What is Active Directory Originally created in the year 1996, Active Directory, also referred as an AD, was first used with Windows 2000 Server as a directory service for Windows domain networks. Active Directory is a special purpose database, which serves as a central location for authenticating and authorizing all the users and computers within a network. Active Directory uses the Lightweight Directory Access Protocol (LDAP), an application protocol used for accessing and maintaining directory information services distributed over an IP network. What is Active Directory? The basic internal structure of the Active Directory consists of a hierarchical arrangement of Objects which can be categorized broadly into resources and security principles. Some of the examples of Active Directory objects are users, computers, groups, sites, services, printers, etc. Every Object is considered as a single entity with some specific set of attributes. The attributes of Objects along with the kind of objects that can be stored in the AD are defined by a Schema. The intrinsic framework of Active Directory is divided into a number of levels on the basis of visibility of objects. An AD network can be organized in four types of container structure namely, Forest, Domains, Organizational Units and Sites. y Forests: It is a collection of AD objects, their attributes and set of attribute syntax. y Domain: Domain is a collection of computers objects in the AD which share a common set of policies, a name and a database of their members. y Organizational Units: OUs are containers in which domains are grouped. They are used to create a hierarchy for the domain to resemble the structure of the Active Directory's company in organizational terms. y Sites: Sites are independent of domains and OU structure and are considered as physical groups defined by one of more IP subnets. They are used to distinguish between locations connected by low- and high-speed connections. Primarily, AD has three levels or logical divisions viz., Forest, Tree and Domain. A Domain is at the lowest level of an entire network and is identified by its DNS (Domain Name Structure). A Tree is a collection of one of more domains in a network while a Forest is a collection of Trees sharing a common global catalog, directory configuration, directory schema and logical structure. Forest is at the highest level of the logical structure and corresponds to the security boundaries within which the AD objects are accessible. Within a domain, all the objects are grouped in Organizational Units or OUs, so that administrative tasks can be simplified. With OUs, a domain can be divided in a hierarchical manner to resemble the managerial or departmental structure of an organization. Organizational units are also considered as containers which can hold other OUs of the domain. Group Policies in the form of Group Policy Objects (GPOs) are generally applied to the OUs and administrative powers are also delegated at the OUs. Sites are physical groupings rather than logical structures and are used to control network traffic caused due to Active Directory replication. Sites are also used to refer the clients to the nearest domain through a Domain Controller (DC). All the information contained in the Active Directory is physically held in one more domain controller. Each DC has a copy of the Active Directory and when changes take place in any server, the information gets replicated in all the DC containing a copy of the Active Directory. This process is termed as Active Directory Replication. Replication in the Active Directory is triggered each time an Object is created, deleted, moved or modified. Active Directory Schema All the objects and their attributes within an Active Directory are defined in a schema, which is an Active Directory component. Since Active Directory stores information from various applications and services, all that information is standardized with the help of a schema. The AD schema defines how the data is stored and how the directory service will retrieve, update or replicate the data while ensuring data integrity. In Active Directory, Objects are the main storage units and are defined under the AD schema. The directory queries the schema for appropriate object definition each time some information is to be handled. The AD creates the objects and stores data in it as per the definition available in the schema, since the schema controls the type of information that can be stored in the objects. Data types which exist in schema definitions can only be stored in the objects. In order to store a new data type, a new object definition must be first created in the schema. The object definitions in the AD schema contain all the object attributes along with the definitions of the attribute relationships. For example, a User object will contain an attribute user¶s logon name. This attribute will in turn contain other attributes like syntax of the logon name. All the object attributes and the attributes within are defined in the schema of the Active Directory. Building Active Directory Schema During the creation of forest at the time of Active Directory installation, the default schema is also created. The default schema gets replicated in each new domain thereafter created within the forest and each Domain Controller gets access to a copy of the default schema. This is necessary for creating objects within the domain as the DC must have the object definitions required for creating objects and store or retrieve information in the Active Directory. The replication topology of Active Directory ensures that every domain controller will be able to write changes in the AD database and replicate those changes to other DCs in the same forest as well. Active Directory Schema architecture Schema is the Active Directory component that defines all the AD objects and their attributes so as to store data. The physical structure of Active Directory schema comprises the object definitions. The schema is stored in the schema partition of the directory and defines the following: y Objects used to store data in the directory y The rules which govern the structure of the objects y The directory structure and its content The above definitions consist of objects, attributes and classes, the details of which are mentioned below: Schema components 1. Objects 2. Attributes 3. Classes 4. Schema objects 5. schema objects Active Directory Domain In a network, a domain is a collection of computers and resources which have a common namespace and share a common security database. The namespace of domains are stored in the DNS which is primarily a hierarchical structure of services and object names. For a domain in an active directory that shares the common AD database, the active directory and DNS namespace have to be the same. Administrative controls and security policies are implemented on a domain basis and are valid for individual domains only. Within a domain, administrators can create and manage different resources and objects. An active directory domain contains various AD objects like users, groups, computers, OU, etc. Therefore, it can be said that a domain is the core logical structure of the active directory, while the physical structures are the domain controllers and sites. When more than one domain is grouped together, a domain tree is formed. Every domain within a domain tree shares a contiguous DNS namespace and naming structure. In a domain tree, the root domain is referred to as the Parent domain while the multiple domains added to it are referred as the Child Domains. A group of multiple domain trees is termed as a forest. Within a forest, the domains are linked by two-way transitive trusts and share a common global catalog and schema. The root domain in a forest contains the specific groups like the Domain Naming Master Role, Schema Master Role, Enterprise Admins group and Schema Admins group. Domain Functional Levels The domain functional levels control and restrict all the functions performed in a domain. If the domain functional level is upgraded to Windows Server 2003 functional level, a few advanced active directory features become available: y Windows 2000 Native supports domain controllers running Windows 2000 and Windows Server 2003. y Windows 2000 Mixed supports domain controllers running Windows NT 4.0, Windows 2000 and Windows Server 2003. y Windows Server 2003 Interim supports domain controllers running Windows NT 4.0 and Windows Server 2003. y Windows Server 2003 supports domain controllers running Windows Server 2003. Domain Design Factor While designing an active directory domain, the following factors should be kept in mind: 1. Business requirements: Depending on the business requirements of the organization, the logical structure of active directory must be designed. 2. Geographical factors: In order to control replication of different regions within the enterprise, it is best to create and implement a geographic domain design so that the domain controllers replicate the changes only in their local domain. 3. Domain Name strategy: Domain name should be unique. Each domain is assigned a NetBIOS name and DNS name. 4. WAN link costs: The cost of implementing WAN links varies in different countries. Active Directory Server Windows Active Directory is used to manage application settings, corporate identities, business information and system credentials in an organization. The Active Directory server performs all these tasks with the help of certain technologies which are explained below: Active Directory Domain Services (AD DS) The Active Directory Domain Service is the central location of the directory where information about security configuration settings, authentication requests and every AD object within the domain or forest is stored. From this centralized location, AD administrators can control, access and manage the entire directory along with its objects, resources and services like users, computers, groups, applications, printer, etc.