Active Directory Domain

Services (AD DS)

What are ADDS?
• Active Directory Domain Services (AD DS) provides the
functionality of an identity and access (IDA) solution for
enterprise networks.
• Store information about users, groups, computers, and
other identities.
• Authenticate an identity.
 The server will not grant the user access to the document
unless the server can verify the identity presented in the
access request as valid.
 Kerberos Authentication: a protocol called Kerberos is used to
authenticate identi-ties.

• Control access

• Provide an audit trail

Components of an Active Directory Infrastructure
 Active Directory data store

 Domain controllers

 Domain

 Forest

 Tree

 Functional level

 Organizational units

 Sites
Domain controllers (DC)

• DCs are servers that perform the AD DS role.

• The Kerberos Key Distribution Center (KDC) service, which

Performs authentication, and other Active Directory
services.
Forest

• A forest is a collection of one or more Active Directory

domains.
• The first domain installed in a forest is called the forest
root domain.
• The forest defines a security boundary.
Functional level
• The functional level is an AD DS setting that enables
advanced domain-wide or forest-wide AD DS features.
• Three domain functional levels:
 Windows 2000 native.
 Windows Server 2003
 Windows Server 2008.

• Two forest functional levels:

 Microsoft Window s Server 2003.
 Windows Server 2008.
 Requirements for Installing AD DS

Server • A computer running Windows Server 2008

requirements to
install AD DS • Minimum disk space of 250 MB and a partition
formatted with NTFS file system

• TCP/IP must be configured, including DNS

client settings
Network
configuration • DNS Server that supports dynamic updates must
be available or will be configured on the domain
controller

• Local Administrator permissions to install the first

domain controller in a forest
Administrator • Domain Administrator permissions to install
permissions additional domain controllers in a domain
• Enterprise Administrator permissions to install
additional domains in a forest
AD DS Installation Process

1 Install the Active Directory Domain Services role

using the Server Manager

Run the Active Directory Domain Services

2 Installation Wizard

3 Choose the deployment configuration

4 Select the additional domain controller features

Select the location for the database, log files, and

5 SYSVOl folder

Configure the Directory Services Restore

6 Mode Administrator Password
 Advanced Options for Installing AD DS

To access the advanced mode installation options,

choose the Advanced Mode option in the installation wizard or run
DCPromo /adv

Use the advanced mode options to:

• Create a new domain tree

• Use backup media as the source for AD DS information

• Select the source domain controller for the installation

• Modify the default domain NetBIOS name

• Define the Password Replication Policy for an RODC

 Installing AD DS from Media

Use Ntdsutil.exe to create the installation media

Ntdsutil.exe can create the following types of installation media:

• Full (or writable) domain controller

• Full (or writable) domain controller without SYSVOL data

• Read-only domain controller without SYSVOL data

• Read-only domain controller

Installing AD DS on a Server Core Computer
• Installing Server Core
Configuring AD DS Domain
Controller Roles
• What Are Global Catalog Servers?

• Modifying the Global Catalog

• Demonstration: Configuring Global Catalog Servers

• What Are Operations Master Roles?

• Demonstration: Managing Operation Master Roles

• How Windows Time Service Works

What Are Global Catalog Servers?

Domain

Domain
Domain Domain

Domain Domain
Domain
Global Catalog
Query

Result

Global Catalog
Server
 How Windows Time Service Works

Windows Time service (W32Time) PDC Emulator

provides network clock
synchronization for domain
controllers and client computers

In a Windows Server 2008 forest,

the PDC Emulator is used to
provide the authoritative time Domain controllers
for all other computers
Client
computers

Time synchronization is important because:

• Kerberos authentication includes a time stamp

• Replication between domain controllers is time stamped

steps