Whats this about?
When I hear about Exchange Servers and Active Directory, I used to get irritated because I knew little about it. So, I decided to read up and write up. This is not an administration guide, just an overview, so sit back, relax and scroll down.
What’s Active Directory?
To me “Active Directory” is a dumb name, it doesn’t mean anything. Active Directory is meant to be a Directory Service. There are many types of Directory Services, for example a phone book or directory enquiries. They contain information (in a phone book, the information is about phone numbers) and it’s a service that you can use (eg a book that you can look through, a phone number you can call or a website you can visit).
Active Directory is the directory service included with Windows servers. It stores all the information you would need to manage a windows network, for example user accounts, file servers and printers, and the rules about who’s allowed to do what (Group Policy Objects or GPOs).
You might have noticed the word Object pop up there in GPO. The data stored in this ‘Active Directory’ is organised into things called objects. The Active Directory Schema is where you define what kinds of objects you can put in your directory. If you’ve never heard of objects and schema and you are a bit confused, then I suggest you google it, it’s quite similar to XML schema.
It’s a confusing word “object”, because it obviously means something special in this context.. but it’s an abstract term, so it’s hard to remember. In my head, I substitute object with “thing”, because I can understand things. I don’t understand objects because “object” weird
Lots More Confusing Words
I think Active Directory should actually be called ‘Lots of Confusing Words’ because that’s what it is, and that’s what’s coming up next.
In Active Directory you have to organise all your information into objects, so you need to put it into some kind of structure. So Microsoft made up all these things to help you structure your directory, and here they are.
All your computers are probably networked. So you normally organise your LAN into a Site. Site means your physical site. You group things into sites because you need to distribute directory information across your whole windows network, so organising your computers into sites helps you manage this information sharing.
You put all your users, printers, email addresses, databases etc. into domains. You can make one domain and use it over different sites or locations. So if your organisation has two main sites in two cities, you don’t need to make two domains, you can use one big domain.
Domain Controller – Oh yes, the DC, something you can touch. This is your active directory server that keeps a copy of the domain directory. You can have more than one domain controller in a domain. A domain controller can only service one domain. A domain controller is the server that checks user logins etc.
Trees – this is when you create a domain hierarchy. By making a tree of domains in your active directory, you can administrate and manage your network more easily. This is actually quite a simple idea, and it’s tied in to DNS a bit. Imagine you have a domain name cyleft.wordpress.com. wordpress.com is the top level domain or main site, and cyleft.wordpress.com is my bit. There are lots of ‘child’ domains under wordpress.com for everybody else who uses wordpress like torinelson.wordpress.com, everyone looks after their bit. So you can think of it like a tree, with wordpress.com at the root, and cyleft, and torinelson as two branches coming out from there, among others. That’s what your tree is, a domain tree helps you organise your directory.
Trees are fine, but Forests? Are you kiddin? If for example, you had blogspot.com as a domain tree and wordpress.com as another domain tree, you can make a forest! Whoopeee! Now you can share Active Directory Schema, and communicate between trees etc. Both trees trust each other, so if you logon to one tree, the other tree trusts that you’re authenticated and logged on (otherwise you’d need to login to both trees)
Organisational Unit (OU) is another confusing name. You make OUs to help you administrate your network, so you can have lots of administrative groups to manage your actual windows network. You can put OUs in other OUs to make a nice tree as well.
If you have more than one domain in a forest, you need a global catalog so that you can login no matter which domain controller you are using. That’s what the global catalog does, it stores all group membership information. This is usually stored on a global catalog server and cached on each domain controller.
Users and Groups
Now when you login to your computer, you can login in two ways. One, your username and password is stored and checked on your computer, known as a Local User Account. The other place you can store and check your password in is the Domain Directory on a domain controller, making it a domain user account. This means that you can have local administrative accounts that can control your computer, and domain administrator accounts which let you change things in the domain, tree or forest.
You also have user groups. These are just to group users and things together. You can have different types of groups, some are limited to a single domain, and some groups let you grant permissions and access to anything in any domain in the forest.
Here comes Group Policy. It should really be called Grouped Policies I think. A GP is a collection of settings that tell you how programs, the operating system etc. work for users and computers in the active directory. You save them in a group policy object and apply it to domains, sites, OUs etc. It doesn’t mean that you create some policies or settings that you apply to a group, even though that’s how it sounds. GPs are not applied to groups, you apply them to domains, or OUs or whatever. Stupid I know. You can have local GPOs for your local computer and domain policy GPOs which get applied to every user in the domain.
Tools & Utilities
I’m just going to put in a list of tools and utils used to administer/diagnose active directory. If you want to know more, leave a comment:
- netdiag.exe
- dcdiag.exe
- ntdsutil.exe (NT Directory Service was the old name for Active Directory type stuff in years gone by)
- dcpromo
- gpedit.msc
- netdom
- dsastat
- repadmin
- dsadd, dsmod, dsquery
- whoami
- runas
- gpresult
There are lots of details about Active Directory which will bore the hair off your eyebrows but I have already had enough of Active Directory now, so I will conclude here. The majority of Active Directory is straightforward, there are just lots of new words to hate.
