Active Directory (AD) is Microsoft’s proprietary directory service. It runs on Windows Server and allows administrators to manage permissions and access to network resources. Active Directory stores data as objects. An object is a single element, such as a user, group, application or device, e.g., a printer. Objects are normally defined as either resources, such as printers or computers, or security principals, such as users or groups.
The main service in Active Directory is Domain Services (AD DS), which stores directory information and handles the interaction of the user with the domain. AD DS verifies access when a user signs into a device or attempts to connect to a server over a network. AD DS controls which users have access to each resource, as well as group policies. For example, an administrator typically has a different level of access to data than an end user.
Active Directory Domain Services uses a tiered layout consisting of domains, trees and forests to coordinate networked elements.
- A domain is a group of objects, such as users or devices, that share the same AD database. Domains have a domain name system(DNS) structure.
- A tree is one or more domains grouped together. The tree structure uses a contiguous namespace to gather the collection of domains in a logical hierarchy. Trees can be viewed as trust relationships where a secure connection, or trust, is shared between two domains. Multiple domains can be trusted where one domain can trust a second, and the second domain can trust a third. Because of the hierarchical nature of this setup, the first domain can implicitly trust the third domain without needing explicit trust.
- A forest is a group of multiple trees. A forest consists of shared catalogs, directory schemas, application information and domain configurations. the schema defines an object’s class and attributes in a forest. In addition, global catalog servers provide a listing of all the objects in a forest. According to Microsoft, the forest is Active Directory’s security boundary.
- Organizational Units (OUs) organize users, groups and devices. Each domain can contain its own OU. However, OUs cannot have separate namespaces, as each user or object in a domain must be unique. For example, a user account with the same username cannot be created.
- Containers are similar to OUs, but Group Policy Objects (GPO) cannot be applied or linked to container objects
We will explore below in next few blog post:
- Install AD DS
- Configure new DC
- Join in Domain from Client host
- Add User Accounts
- Add Group Accounts
- Add Organizational Unit
- Add Computer Accounts
