When was Launch Active Directory?

IT administrators have been working with and around Active Directory since the introduction of the
technology in Windows 2000 Server. Windows 2000 Server was released on February 17, 2000 but many
administrators began working with Active Directory in late 1999 when it was released to manufacturing
(RTM) on December 15, 1999.

What are roles of the Active Directory?

 Active Directory Domain Services (AD DS): - Active Directory is used by 93% of the Fortune
1000.
 Active Directory Lightweight Directory Services (AD LDS):- AD LDS is the lightweight, developer-
friendly, directory that can be deployed on a client computer and client operating system as well
as on a server. It isn’t as full featured as AD DS (for example, Group Policy isn’t part of it) but it
can be useful as a decentralized directory for developers and testers.
 Active Directory Federation Services (AD FS):- AD FS is a claims-based identity solution that
helps independent organizations connect their directory services technologies together to
facilitate single sign-on and cross-organizational resource access. Today, it has become a fairly
common solution because it helps organizations connect to cloud services such as Microsoft
Azure.
 Active Directory Certificate Services (AD CS).
 Active Directory Rights Management Services(AD RMS)

How many type of group policy?

1. Local Group Policy

2. Site-linked policies
3. Domain-linked policies
4. OU-linked policies

What is sequence to apply group policy?

Any policy that is configured by two or more GPOs will be overwritten or modified by the last GPO that is
processed. For example, if a site policy is applied that modifies system settings, and an OU policy
modifies the same system settings, then the OU policy will take precedent because it is processed last.
Additionally, if a policy is enforced, the settings that are defined by that specific policy cannot be
overwritten by a subsequent GPO, even if the other GPO is processed last.

By default, GPOs are also reapplied every 90 minutes, with a randomized offset of up to 30 minutes. For
domain controllers, the policies are refreshed every 5 minutes. Both of these refresh settings can be
configured by using Group Policy.

What is SYSVOL?

The system volume (SYSVOL) is a special directory on each DC. It is made up of several folders with one
being shared and referred to as the SYSVOL share. The default location is %SYSTEMROOT
%\SYSVOL\sysvol for the shared folder, although you can change that during the DC promotion process
or anytime thereafter.
What are stored in SYSVOL folder?

 Group Policy templates (GPTs), which are replicated via SYSVOL container (GPC)is replicated via
Active Directory replication.
 Scripts, such as startup scripts that are referenced in a GPO.
 Junction points:- Junction points work like a shortcut. One directory can point to a different
directory. In File Explorer, a junction point and a directory look and feel the same. You can view
junction points by running the dir /AL /S command.

How to SYSVOL replication occurs?

SYSVOL replication occurs over DFSR. Initially with Windows 2000 Server, Windows Server 2003, and
Windows Server 2003 R2, replication was handled by File Replication Service (FRS). Starting with
domains created in Windows Server 2008, DFSR is the default SYSVOL replication method. FRS wasn’t
very efficient. Any time that a file in SYSVOL changed, FRS replicated the entire file to all domain
controllers. With DFSR, only the changed part of the file is replicated, although only for files over 64KB.
DFSR uses Remote Differential Compression (RDC). RDC is what enables the replication of only changed
data. Some admins may remember migrating from FRS to DFSR when Windows Server 2008 was
released. Without reliable and timely replication, one side effect that users may experience is
inconsistent GPO application since the SYSVOL data may not be in sync across all of the DCs.

How to migrate FSR to DFSR?

Trusts

A trust is a relationship between forest and/or domains. In a forest, all of the domains trust each
because a two-way transitive trust is created when each domain is added. This allows authentication to
pass through from one domain to any other domain in the same forest. You can create trusts outside of
the forest too with other AD DS forests and domains or Kerberos v5 realms.

Each trust in a domain is stored as a trusted Domain object (TDO) in the System container. Thus, to find
and list all of the trusts and trust types in a domain named contoso.com, run the Windows PowerShell

Command:

Get-ADObject –SearchBase “cn=system,dc=contoso,dc=com” –Filter * -Properties trustType | where

{$_.objectClass –eq “trustedDomain”} | select Name,trustType

What is Active directory database?

The Active Directory database is made up of a single file named ntds.dit. By default, it is stored in the
%SYSTEMROOT%\NTDS folder. The folder also contains the following related files:

1. Edb.log. There are typically multiple log files starting with “edb” such as edb0013A. log and
edb0013B.log. Additionally, there is the edb.log file which is the active log file. These logs are
the transaction logs used to record changes made in AD DS. All changes are first written to a
transaction log and eventually make their way into the database a short time later.
2. Temp.edb. As the name implies, this file is a temporary file used to track transactions that are
taking place. It is also used when you run a database compaction job.
 3. Res1.log and res2.log or edbres00001.jrs and edbres00002.jrs. These log files are each 10MB in
space and used in a situation where you are critically low on disk space on the system volume. In
older versions of Windows Server, the res1.log and res2.log files are used. Since Windows Server
2008, the “edbres” naming is used, along with a new file extension of .jrs.

The Active Directory database is based on Microsoft’s Joint Engine Technology (JET) which is a database
engine that was developed in 1992.

Microsoft chose to use the Indexed Sequential Access Method (ISAM) model for indexing data in the AD
DS database.

What is active directory replication?

Active Directory replication is the method of transferring and updating Active Directory objects from one
DC to another DC. The connections between DCs are built based on their locations within a forest and
site.

Which topologies active directory relies for replication?

Active Directory replication relies on the following technologies to operate successfully:

1. DNS
2. Remote procedure call (RPC)
3. SMTP (optional)
4. Kerberos
5. LDAP

How many component of replication in active directory?

There are four main components of replication in Active Directory:

1. Multimaster replication. Multimaster replication, compared to single-master replication as used

in Windows NT 4.0, ensures that each domain controller can receive updates for objects for
which it is authoritative. This provides fault tolerance within an Active Directory environment.
2. Pull replication. Pull replication ensures that DCs request object changes instead of changes
being pushed (especially unnecessarily). Pulling slightly reduces replication traffic between DCs.
3. Store-and-forward replication. Store-and-forward replication ensures that every DC
communicates with a subset of DCs to transfer the object changes that have occurred. With
store- and-forward, every DC would communicate with every other DC, which is inefficient.
Store-and- forward replication balances the replication load among the DCs within an Active
Directory environment.
4. State-based replication. State-based replication ensures that each DC tracks the state of
replication updates which eliminates conflicts and unnecessary replication.

Knowledge Consistency Checker (KCC).

Replication is managed by the Knowledge Consistency Checker (KCC). The KCC manages replication
between DCs in a single site by using automatically created connections. The KCC reads configuration
data and reads and writes connection objects for DCs. The KCC only uses RPC to communicate with the
directory service.
Intrasite replication

Intrasite replication does not use compression and changes are sent to DCs immediately. However,
intersite replication relies on user-defined links that must be created.

The KCC uses these links to create a topology so that replication is managed across the site-to-site links.
Site connections can be controlled on a schedule and the replication data is compressed to minimize
bandwidth usage.

The default replication schedule for site-to-site connections is 180 minutes which is usually way too long
for the vast majority of organization. This can be configured to as low as 15 minutes in the GUI, and even
faster by modifying the registry.

A replication packet size is calculated based on the amount of RAM in the DC. By default, the packet size
limits are 1/100th the size of RAM, with a minimum of 1 MB and a maximum of 10 MB. Additionally, the
maximum number of objects in a packet is 1/1,000,000th the size of the system RAM, with a minimum
of 100 objects, and a maximum of 1,000 objects.

Therefore, in modern servers that have more than 1 GB or RAM, replication packet sizes will either
contain up to 10MB of data or up to 1,000 objects. .The maximum packet size and object limit can be
configured by modifying the registry in the following location:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters

What are primary replication components?

1. Knowledge Consistency Checker (KCC). The KCC is a process that runs on each DC and
communicates directly with Ntdsa.dll to read and write replication objects.
2. Directory System Agent (DSA). The DSA is a directory service component that runs as Ntdsa.dll
on each DC. It provides an interface for services and processes to read the directory database.
3. Extensible Storage Engine (ESE). The ESE manages directory database records, which may
contain one or more columns.
4. Remote Procedure Call (RPC). Directory replication is communicated by using the RPC protocol.
RPC is a communication protocol that allows developers to execute code on a local or remote
system without having to develop specific code for remote execution. The KCC also uses RPC to
communicate with DCs to request information when building a replication topology.
5. Intersite Topology Generator (ISTG). The ISTG manages the intersite inbound replication
connection objects for a specific site. There is one ISTG server in each site. By default, the first
DC in each site is the ISTG. To find the ISTG in a site named HQ in a domain named
tailspintoys.com, you can run the Windows PowerShell command:

Get- ADObject –Identity "cn=NTDS Site Settings,

cn=HQ,cn=sites,cn=configuration,dc=tailspintoys,dc=com" –Properties interSiteTopologyGenerator |
Select interSiteTopologyGenerator

What are Active Directory objects?

1. Sites. Sites are Active Directory objects in the site class, which correspond to the subnets in a
given site.
 2. Subnets. Subnet objects are in the subnet class, and define the network IP subnet that is
corresponded with a site.
3. Servers. A server object, in the server class, represents server computers, including DCs. Server
objects are treated as security principals which are stored in a separate directory partition and
have separate globally unique identifiers (GUIDs).
4. NTDS Settings. NTDS Setting objects are in the nTDSDSA class, and represent an instance of
Active Directory on a specific DC.
5. Connections. Connection objects are in the nTDSConnection class, and define a one-way,
inbound route from a source DC to the DC that is storing the connection object.
6. Site Links. Site Link objects are in the siteLink class, and identify the protocol and schedule to
replicate data between two or more sites.
7. NTDS Site Settings. NTDS Site Setting objects are in the nTDSSiteSettings class, and identify site-
wide settings for Active Directory. There is only one NTDS Site Settings object per site in the Sites
container.
8. Cross-reference. Cross-reference objects are in the crossRef class, and store the location of
Active Directory partitions in the Partitions container.

The diagram below shows a typical two-site Active Directory environment with some of the replication
components.

There are 25 cmdlets to specifically manage Active Directory replication. These cmdlets offer
functionality such as viewing replication information, configuring sites, managing site links, and forcing
replication to occur. The RepAdmin.exe command line tool is also available to provide information and
configure Active Directory replication. Another replication tool is the Active Directory Replication Status
Tool. It is available at http://www.microsoft.com/ en-us/download/details.aspx?id=30005.

DNS

AD DS provides a built-in method of storing and replicating DNS records by using Active Directory-
integrated DNS zones. All of the records and zone data stored within the zone are replicated to other
DNS servers by using the native AD DS replication service. Each DC stores a writable copy of the DNS
zone data for namespaces for which they are authoritative.

DNS zone data is stored in an application directory partition. A forest-wide partition named
ForestDnsZones is used for the zone data. For each AD DS domain, a domain partition is created named
DomainDnsZones.
Security

Security is a huge topic because it encompasses so many areas. Even in a specific technology like AD DS,
security is a huge topic. For this e-book, we will focus on 3 specific areas of security in AD DS:

1. Securing LDAP traffic with SSL/TLS

2. Modifying the access control list (ACL) on administrative accounts
3. Enabling strong authentication in a domain

Intrasite versus Intersite Replication

Because Active Directory can hold thousands, or even millions, of objects, replicating changes to those
objects can easily consume network bandwidth and the system resources of domain controllers.
Replication is handled differently between domain controllers in the same site (intrasite replication) and
between domain controllers in different sites (intersite replication).

Intrasite replication sends replication traffic in an uncompressed format. This is because of the
assumption that all domain controllers within the site are connected by high-bandwidth links. Not only is
the traffic uncompressed, but also replication occurs according to a change notification mechanism. This
basically means that if changes are made in the domain, those changes are quickly replicated to the
other domain controllers.

Intersite replication sends all data compressed. This shows an appreciation for the fact that the traffic
will probably be going across slower WAN links (as opposed to the LAN connectivity intrasite replication
assumes), but it increases the load on the server side because compression/decompression is added to
the processing requirements. In addition, the replication can be scheduled for times that are more
appropriate to your organization. For example, you may decide to allow replication only during slower
times of the day. Of course, this delay in replication (based on the schedule) causes a delay in replicating
changes between servers in different sites.

You create additional sites when you need to control how replication traffic occurs over slower WAN
links. For example, suppose you have a number of domain controllers on your main LAN and a few
domain controllers on a LAN at a branch location. Those two LANs are connected to one another with a
relatively slow WAN link. You would want replication traffic to occur as needed between the domain
controllers on each LAN, but you would not want replication to occur as needed over the WAN link. To
address this situation, you would set up two sites—one site that contained all the domain controllers on
the main LAN and one site that contained all the domain controllers on the remote LAN.

Replication Transports

All communication within a network requires some transport to carry the information. The same is true
of Active Directory replication traffic. The two transports that are used to replicate data are Remote
Procedure Call (RPC) and Simple Mail Transfer Protocol (SMTP).

RPCs are for sending replication messages within a site and between sites. RPC is the default protocol
for all Active Directory replication because it is an industry standard and is compatible with most
network types.
SMTP can be used for replication between sites that are not connected with permanent connections
(which are required for RPCs). One caveat regarding SMTP is that it doesn't replicate domain partition
information to DCs in the domain. Because SMTP is used only for replication between sites, this is not a
problem for replication of domain partition information within the domain (because this will
automatically use RPC). This shows that SMTP is useful only for replication of the schema and the global
catalog.