UNDERSTANDING ACTIVE DIRECTORY FOR BEGINNERS – PART 2

發行項
12/26/2012

This is the documentation for the Online discussion we conducted on Active Directory.

Recording of this session is available on YouTube
Here we discussed about.

ACID Property of a Database
Active Directory Sites and Services
Active Directory Replication
Domain Controller
Global Catalog Server
Logical and Physical Components of Active Directory
FSMO Roles
Domain Functional Level
Forest Functional Level
Installing Active Directory (Windows Server 2012)

ACID Property of a Database

In computer science, ACID (atomicity, consistency, isolation, durability) is a set of properties that guarantee that database transactions are processed reliably.
In the context of databases, a single logical operation on the data is called a transaction

ACID Property of a Database

Atomicity

Atomicity requires that each transaction is “all or nothing”: if one part of the transaction fails, the entire transaction fails, and the database state is left unchanged.

Consistency

The consistency property ensures that any transaction will bring the database from one valid state to another.

Isolation

The isolation property ensures that the concurrent execution of transactions results in a system state that could have been obtained if transactions are executed serially, i.e. one after the other. Each transaction has to execute in total isolation.

Durability

Durability means that once a transaction has been committed, it will remain so, even in the event of power loss, crashes, or errors. Even if the database crashes it can be restored.

Active Directory Sites

Sites in Active Directory represent the physical structure, or topology, of your network.
Managed using Active Directory Sites and Services Console.
Each Sites are connected by a Site link and each Site link has a cost associated.

Active Directory Replication

Intrasite Replication
Intersite Replication

Intrasite Replication

Happens between DC’s in the same site.
Replication happens 15 seconds after a change.
This happens automatically.
Intrasite topology is automatically generated by KCC (Knowledge consistency checker) which runs on every DC.

Intersite Replication

This is not created automatically. Administrator makes.
Active Directory will automatically pick a Domain Controller from each site to act as a Bridgehead server.
Bridgehead servers replicate changes between the sites. This is much efficient than every DCs attempting to replicate to other sites.
When a change happens to the bridgehead server change is replicated to all other domain controllers inn that site.
Administer can manually select the bridgehead server, they are called preferred bridgehead server. If they are selected manually and if those DCs aren’t available no replication will occur.
Each of these sites are connected each other by Site Link.

Site Link

Determine the schedule of replication.
Allows to configure a cost
Cost determines at what priority these links should be used. Lower cost, higher priority
KCC running on bridge will act as ISTG (InterSite Topology Generator.
Whenever a site link goes down, KCC creates a new InterSite Replication Topology. KCC runs every 15 mins.

Transport Protocol

RPC over IP
SMTP

RPC over IP

Supports every type of data replication required for Active Directory
Synchronous
Used when the connectivity is reliable.
Always used for Intrasite replication.

SMTP

Cannot be used to replicate every data replication required for Active Directory, for ex. It cannot do file replication. Files include – Login Scripts and Group Policies.
Asynchronous
Used when the connectivity is unreliable.
Please refer this technet for more details.

RPC over IP is normally used in the real world.

Active Directory Replication Database prospective

Domain Controller

Server which has Active Directory installed
Uses LDAP port 389 for communication

Global Catalog Server

The global catalog is a domain controller that contains a searchable, partial representation of every object in every domain in a multi domain Active Directory forest.
Uses non standard LDAP port 3268 for communication.

Lets review AD Database Layers again

ESE Layer

JetEngine Database Engine

Database Layer

Schema Partition
Config Partition
Domain Partition
Application Partition

Core Directory System Agent (DSA) Layer

The directory service component that runs as Ntdsa.dll on each domain controller, providing the interfaces through which services and processes gain access to the directory database.

LDAP Layer

The primary interface for AD DS access. Directory clients use LDAP v3 to connect to the DSA through the LDAP interface. The LDAP interface is part of Wldap32.dll. LDAP v3 is backward compatible with LDAP v2.

Replication Layer

The replication management interface.

SAM Layer

Proprietary interface for connecting to the DSA on behalf of clients that run Windows NT 4.0 or earlier.

Logical and Physical Components of Active Directory

Logical Components

Domain
OU
Objects (not every objects)
Global Catalog
Tree
Forest
Group Policy

Physical Components

Domain Controller
Sites
Site Link

Multi Master Replication

Multi-master replication is a method of database replication which allows data to be stored by a group of computers, and updated by any member of the group.

Single Master Replication

Single-master replication is a method of database replication which allows data to be stored by a group of computers, but can only be updated by one member of the group.

Active Directory works on Multi Mastered Replication Model except for few.

FSMO Roles
Flexible Single Master Operations Roles

Schema Master Role:

The schema master domain controller controls all updates and modifications to the schema. Once the Schema update is complete, it is replicated from the schema master to all other DCs in the directory. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.

Domain naming master Role:

The domain naming master domain controller controls the addition or removal of domains in the forest. This DC is the only one that can add or remove a domain from the directory. It can also add or remove cross references to domains in external directories. There can be only one domain naming master in the whole forest.

Infrastructure Master Role:

When an object in one domain is referenced by another object in another domain, it represents the reference by the SID and the DN of the object being referenced. The infrastructure FSMO role holder is the DC responsible for updating an object’s SID and distinguished name in a cross-domain object reference. At any one time, there can be only one domain controller acting as the infrastructure master in each domain.
Note: The Infrastructure Master (IM) role should be held by a domain controller that is not a Global Catalog server (GC). If the Infrastructure Master runs on a Global Catalog server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a Global Catalog server holds a partial replica of every object in the forest.

Relative ID (RID) Master Role:

The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. When a DC creates a user or group, it attaches a unique Security ID (SID) to the object. This SID consists of a domain SID (the same for all SIDs created in a domain), and a relative ID (RID) that is unique for each security principal SID created in a domain. Each DC in a domain is allocated a pool of RIDs that it is allowed to assign to the security principals it creates. When a DC’s allocated RID pool falls below a threshold, that DC issues a request for additional RIDs to the domain’s RID master. The domain RID master responds to the request by retrieving RIDs from the domain’s unallocated RID pool and assigns them to the pool of the requesting DC. At any one time, there can be only one domain controller acting as the RID master in the domain.

PDC Emulator Role:

The PDC emulator is necessary to synchronize time in an enterprise. At any one time, there can be only one domain controller acting as the PDC Emulator in each domain.
The PDC emulator role also does the following functions:
Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
Account lockout is processed on the PDC emulator.
Editing or creation of Group Policy Objects (GPO) is always done from the GPO copy found in the PDC Emulator’s SYSVOL share, unless configured not to do so by the administrator.
The PDC emulator performs all of the functionality that a Microsoft Windows NT 4.0 Server-based PDC or earlier PDC performs for Windows NT 4.0-based or earlier clients.

More detailed documentation can be reviewed here:

https://www.petri.co.il/understanding\_fsmo\_roles\_in\_ad.htm

They are 5 FSMO Roles in total, 2 Forest wide and 3 Domain wide.

Domain Functional Level

Active Directory has functional levels at the domain and forest levels which determine which Active Directory features are available. The higher the functional level the more features available.
They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems you can run on workstations and member servers that are joined to the domain or forest.

The different domain functional levels are:

Mixed or Interim

Upgraded from an NT4 domain and may have some domain controllers that are still NT4.

Windows 2000 native

Gives basic Active Directory functionality