory partition.
TO MODIFY
Dsmod is a command-line tool that is built into Windows Server 2008. It is available if you have the Active Directory Domain Services (AD DS) server role installed. To use dsmod, you must run the dsmod command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.
Dsmod computer:Modifies attributes of one or more existing computers in the directory.
Dsmod contact:Modifies attributes of one or more existing contacts in the directory.
Dsmod group:Modifies attributes of one or more existing groups in the directory.
Dsmod ou:Modifies attributes of one or more existing organizational units (OUs) in the directory.
Dsmod server:Modifies properties of a domain controller.
Dsmod user:Modifies attributes of one or more existing users in the directory.
Dsmod quota:Modifies attributes of one or more existing quota specifications in the directory.
Dsmod partition:Modifies attributes of one or more existing partitions in the directory.
Does windows 2008 web server support ASP.NET?
yes it does..
Windows Web Server 2008 R2 Edition was designed to be used as a single purpose internet facing web server that delivers rock solid foundation of infrastructure capabilities. It is integrated with the newly re-architected IIS 7.0, ASP.NET, and the Microsoft .NET Framework. Windows Web Server 2008 R2 enables your organization to rapidly deploy webpages, websites, web applications, and web services.
Web and Applications PlatformWindows Web Server 2008 R2 provides your organization with the ability to deliver rich web-based experiences efficiently and effectively, with improved administration and diagnostics, advanced development and application tools, and lower infrastructure costs. Enhancements- Greater technical capacity than the previous versions of Windows Server, and no limitation of Microsoft SQL Server installation.
- Highly effective platform for ASP.NET based Internet web deployments, because it includes the newly re-architected Internet Information Services (IIS) 7.0, Microsoft ASP.NET, and the Microsoft .NET Framework.
- Dedicated web-serving functionality and server roles that support four x64 sockets and 32 gigabytes (GB) of RAM.
- Economical next-generation web server that is competitively priced for enterprise or hosting organizations needing to rapidly deploy webpages, websites, web applications, and web services.
More efficient administration tools, including delegated administration and shared configuration.
Powerful Hosting of Applications and ServicesExpanded application hosting for .NET, ASP, PHP web applications, and XML services; web server extensibility throughout.
Lower Infrastructure CostsImproved scalability and enhanced security and reliability with automatic application sandboxing.
Where can you add additional attributes by modifying the active directory schema?
Adding items to the Schema, also called "extending the Schema", or even modifying existing objects can be a tricky business, and if done without proper knowledge, can be very destructive to your existing Active Directory infrastructure. This is because the Schema is a forest-wide setting, and any additions or changes to the Schema will be immediately replicated to each and every Domain Controller in each and every domain in your AD Forest. You cannot make any changes to the Schema and yet keep it within your domain's boundaries. Furthermore, changing existing attributes (such as configuring an attribute to replicate itself to the Global Catalog) will cause a forest-wide replication of all the attributes and objects, even if your change was just made on one attribute. Note that this behavior was changed in Windows Server 2003, but even so, you might unintentionally cause a major network load and a lot of overhead by simply clicking one one small checkbox on one small attribute.
1.Open the Run command and type:regsvr32 schmmgmt.dll
You should get a confirmation message.
2.Next, open Run and type mmc.exe. Press Enter.
3.In the new MMC window, click File > Add/Remove Snap-in.
4.Click Add, then, in the Add Standalone Snap-in window, select the Active Directory Schema snap-in from the list. Next click Add again.
5.Click Ok.
Windows 2000 only - Enable write operations to the Schema
If you're running Windows 2000-based AD, you'll probably need to allow the Schema to be written. To do so follow these guidelines (only required for W2K-based DC):
1.In the MC window from the previous procedure, under the Console Root, double-click on the Active Directory Schema snap-in and let it load (you'll know when it has loaded when you will see 2 nodes under the root - Classes and Attributes)
2.Right-click Active Directory Schema (your domain controller name) and
Adding 3 new attributes to the Schema
One method of creating new attributes in the Schema is by using the Active Directory Schema snap-in from an MMC.
In order to use this snap-in you must first register it with the command:regsvr32 schmmgmt.dll
Connecting the new attributes to the User Object Class
One method of creating new attributes in the Schema is by using the Active Directory Schema snap-in from an MMC.
In order to use this snap-in you must first register it with the command:regsvr32 schmmgmt.dll
The results
After adding the new attributes we now need to verify their existence and functionality.
What now?
After the new attributes were successfully added to the Schema and we've verified their functionality, we would now like to begin working with these attributes and begin populating their values.
A very simple way to avoid damaging or costly schema mistakes in your production forest is to first test your schema extensions on a test forest. By using a test environment, you can identify any potential problems in your plan before they affect your users and your production environment.
What is the name of the default site link that is created when Active Directory is first installed?
The default link name is Default first site
What are some advantages to using directory services?
Security-Having only one domain means better security through a single security policy and a single set of administrators. If you have multiple domains and forests, each has its own administrator. One weak but trusted domain exposes all the other forests and domains. With only a single domain, it's also far easier to enforce an organization-wide security policy
Single platform - a single directory service or Global Catalog (GC) means a single platform for all other directory-ware services, including monitoring and messaging.
Faster deployment-starts in an organization with just a single domain and shared account database solutions need only be deployed once, which means company-wide deployments are much faster than if the organization has multiple and separate domains.
Single management infrastructure-Having a single management infrastructure means there is just one infrastructure for all other directory services tasks, such as software deployment, inventory, and object managment sharing and delegation (such as for user accounts).
Single Group Policy container (GPC)-With a single GPC, management polices need to be defined only once, and can be used throughout the entire enterprise without the need to manually export and import Group Policy Objects (GPOs).
.
Backup and recovery-Having only a single domain means better resiliency because every location has a full domain backup.
Less hardware-In an organization with multiple domains, every location needs two domain controllers (DCs). With a single domain, each location needs only a single DC because if the local DC fails, the locations can use hub DCs. Reduced hardware also means fewer licenses, less management software, and less overhead for server management. There's also no need to back up remote DCs because the remote DCs just hold the same information as the central DCs-assuming the DCs only perform directory services.
This is really simple. There are probably hundreds of places on the net that tell you how to do this, but the simplest way is to ensure that all of the computers have ethernet cards. Have all of the computers connect to a hub, including the server. Go into the control panel, then networking and setup all of the ethernet cards to support Netbeui. From there, on the server, right click on the folder you want to share and give it a share name. Then right click on my computer on each workstation and select map network drive and use the following pattern to map your drives: \\servername\sharename.
Read this for a more step by step explanation: http://www.hardwarecentral.com/hardwarecentral/tutorials/3/1/
First we understand the concept. windows 2000 proffessional is not the server OS. this is the client OS. for client server technology server must be the server OS like windows 2000 server or NT server. client may be any OS. If u configure windows 2000 professional and win98, this is as the workgroup model. this not the client server technology. this is normal networking in LAN.
What are the security administrative issues addressed by a read only domain controller?
Each RODC will have an analagous group that will prevent users passwords from being stored only on a single DC. Members of the purpose group are not eligible to have their passwords stored on any RODC in the domain
Active directory 2003 and active directory 2008 differences?
One of the really exciting new ones is the concept of the read-only domain controller. Before with AD, as compared with NT 4.0 in particular, every domain controller has a writable copy of your directory. You can make a change anywhere and it will propagate throughout the environment. At the same time, all of [the domain controllers] have secrets like your password. Right now with Windows Server 2003, if that server security is physically compromised and gets stolen and it's not secure, then you have a huge security issue in that all the password for that domain are in the DNCs. So the only approach you can take is to make everyone change their password. That's a big deal if you have 100,000 people on that domain.
With the new read-only domain controller feature, this change is two-fold. First you can now define which passwords are stored locally. Now if the server gets stolen, you only have to have 100 people change their passwords versus 100,000.
Second, you can't make any changes on that domain controller (DC), because it's read only.
1.we can install windows 2008 server either in full version(install all services& applications) or server core(only install minimal required services), but in 2003 we can only install fully O.S.
2.Windows server 2008 use Hyper-V application & Roles concept for better productivity but server 2003 does not have such features.
1)2008 is combination of vista and windows 2003r2. Some new services are introduced in it
1. RODC one new domain controller introduced in it
[Read-only Domain controllers.]
2. WDS (windows deployment services) instead of RIS in 2003 server
3. shadow copy for each and every folders
4.boot sequence is changed
5.installation is 32 bit where as 2003 it is 16 as well as 32 bit, that's why installation of 2008 is faster
6.services are known as role in it
7. Group policy editor is a separate option in ads
2) The main difference between 2003 and 2008 is Virtualization, management.
2008 has more inbuilt components and updated third party drivers Microsoft introduces new feature with 2k8 that is Hyper-V Windows Server 2008 introduces Hyper-V (V for Virtualization) but only on 64bit versions. More and more companies are seeing this as a way of reducing hardware costs by running several 'virtual' servers on one physical machine. If you like this exciting technology, make sure that you buy an edition of Windows Server 2008 that includes Hyper-V, then launch the Server Manger, add Roles.
3) In Windows Server 2008, Microsoft is introducing new features and technologies, some of which were not available in Windows Server 2003 with Service Pack 1 (SP1), that will help to reduce the power consumption of server and client operating systems, minimize environmental byproducts, and increase server efficiency.
Microsoft Windows Server 2008 has been designed with energy efficiency in mind, to provide customers with ready and convenient access to a number of new power-saving features. It includes updated support for Advanced Configuration and Power Interface (ACPI) processor power management (PPM) features, including support for processor performance states (P-states) and processor idle sleep states on multiprocessor systems. These features simplify power management in Windows Server 2008 (WS08) and can be managed easily across servers and clients using Group Policies
What is the Difference between server and domain controller?
Server is a computer which serves files to other users or computers. A server can be a windows XP operating system also, but it does not have any security
Domain controller is a computer which controls other users or computers .A domain controller must have windows 2003 server operating system and need to configure as a domain. It has a Excellent security
Every Active Directory domain should have a minimum of domain controllers?
Its is recommended just because in case of one fails other server can take over the roles and the network does not crash down.
What are the physical components of active directory?
The logical structure of active directory include forest, domains, tree, OUs and global catalogs.
Domain : a group of computer and other resources that are part of a windows server2003 network and share a common directory database.
Global catalog : Global catalog used to catch information about all object in a forest , the global catalog enables users and applications to find object in an active directory domain tree if the user or application knows one or more attributes of the target object.
Tree : Tree as is collection of Active directory Domain, that means the trust relationship can be used by all other domain in the forest as a means to access the domain.
Organization Unit - Organization Unit is a Active directory container into which object can be grouped for per mission management.
Forest : Active directory forest as due to represents the external boundary of the directory service.
These are two types of active directory forest :-
I) Single Forest
2) Multiple forest
A conditional forwarder will forward DNS queries to different servers based on domain name.
What is the difference between inter domain routing and intra domain routing and what are they for?
Routing algorithms that are restricted to only work within the domain are referred as intera-domain routing algorithms and if they are not restricted only within the domains then they are inter-domain algorithms.
What does the sysvol folder stores in an active directory?
The sysVOL folder stores the server's copy of the domain's public files. The contents such as group policy, users etc of the sysvol folder are replicated to all domain controllers in the domain.
The sysvol folder must be located on an NTFS volume The article describes how to use the Burflags registry entry to rebuild each domain controller's copy of the system volume (SYSVOL) tree on all domain controllers in a common Active Directory directory service domain. The term SYSVOL refers to a set of files and folders that reside on the local hard disk of each domain controller in a domain and that are replicated by the File Replication service (FRS).
Network clients access the contents of the SYSVOL tree by using the following shared folders:
What is active directory schema?
All databases have a schema which is a formal definition (set of rules) which govern the database structure and types of objects and attributes which can be contained in the database. The schema contains a list of all classes and attributes in the forest.
The schema keeps track of:
- Classes
- Class attributes
- Class relationships such as subclasses (Child classes that inherit attributes from the super class) and super classes (Parent classes).
- Object relationships such as what objects are contained by other objects or what objects contain other objects.
There is a class Schema object for each class in the Active Directory database. For each object attribute in the database, there is an attributeSchema object.
PartitionsActive Directory objects are stored in the Directory Information Tree (DIT) which is broken into the following partitions:
- Schema partition - Defines rules for object creation and modification for all objects in the forest. Replicated to all domain controllers in the forest. Replicated to all domain controllers in the forest, it is known as an enterprise partition.
- Configuration partition - Information about the forest directory structure is defined including trees, domains, domain trust relationships, and sites (TCP/IP subnet group). Replicated to all domain controllers in the forest, it is known as an enterprise partition.
- Domain partition - Has complete information about all domain objects (Objects that are part of the domain including OUs, groups, users and others). Replicated only to domain controllers in the same domain.
- Partial domain directory partition - Has a list of all objects in the directory with a partial list of attributes for each object.
The DIT holds a subset of Active Directory information and stores enough information to start and run the Active Directory service
