Publicité
Check these out next
Zarządzanie użytkownikami i komputerami w firmie - dlaczego warto znać Active Directory
1 Jul 2014•0 j'aime•1,280 vues
1 j'aime
Soyez le premier à aimer ceci
afficher plus
vues
Nombre de vues
0
Sur Slideshare
0
À partir des intégrations
0
Nombre d'intégrations
0
Télécharger pour lire hors ligne
Signaler
Technologie
Dlaczego warto podnosić kwalifikacje i poznać Active Directory, krótkie wprowadzenie do AD
Konrad SagalaSuivre
Architekt Systemów IT à APN Promise S.A.Publicité
Publicité
Publicité
Recommandé
![[PL] PRUG Luty 2022 - Service objecty to za mało - jak żyć z Railsami?](https://public.slidesharecdn.com/_next/static/media/rec_thumb_placeholder.82109866.jpeg)
[PL] PRUG Luty 2022 - Service objecty to za mało - jak żyć z Railsami?Andrzej Krzywda
Data Tier ApplicationsMariusz Koprowski
1st Silesian Code Camp - Czy jesteśmy gotowi na SQL Azure?Tobias Koprowski
Nowości Windows Azurepbubacz
Sql Dla Administratora i Deweloperanexik
20060416 Azure Boot Camp 2016- Azure Data Lake Storage and AnalyticsŁukasz Grala
Zarządzanie użytkownikami i komputerami w firmie - dlaczego warto znać Active Directory
- Zarządzanie użytkownikami i komputerami w firmie - dlaczego warto znać Active Directory Konrad Sagała Exchange MVP Architekt Systemów IT w APN Promise S.A.
- Kariera w IT
- Kariera w IT - kompetencje IT – Nauka całe życie Obszary Wyboru Zarządzanie systemami Wsparcie użytkowników Programowanie Testowanie Bazy Danych Projektowanie stron webowych …
- Zarządzanie komputerami i użytkownikami w firmie – usługi katalogowe Identyfikacja zasobów Spójny sposób zarządzania: Nazwami Lokalizacjami Prawami dostępu Bezpieczeństwem Usługami
- Zarządzanie komputerami i użytkownikami w firmie - narzędzia Usługi katalogowe Active Directory OpenLDAP eDirectory Lotus Domino Oracle Internet Directory
- Wprowadzenie do Active Directory Domain Services Omówienie podstaw AD DS Kontrolery domeny w Windows Server
- Omówienie podstaw AD DS Podstawy AD DS Czym są domeny AD DS? Czym są jednostki organizacyjne (OU)? Czym jest las AD DS? Czym jest schemat AD DS?
- Podstawy AD DS Komponenty fizyczne Komponenty logiczne • Data store • Domain controllers • Global catalog server • RODC • Partitions • Schema • Domains • Domain trees • Forests • Sites • OUs AD DS składa się z komponentów logicznych i fizycznych
- Czym są domeny AD DS? • AD DS wymaga co najmniej jednego kontrolera domeny • Wszystkie kontrolery domeny przechowują kopię bazy danych domeny, która jest na bieżąco synchronizowana • Domena jest kontekstem, w ramach którego są tworzone komputery, grupy i użytkownicy • Domena ogranicza zasięg replikacji • Zalecane narzędzie do tworzenia i konfiguracji obiektów to Administrative Center • Dowolny kontroler domeny uwierzytelnia logowanie do domeny
- Czym są OUs? Organizational Units • Kontenery do grupowania obiektów w ramach domeny • OU tworzymy do: • Delegacji uprawnień administracyjnych • Aplikowania zasad grupowych (Group Policy)
- Czym jest las AD DS? adatum.com Tree Root Domain Forest Root Domain atl.adatum.com fabrikam.com
- Czym jest schemat AD DS? Schemat Active Directory definiuje atrybuty i klasy używane do opisu obiektów: • Attributes • objectSID • sAMAccountName • location • manager • department • Classes • User • Group • Computer • Site
- Kontrolery domeny w Windows Server 2012 Czym jest Kontroler Domeny? Czym jest Global Catalog? Proces logowania do AD DS Demonstracja: Rekordy SRV w DNS Czym są FSMO?
- Czym jest kontroler domeny? Kontrolery domeny • Serwery utrzymujące kopie bazy Active Directory (NTDS.DIT) i SYSVOL • Usługa uwierzytelniania Kerberos oraz usługa KDC • Dobre praktyki: • Dostępność: Co najmniej dwa kontrolery domenowych w domenie • Bezpieczeństwo: RODC i BitLocker
- Czym jest Global Catalog? Domain B Domain A Configuration Schema Domain A Configuration Schema Domain B Configuration Schema Domain B Configuration Schema Global catalog: Przechowuje częściowe zestawy atrybutów dla innych domen w lesie. Pozwala wyszukiwać obiekty w całym lesie Global catalog server
- Proces logowania do AD DS DC1 SVR1WKS1 Proces logowania: 1. Konto użytkownika jest uwierzytelnianiane na DC1 2. DC1 zwraca TGT do klienta 3. Klient używa TGT żeby uzyskać dostęp do WKS1 4. DC1 zezwala na dostęp do WKS1 5. Klient używa TGT żeby uzyskać dostęp do SVR1 6. DC1 zezwala na dostęp do SVR1
- Czym są FSMO? W topologii multimaster, niektóre operacje muszą być wykonywane w jednym miejscu, serwery takie opisywane są w dokumentacji kilkoma nazwami: • Operations master (lub operations master roles) • Single master roles • FSMOs Role • Forest: • Domain naming master • Schema master • Domain: • RID master • Infrastructure master • PDC Emulator master
- Instalacja kontrolera domeny Instalacja poprzez Server Managera Instalacja na Server Core Windows Server 2012 Uaktulanienie kontrolera ze starszej wersji systemu Instalacja kontrolera domeny z użyciem opcji Install from Media Klonowanie wirtualnych kontrolerów domeny
- Instalacja poprzez Server Managera
- Instalacja kontrolera na Server Core Używamy poleceniadcpromo /unattend:”D:answerfile.txt”. Poniżej przykładowy plik: [DCINSTALL] UserName=<Konto administracyjne w domenie, gdzie dodajemy kontroler> UserDomain=<Nazwa domeny> Password=<Hasło domenowe dla konta, którego używamy do promocji kontrolera> SiteName=<Nazwa site’u AD DS, do którego dodajemy kontroler> Site musi być utworzony wcześniej w przystawce Dssites.msc. ReplicaOrNewDomain=replica ReplicaDomainDNSName=<Pełna nazwa (FQDN) domeny, do której dodajemy dodatkowy kontroler> DatabasePath="<Ścieżka do katalogu na lokalnym dysku>" LogPath="<Ścieżka do katalogu na lokalnym dysku>" SYSVOLPath="<Ścieżka do katalogu na lokalnym dysku>" InstallDNS=yes ConfirmGC=yes SafeModeAdminPassword=<Hasło adminsitracyjne dla trybu offline> RebootOnCompletion=yes
- Instalacja z użyciem opcji Install from Media
- Dziękuję za uwagę
Notes de l'éditeur
- Do not spend too much time on each topic. Remember that this is a class on Windows Server® 2012, and not a class on AD DS.
- Go through the list of physical and logical components. Offer brief descriptions of each. Physical Components Data store. Stores the AD DS information. This is a file on each domain controller. Domain controllers. Contain a copy of AD DS database. Global catalog servers. Host the global catalog, which is a partial, read‑only copy of all the domain naming contexts in the forest. A global catalog speeds up searches for objects that might be attached to other domain controllers in the forest. Read‑only domain controllers (RODCs). A special install of AD DS in a read‑only form. These are often used in branch offices where security and IT support are often less advanced than in the main corporate centers. RODCs are sometimes installed in Server Core installations and can be secured by using Windows® BitLocker Drive Encryption. Logical Components Partitions. The partitions that exist in AD DS, which are: domain partition, configuration partition, schema partition, global catalog, and application partitions. Schema. Defines the list of attributes that all objects in the AD DS can have. Domains. Logical, administrative boundary for users and computers Domain Trees. Collection of domain controllers that share a common root domain. Forests. Collections of domains that share a common AD DS. Sites. Collections of users, groups, and computers as defined by their physical locations. Useful when you plan administrative tasks such as replication of the AD DS. Organizational Units (OUs). Containers in AD DS that provide a framework for delegating administrative rights and for linking Group Policy Objects (GPOs). Emphasize that the OU structure does not necessarily match the organizational chart, but should be designed to meet the administrative requirements for each situation.
- Establish clearly to students the difference between OUs and containers: explain that containers are not OUs. Although they can hold objects, they cannot have GPOs linked to them, so it is necessary to move the objects into OUs that need to be managed. Examples are user accounts, computer accounts, and groups. Remind students that usually the OU structure would not match the organizational chart, but would be designed to support the delegation of administration, and should be a framework to support the linking of GPOs. In a large organization, with for example 50,000 users and computers, it would be much more manageable to divide those objects into OUs. Discuss some of the criteria that might drive the OU structure design, such as geographical location, department, object type, and cost center.
- Use this slide to illustrate the different relationships of a child domain or another tree, but emphasize that there is no administrative difference between the two options, apart from the names.
- Reinforce the concept that the schema defines the rules and syntax of the AD DS database, and provides the blueprint for any objects that can be created in it. If you think that your students are having trouble understanding this concept, you could use this analogy or something similar: In a restaurant, there is a burger and a cheeseburger on the menu. If you order one of these, there are certain mandatory components, or attributes, and additional optional extras, as shown in the following table. In a similar way, the schema defines the objects that reside in the AD DS database, and defines the mandatory and optional attributes, and the syntax and the relationships between them. Notice that the attributes are defined first, and then the objects are defined based on the underlying attributes. Thus, an attribute that is optional for one object might be mandatory for another. Optionally, you can demonstrate the Schema Management tool to show how the objects are defined from attributes. You also can show the hierarchy of objects and the inherited attributes. For example, the parent object for User is Organizational Person, the parent object for Organizational Person is Person, and the parent object for Person is an object called Top. Point out to students that attributes are defined at each level in the hierarchy, so the User object contains all of the attributes that are defined on the User class, and all of the attributes defined farther up the objects hierarchy (Organizational Person, Person, Top).
- This lesson describes the purpose of domain controllers and introduces the concept of the global catalog. It also describes in detail the logon process. This lesson covers the importance of DNS, particularly service resource (SRV) records, to the logon process. It also examines various operations master roles and how they contribute to the functioning of the AD DS domain. Question Why would you make a domain controller a global catalog server? Answer Queries that are directed at the forest (rather than the domain) need to be directed to a global catalog server. This is because a domain controller that is not a global catalog only holds information about the objects in its own domain. As a best practice, you should configure every domain controller to be a global catalog, even in a single domain forest.
- Emphasize to students that the database and services are stored on servers called domain controllers. Domain controllers—servers that perform the AD DS role—host the Active Directory database, SYSVOL, the Kerberos authentication service and other Active Directory services. For redundancy purposes, it is best to have at least two available domain controllers. Highlight that all domain controllers in a domain essentially are equal. Each domain controller contains a copy of the directory store, and updates can be made to the AD DS data on all domain controllers except for RODCs. Emphasize the importance of having multiple domain controllers in each domain. This provides load balancing, but more importantly, it also provides recoverability if a server failure occurs. Mention that all domain controllers engage in authentication and authorization, thus making it a redundant system with fewer fail points. This topic does not provide much information about best practices. If students are interested, you can go into more detail about installing domain controllers in remote sites to protect against an unavailable wide area network (WAN) connection. You can also talk about increasing the number of domain controllers to account for redundancy and performance.
- Describe the role of the global catalog server when searching for objects across domains in a forest. Define a global catalog as a domain controller that replicates the partial attribute set for each domain in the forest. The domain controller does not need the partial attribute set for its own domain because it already has the full copy of the domain database, and only needs the changes made to other domains. That is why, in a single domain environment, making every domain controller a global catalog server adds no significant replication. Question Should a domain controller be a global catalog? Answer Every domain controller should be a global catalog. (In some extreme situations, there might be a reason not to do so.) However, most large, distributed organizations are doing just that, so it also makes sense for less complex, smaller organizations.
- Use this slide to illustrate how the logon process works. In the first phase, the user account is authenticated to DC1. In the second phase, the user account applies to the domain controller for a ticket to gain authorization to connect with the local computer. A centralized directory service such as AD DS provides a single identity store, authentication service, and point of management for administration. Emphasize the advantages of a single identity store for security and manageability.
- Discuss each of the operations master roles in as much depth as you feel is appropriate for the students. Be sure to point out that most master roles are so specific that the master could be offline for a while without causing any problems. For example, you do not need the schema master until you make changes to the schema, and you do not need the domain naming master until you add or remove a domain in the forest. Point out that other domain services can be slowed or disrupted if a domain controller is offline and not available. Be sure to point out to students that these roles all run on a domain controller, so the loss of a domain controller could cause serious problems. Domain Flexible Single Master Operations (FSMOs) are needed on a more regular basis than those in the forest root domain, particularly the primary domain controller (PDC) emulator. The relative ID (RID) master provides a pool of RIDs to each domain controller. If this master is not available, eventually a domain controller will attempt to create an account and will be unable to do so. Talk through the five PDC functions to the level of detail that is provided in the student handbook. Enforce that if the PDC emulator master is not available or is slow to respond, you are more likely to have issues in the domain. You can find which domain controllers are FSMO holders by typing the following at a command prompt, and then pressing Enter: Netdom query fsmo
- Depending on the students’ experience with AD DS, you might have to explain in more detail the implications of no longer being able to run the dcpromo.exe tool as a GUI wizard. This tool is only used in Windows Server 2012 for an unattended installation. Mention to students that you can remotely promote a server to be a domain controller by using Server Manager running on Windows Server 2012. Emphasize to the students that this module is only concerned with installing domain controllers by using the GUI tools. There are other ways of installing domain controllers by using scripting tools such as Windows PowerShell® or VBScript. Question What is the reason to specify the Directory Services Restore Mode password? Answer If the AD DS database must be restored from backup, the domain controller must be restarted into Directory Services Restore Mode. You then must use the Directory Services Restore Mode password to log on to the domain controller when it starts in Directory Services Restore Mode.
- Use Server Manager to run through the initial process of installing an AD DS domain controller. Show the option to choose the local server or a remote server from the server pool. Explain that the initial pass installs the binaries for AD DS, and then you can continue to configure the AD DS installation.
- Describe the command displayed on the slide, and refer to the answer file (answerfile.txt). Remind the students that dcpromo.exe cannot be used in GUI format in Windows Server 2012, but can still be typed at a command prompt when doing an unattended install.
- Point out to students that because they are installing the domain controller using the IFM method, they should select the Install from media path check box. The next step is to type the path to the snapshot file in the Install from media path box.
Publicité