Active Directory

by Allen, Robbie; Lowe-Norris, Alistair G.

• ISBN13: 9780596004668
• ISBN10: 0596004664
• Edition: 2nd
• Format: Paperback
• Copyright: 2003-05-01
• Publisher: Oreilly & Associates Inc

Summary

"Active Directory, 2nd Edition, provides system and network administrators, IT professionals, technical project managers, and programmers with a clear, detailed look at Active Directory for both Windows 2000 and Windows Server 2003. The upgraded Active Directory that ships with Windows Server 2003 has over 100 new and enhanced features and once again, O'Reilly has the answers to puzzling questions. While Microsoft's documentation serves as an important reference, "Active Directory, 2nd Edition is a guide to help the curious (and weary) understand the big picture. In addition to the technical details for implementing Active Directory, several new and significantly enhanced chapters describe the numerous features that have been updated or added in Windows Server 2003 along with coverage of new programmatic interfaces that are available to manage it. "Active Directory, 2nd Edition will guide you through the maze of concepts, design issues and scripting options enabling you to get the most out of your deployment.

Author Biography

Robbie Allen and Alistair G. Lowe-Norris are experienced veterans with real-world experience. Robbie is a Senior Systems Architect in the Advanced Services Technology Group at Cisco Systems

Table of Contents

Preface	xi
Part I. Active Directory Basics
A Brief Introduction	3	(10)
Evolution of the Microsoft NOS	4	(1)
Windows NT Versus Active Directory	5	(4)
Windows 2000 Versus Windows Server 2003	9	(4)
Active Directory Fundamentals	13	(19)
How Objects Are Stored and Identified	13	(3)
Building Blocks	16	(16)
Naming Contexts and Application Partitions	32	(7)
Domain Naming Context	33	(1)
Configuration Naming Context	34	(1)
Schema Naming Context	35	(1)
Application Partitions	36	(3)
Active Directory Schema	39	(21)
Structure of the Schema	39	(4)
Attributes (attributeSchema Objects)	43	(5)
Attribute Syntax	48	(1)
Classes (classSchema Objects)	49	(11)
Site Topology and Replication	60	(19)
Site Topology	60	(3)
Data Replication	63	(16)
Active Directory and DNS	79	(16)
DNS Fundamentals	79	(2)
DC Locator	81	(2)
Resource Records Used by Active Directory	83	(3)
Delegation Options	86	(5)
Active Directory Integrated DNS	91	(2)
Using Application Partitions for DNS	93	(2)
Profiles and Group Policy Primer	95	(28)
A Profile Primer	97	(5)
Capabilities of GPOs	102	(17)
Summary	119	(4)
Part II. Designing an Active Directory Infrastructure
Designing the Namespace	123	(40)
The Complexities of a Design	124	(2)
Where to Start	126	(1)
Overview of the Design Process	126	(1)
Domain Namespace Design	126	(10)
Design of the Internal Domain Structure	136	(11)
Other Design Considerations	147	(1)
Design Examples	148	(9)
Designing for the Real World	157	(6)
Creating a Site Topology	163	(24)
Intrasite and Intersite Topologies	163	(12)
Designing Sites and Links for Replication	175	(6)
Examples	181	(6)
Designing Organization-Wide Group Policies	187	(52)
How GPOs Work	187	(25)
Managing Group Policies	212	(7)
Using GPOs to Help Design the Organizational Unit Structure	219	(14)
Debugging Group Policies	233	(6)
Active Directory Security: Permissions and Auditing	239	(32)
Using the GUI to Examine Permissions	241	(9)
Using the GUI to Examine Auditing	250	(1)
Designing Permission Schemes	251	(11)
Designing Auditing Schemes	262	(2)
Real-World Examples	264	(7)
Designing and Implementing Schema Extensions	271	(18)
Nominating Responsible People in Your Organization	272	(1)
Thinking of Changing the Schema	273	(4)
Creating Schema Extensions	277	(9)
Wreaking Havoc with Your Schema	286	(3)
Backup, Recovery, and Maintenance	289	(22)
Backing Up Active Directory	289	(3)
Restoring a Domain Controller	292	(5)
Restoring Active Directory	297	(6)
FSMO Recovery	303	(3)
DIT Maintenance	306	(5)
Upgrading to Windows Server 2003	311	(20)
New Features in Windows Server 2003	312	(2)
Differences With Windows 2000	314	(2)
Functional Levels Explained	316	(3)
Preparing for ADPrep	319	(4)
Upgrade Process	323	(4)
Post-Upgrade Tasks	327	(4)
Migrating from Windows NT	331	(12)
The Principles of Upgrading Windows NT Domains	331	(12)
Integrating Microsoft Exchange	343	(19)
Quick Word about Exchange Server 2003	343	(1)
Preparing Active Directory for Exchange 2000	344	(3)
Exchange 5.5 and the Active Directory Connector	347	(15)
Interoperability, Integration, and Future Direction	362	(17)
Microsoft's Directory Strategy	362	(4)
Interoperating with Other Directories	366	(1)
Integrating Applications and Services	367	(12)
Part III. Scripting Active Directory with ADSI, ADO, and WMI
Scripting with ADSI	379	(22)
What Are All These Buzzwords?	379	(4)
Writing and Running Scripts	383	(3)
ADSI	386	(10)
Simple Manipulation of ADSI Objects	396	(3)
Further Information	399	(2)
IADs and the Property Cache	401	(29)
The IADs Properties	401	(10)
Manipulating the Property Cache	411	(16)
Checking for Errors in VBScript	427	(3)
Using ADO for Searching	430	(22)
The First Search	431	(5)
Other Ways of Connecting and Retrieving Results	436	(3)
Understanding Search Filters	439	(3)
Optimizing Searches	442	(5)
Advanced Search Function---SearchAD	447	(5)
Users and Groups	452	(24)
Creating a Simple User Account	452	(1)
Creating a Full-Featured User Account	453	(8)
Creating Many User Accounts	461	(3)
Modifying Many User Accounts	464	(2)
Account Unlocker Utility	466	(5)
Creating a Group	471	(1)
Adding Members to a Group	472	(2)
Evaluating Group Membership	474	(2)
Manipulating Persistent and Dynamic Objects	476	(25)
The Interface Methods and Properties	476	(1)
Creating and Manipulating Shares with ADSI	477	(2)
Enumerating Sessions and Resources	479	(12)
Manipulating Print Queues and Print Jobs	491	(10)
Permissions and Auditing	501	(31)
How to Create and ACE Using ADSI	502	(9)
A Simple ADSI Example	511	(2)
A Complex ACE Example	513	(4)
Creating Security Descriptors	517	(5)
Listing ACEs to a File for All Objects in an OU and Below	522	(10)
Extending the Schema and the Active Directory Snap-Ins	532	(19)
Modifying the Schema with ADSI	532	(10)
Customizing the Active Directory Administrative Snap-ins	542	(9)
Using ADSI and ADO from ASP or VB	551	(40)
VBScript Limitations and Solutions	552	(1)
How to Avoid Problems When Using ADSI and ASP	553	(1)
Combining VBScript and HTML	553	(6)
Binding to Objects Via Authentication	559	(10)
Incorporating Searches into ASP	569	(13)
Migrating Your ADSI Scripts from VBScript to VB	582	(9)
Scripting with WMI	591	(21)
Origins of WMI	592	(1)
WMI Architecture	592	(2)
Getting Started with WMI Scripting	594	(3)
WMI Tools	597	(2)
Manipulating Services	599	(2)
Querying the Event Logs	601	(3)
Querying AD with WMI	604	(3)
Monitoring Trusts	607	(2)
Monitoring Replication	609	(3)
Manipulating DNS	612	(17)
DNS Provider Overview	612	(2)
Manipulating DNS Server Configuration	614	(6)
Creating and Manipulating Zones	620	(3)
Creating and Manipulating Resource Records	623	(6)
Getting Started with VB.NET and System.DirectoryServices	629	(16)
The .NET Framework	629	(1)
Using VB.NET	630	(2)
Overview of System.DirectoryServices	632	(1)
DirectoryEntry Basics	633	(6)
Searching with DirectorySearcher	639	(1)
Manipulating Objects	640	(5)
Index	645