DOCSLIB.ORG

Active Directory Design

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Active Directory Design Novell to Microsoft Conversion Assessment: Active Directory Design Presented to: 03/11/11 1215 Hamilton Lane, Suite 200 Naperville, IL 60540 www.MoranTechnology.com Voice & Fax: 877-212-6379 Active Directory Design HACC Version History Ver. # Ver. Date Author Description 1.0 19-Jan-11 Brian Desmond Initial Draft 1.1 25-Jan-11 Scott Weyandt Edits 1.2 03-Feb-11 Brian Desmond Edits at HACC 1.3 09-Feb-11 Brian Desmond Updated drawings 1.4 09-Mar-11 Brian Desmond Updates based on review w/ HACC Page 2 of 38 Active Directory Design HACC Table of Contents Introduction .................................................................................................................................. 5 Background ............................................................................................................................... 5 Approach ................................................................................................................................... 6 Current Environment .............................................................................................................. 6 Design Goals ............................................................................................................................. 6 Forest & Domain Design ............................................................................................................. 7 Forest Model ............................................................................................................................. 7 Domain Model .......................................................................................................................... 7 Trusts ......................................................................................................................................... 8 Schema Customizations .......................................................................................................... 9 Site Topology & Domain Controller Placement .................................................................... 11 Site Layout .............................................................................................................................. 11 Replication Topology ............................................................................................................ 12 Exchange Server Considerations ......................................................................................... 13 Domain Controller Hardware & OS ................................................................................... 14 Domain Controller Placement .............................................................................................. 16 Global Catalog Placement ..................................................................................................... 17 Read Only Domain Controller Placement .......................................................................... 18 Filtered Attribute Set ......................................................................................................... 19 Password Replication Policy ............................................................................................ 19 FSMO Placement .................................................................................................................... 20 Page 3 of 38 Active Directory Design HACC Name Resolution ........................................................................................................................ 23 DNS Namespace Design ....................................................................................................... 23 Time Sync .................................................................................................................................... 25 Best Practices........................................................................................................................... 25 Time Sync Design ................................................................................................................... 25 Disaster Recovery....................................................................................................................... 27 Backup ..................................................................................................................................... 27 Restore ..................................................................................................................................... 28 Active Directory Recycle Bin ................................................................................................ 29 Administrative Model ............................................................................................................... 30 Organizational Unit Design .................................................................................................. 30 Top-Level OU Design ........................................................................................................ 31 Enterprise Support OU...................................................................................................... 33 Site-Level OU Design ........................................................................................................ 35 Recommended Site-Level OU Design ......................................................................... 36 Object Lifecycle Management .............................................................................................. 37 Summary ..................................................................................................................................... 38 Page 4 of 38 Active Directory Design HACC Introduction This document details the recommendations of Moran Technology Consulting (MTC) for the design of the new Harrisburg Area Community College (HACC) Active Directory. Background HACC has engaged MTC to conduct a thorough and impartial evaluation of its current network operating system and email environment (Novell NDS and GroupWise). As part of this assessment, MTC will identify the pros and cons of converting to a Microsoft Windows Server Active Directory and Exchange Server 2010 from the current Novell NetWare and GroupWise products. In addition, MTC will develop a project plan that identifies the total cost of conversion, including: . Estimates for hardware and software (licensing and support); . Resource, time, and cost estimates for implementing the new solution (upgrade or migration); . Knowledge transfer and training of HACC to operate and maintain the new solution. As part of this effort, MTC has developed the following design for Windows Server 2008 R2 Active Directory to enable detailed pricing and planning information to be developed. Page 5 of 38 Active Directory Design HACC Approach As a firm that specializes in IT Management and Technical consulting for higher education clients, MTC recognizes the importance of the cultural, organizational, and technical challenges that must be addressed in order to develop and implement an efficient design and plan for HACC. At the kickoff of the project, a HACC design team was assembled to provide stakeholder input into the design to ensure that it meets the technical and functional needs of all the parties dependent on the new Active Directory. Several meetings and workshops were conducted to socialize the proposed design and gather inputs from each of the campuses. Current Environment HACC is currently utilizing a Novell Netware/NDS as its directory platform and Network Operating System. The Novell infrastructure is comprised of centrally hosted and distributed Novell servers at each of the campuses. Novell primarily supports file services for employees (faculty and staff) and GroupWise. Design Goals The primary goal of this design is to provide an Active Directory infrastructure which will meet the authentication and administrative needs of the HACC stakeholders while also conforming to current best practice standards for Active Directory. The following design was established to support a proposed Microsoft Exchange Server 2010 deployment as well as desktop authentication and file services for all of the HACC campuses. Substantial consideration will be given to ensuring that administrators for each of the campuses can continue to perform all of their duties in an efficient and timely manner. Page 6 of 38 Active Directory Design HACC Forest & Domain Design The two top level elements of any Active Directory design are the forest and domain. Forests are security boundaries in an Active Directory and contain one or more domains. While domains are a replication boundary within a forest, they are never a security boundary. Therefore, when complete separation of administration is necessary in an Active Directory environment, a separate forest must be deployed. A common misconception is that deploying an empty root domain to hold enterprise level administrative groups is more secure than collocating those groups in a general use domain. Given the architecture of Active Directory, it is in fact quite possible for administrators in one domain to affect other domains. Thus a single domain design is just as secure as a multi-domain design. Empty roots were originally conceived in an era where popular wisdom was that there were technical advantages to the deployment of the root domain. Today, the cases where the empty root makes sense are corner cases rather than the norm. Forest Model The business and technical requirements for HACC’s new Active Directory design do not
Load more

Recommended publications
  • 1 Table of Contents List of Figures
    Table of Contents List of Figures ..................................................................................................................... 4 List of Tables ...................................................................................................................... 5 Chapter 1: Introduction....................................................................................................... 6 1.1 Introduction....................................................................................................................6 1.2 Problem Statement .......................................................................................................12 1.3 Thesis Objective...........................................................................................................12 1.4 Thesis Organization.....................................................................................................14 Chapter 2: Intrusion Detection.......................................................................................... 15 2.1 Introduction..................................................................................................................15 2.2 What is an IDS .............................................................................................................15 2.2.1 The Basic Concepts of Intrusion Detection......................................................16 2.2.2 A Generic Intrusion-Detection System.............................................................17 2.2.3 Characteristics of
    [Show full text]
  • Blackbaud CRM Security Guide
    Security Guide 11/10/2014 Blackbaud Direct Marketing 4.0 Security UK ©2014 Blackbaud, Inc. This publication, or any part thereof, may not be reproduced or transmitted in any form or by any means, electronic, or mechanical, including photocopying, recording, storage in an information retrieval system, or oth- erwise, without the prior written permission of Blackbaud, Inc. The information in this manual has been carefully checked and is believed to be accurate. Blackbaud, Inc., assumes no responsibility for any inaccuracies, errors, or omissions in this manual. In no event will Blackbaud, Inc., be liable for direct, indirect, special, incidental, or consequential damages resulting from any defect or omission in this manual, even if advised of the possibility of damages. In the interest of continuing product development, Blackbaud, Inc., reserves the right to make improvements in this manual and the products it describes at any time, without notice or obligation. All Blackbaud product names appearing herein are trademarks or registered trademarks of Blackbaud, Inc. All other products and company names mentioned herein are trademarks of their respective holder. Security-2014 Contents CONTENTS I SECURITY 1 Fundamentals of Security 1 APPLICATION USERS 3 Search for Users 3 Application User Records 4 Add an Application User 4 Edit Users 5 Delete Users 6 Grant/Revoke Users Administrator Rights 6 Run the Program as a Selected User 6 Organisational Unit Record 7 Application Users Page 8 Manage System Roles of an Application User 8 Add System Roles
    [Show full text]
  • Lesson 14: Creating and Managing Active Directory Users and Computers
    Lesson 14: Creating and Managing Active Directory Users and Computers MOAC 70-410: Installing and Configuring Windows Server 2012 Overview • Exam Objective 5.2: Create and Manage Active Directory Users and Computers • Creating User Objects • Creating Computer Objects • Managing Active Directory Objects © 2013 John Wiley & Sons, Inc. 2 Creating User Objects Lesson 14: Creating and Managing Active Directory Users and Computers © 2013 John Wiley & Sons, Inc. 3 Creating User Objects • The user account is the primary method for authentication on a network. • Usernames and passwords are validated at log on by comparing entered information to the information stored in the AD DS database. © 2013 John Wiley & Sons, Inc. 4 Types of Users • Local users: These accounts can only access resources on the local computer and are stored in the local Security Account Manager (SAM) database on the computer where they reside. • Domain users: These accounts can access AD DS or network-based resources, such as shared folders and printers. o Account information for these users is stored in the AD DS database and replicated to all domain controllers within the same domain. © 2013 John Wiley & Sons, Inc. 5 Built-In User Accounts Administrator and Guest • On a member server or standalone server: The built-in local Administrator account has full control of all files as well as complete management permissions for the local computer. • On a domain controller: The built-in Administrator account created in Active Directory has full control of the domain in which it was created. The Administrator account cannot be deleted, but it can be renamed. © 2013 John Wiley & Sons, Inc.
    [Show full text]
  • The 12 Essential Tasks of Active Directory Domain Services
    WHITE PAPER ACTIVE DIRECTORY DOMAIN SERVICES The 12 Essential Tasks of Active Directory Domain Services Using the right tools and processes helps reduce administrative overhead and ensures directory service is always available By Nelson Ruest and Danielle Ruest Sponsored by WHITE PAPER ACTIVE DIRECTORY DOMAIN SERVICES ABSTRACT Active Directory Domain Services (AD DS) administration and management includes Sponsored by 12 major tasks. These tasks cover a wide breadth of business needs and are not all performed solely by AD DS administrators. In fact, administrators can and should delegate several tasks to other members of their technical community, technicians, help desk personnel, even users such as team managers and administrative assistants. While delegation is a way to reduce the amount of work administrators have to do when managing AD DS infrastructures, it really only addresses one or two of the 12 tasks, for example, user and group administration as well as end point device administration. The other ten tasks can be staggering in nature—security, networked service administration, OU-Specific Management, Group Policy Object management and many more—and because of this can take up inordinate amounts of time. You can rely on Microsoft’s built-in tools to reduce some of this workload, but are the native tools enough? Perhaps it’s time to reduce AD DS administration overhead by automating most tasks and tightening internal security. Address this by first, determining what the twelve essential labors of Active Directory are and then, see how you can reduce AD DS workloads through the implementation of proper management and administration tools.
    [Show full text]
  • Active Directory with Powershell
    Active Directory with PowerShell Learn to configure and manage Active Directory using PowerShell in an efficient and smart way Uma Yellapragada professional expertise distilled PUBLISHING BIRMINGHAM - MUMBAI Active Directory with PowerShell Copyright © 2015 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: January 2015 Production reference: 1200115 Published by Packt Publishing Ltd. Livery Place 35 Livery Street Birmingham B3 2PB, UK. ISBN 978-1-78217-599-5 www.packtpub.com Credits Author Project Coordinator Uma Yellapragada Sageer Parkar Reviewers Proofreaders David Green Simran Bhogal Ross Stone Stephen Copestake Nisarg Vora Martin Diver Ameesha Green Commissioning Editor Paul Hindle Taron Pereira Indexer Acquisition Editor Hemangini Bari Sonali Vernekar Production Coordinator Content Development Editor Aparna Bhagat Prachi Bisht Cover Work Technical Editor Aparna Bhagat Saurabh Malhotra Copy Editors Heeral Bhatt Pranjali Chury Gladson Monteiro Adithi Shetty About the Author Uma Yellapragada has over 11 years of experience in the IT industry.
    [Show full text]
  • Open Directory Administration for Version 10.5 Leopard Second Edition
    Mac OS X Server Open Directory Administration For Version 10.5 Leopard Second Edition Apple Inc. © 2008 Apple Inc. All rights reserved. The owner or authorized user of a valid copy of Mac OS X Server software may reproduce this publication for the purpose of learning to use such software. No part of this publication may be reproduced or transmitted for commercial purposes, such as selling copies of this publication or for providing paid-for support services. Every effort has been made to make sure that the information in this manual is correct. Apple Inc., is not responsible for printing or clerical errors. Apple 1 Infinite Loop Cupertino CA 95014-2084 www.apple.com The Apple logo is a trademark of Apple Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, iCal, iChat, Leopard, Mac, Macintosh, QuickTime, Xgrid, and Xserve are trademarks of Apple Inc., registered in the U.S. and other countries. Finder is a trademark of Apple Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. UNIX is a registered trademark of The Open Group. Other company and product names mentioned herein are trademarks of their respective companies. Mention of third-party products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the performance or use of these products.
    [Show full text]
  • Active Roles 7.3 Skype for Business Server User Management
    One Identity Active Roles 7.3 Skype for Business Server User Management Administration Guide Copyright 2018 One Identity LLC. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser’s personal use without the written permission of One Identity LLC . The information in this document is provided in connection with One Identity products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of One Identity LLC products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, ONE IDENTITY ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON- INFRINGEMENT. IN NO EVENT SHALL ONE IDENTITY BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF ONE IDENTITY HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. One Identity make no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice.
    [Show full text]
  • Using IIS Application Request Routing to Publish Lync Server 2013 Web Services
    Using IIS Application Request Routing to Publish Lync Server 2013 Web Services DISCLAIMER © 2014 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, Hyper-V, Internet Explorer, Lync, PowerPoint, Silverlight, SQL Server, Windows, Windows PowerShell, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. THE CONTENTS OF THIS PACKAGE ARE FOR INFORMATIONAL AND TRAINING PURPOSES ONLY AND ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. No part of the text or software included in this training package may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission from Microsoft. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. To obtain authorization for uses other than those specified above, please visit the Microsoft Copyright Permissions Web page at http://www.microsoft.com/about/legal/permissions This content is proprietary and confidential, and is intended only for users described in the content provided in this document. This content and information is provided to you under a Non-Disclosure Agreement and cannot be distributed.
    [Show full text]
  • Freeipa Global Catalog Challenges
    FreeIPA Global Catalog challenges Samba XP - 2020 May 27 Alexander Bokovoy Florence Blanc-Renaud Red Hat / Samba team Red Hat Alexander: ● Samba team member since 2003 ● FreeIPA core developer since 2011 Florence ● LDAP server technology engineer since 2007 ● FreeIPA core developer since 2016 Samba: ● Andreas Schneider ● Isaac Boukris ● Simo Sorce 389-ds LDAP server ● Thierry Bordaz ● William Brown Thank you all! ● Mark Reynolds ● Ludwig Krispenz MIT Kerberos ● Greg Hudson ● Robbie Harwood ● Isaac Boukris ● Simo Sorce and many others Allow access to Active Directory resources for IPA users and services Frankenstein's Active Directory: for Linux clients, not Windows Uses 389-ds LDAP server, MIT Kerberos, and Samba NT domain controller code base to implement what Active Directory domain controller sees as a separate Active Directory forest ▸ LDAP schema optimized for Linux clients and POSIX identity management use cases ▸ Flat directory information tree for users, groups, and services ▸ No compatibility with Active Directory schema ▸ LDAP objects specific to POSIX environment use cases (SUDO rules, own access control rules, etc) ▸ KDC based on MIT Kerberos, native two-factor authentication and modern pre-authentication methods ▸ NetLogon and LSA pipes with enough support to allow AD DCs to interoperate via a forest trust ▸ Integrated DNS server and Certificate Authority It is not that simple... Global Catalog Entries LDAP is a communication protocol designed with flexibility and extensibility in mind ▸ Schema: ▸ Syntaxes ▸ Attribute types
    [Show full text]
  • Freeipa 3.3 Trust Features
    FreeIPAFreeIPA 3.33.3 TrainingTraining SeriesSeries FreeIPA 3.3 Trust features Sumit Bose, Alexander Bokovoy March 2014 FreeIPA and Active Directory ● FreeIPA and Active Directory both provide identity management solutions on top of the Kerberos infrastructure ● FreeIPA AD Trust feature is designed ● To give Active Directory users access to FreeIPA resources ● To allow FreeIPA servers and clients to resolve identities of AD users and groups ● FreeIPA AD Trust feature does not require ● Synchronizing accounts and passwords with AD ● Installing any software on AD domain controllers 2 FreeIPA 3.3 Training Series Cross-realm forest trust: FreeIPA and Active Directory ● FreeIPA exposes its own realm as an Active Directory- compatible forest ● Two Active Directory-compatible forests can trust each other ● As result: ● Active Directory users can access FreeIPA resources ● FreeIPA servers and clients can resolve identities of AD users and groups ● Access to FreeIPA is controlled by FreeIPA rules (HBAC, ...) for Active Directory users and groups ● All AD user and group management stays at AD side 3 FreeIPA 3.3 Training Series Active Directory → FreeIPA ● FreeIPA Kerberos infrastructure cannot be joined to Active Directory forest as a domain, only trusted as an Active Directory-compatible forest ● FreeIPA provides access to its own services to Active Domain's users by trusting Active Directory Kerberos infrastructure ● All FreeIPA access control decisions are done on FreeIPA side ● FreeIPA uses Kerberos trust by an Active Directory to perform LDAP
    [Show full text]
  • Using Microsoft Active Directory (AD) with Eonstor GS/Gse in Windows Server
    Using Microsoft Active Directory (AD) with EonStor GS/GSe in Windows Server Application Note Abstract: This application note describes how to use Microsoft Active Directory (AD) service with EonStor GS/GSe systems in Windows Server environments. Copyright © 2016 Infortrend Technology, Inc. All rights reserved. Infortrend, ESVA, EonStor, EonNAS and EonPath are trademarks or registered trademarks of Infortrend. All other marks and names mentioned herein may be trademarks of their respective owners. The information contained herein is subject to change without notice. The content provided as is, without express or implied warranties of any kind. Table of Content Table of Content Table of Content ......................................................................................................................... 2 Using Microsoft Active Directory with EonStor GS/GSe ............................................................... 3 Preparing the Environment ........................................................................................................ 4 Step 1: Time setting .................................................................................................................... 4 Step 2: Check channel connection .............................................................................................. 5 Step 3: Check IP address of AD & DNS ........................................................................................ 5 Adding AD Server to EonStor GS/GSe ........................................................................................
    [Show full text]
  • Windows Powershell Best Practices Windows Powershell Best Practices
    Windows PowerShell Best Practices Windows PowerShell Best Practices Expert recommendations, pragmatically applied Automate system administration using Windows PowerShell best practices—and optimize your operational efficiency. With this About the Author practical guide, Windows PowerShell expert and instructor Ed Ed Wilson, MCSE, CISSP, is a well-known Wilson delivers field-tested tips, real-world examples, and candid scripting expert and author of “Hey Windows Scripting Guy!”—one of the most popular advice culled from administrators across a range of business and blogs on Microsoft TechNet. He’s written technical scenarios. If you’re an IT professional with Windows several books on Windows scripting PowerShell experience, this book is ideal. for Microsoft Press, including Windows PowerShell 2.0 Best Practices and Windows PowerShell Scripting Guide. Discover how to: PowerShell • Use Windows PowerShell to automate Active Directory tasks • Explore available WMI classes and methods with CIM cmdlets • Identify and track scripting opportunities to avoid duplication • Use functions to encapsulate business logic and reuse code • Design your script’s best input method and output destination • Test scripts by checking their syntax and performance • Choose the most suitable method for running remote commands • Manage software services with Desired State Configuration Wilson BEST PRACTICES microsoft.com/mspress ISBN 978-0-7356-6649-8 U.S.A. $59.99 55999 Canada $68.99 [Recommended] 9 780735 666498 Operating Systems/Windows Server Celebrating 30 years! Ed Wilson 666498_Win_PowerShell_Best_Practices.indd 1 4/11/14 10:30 AM Windows PowerShell Best Practices Ed Wilson 666498_book.indb 1 12/20/13 10:50 AM Published with the authorization of Microsoft Corporation by: O’Reilly Media, Inc.
    [Show full text]