Inside Active Directory
A book by Sakari Kouti and Mika Seitsonen

Content (1st Edition, AD2000)

Inside Active Directory contains the following 11 chapters, divided into three parts.

Part		Chapter	No of Pages
Part I: Background Skills	1	Active Directory: The Big Picture	64
Part I: Background Skills	2	Installation	51
Part II: Core Skills	3	Managing OUs, Users and Groups	82
	4	Securing Active Directory	104
	5	Sites and Replication	111
	6	Domains and Forests	84
	7	Group Policy	76
Part III: Advanced Skills	8	Active Directory Schema	60
	9	Extending the Schema	56
	10	Administration Script Concepts	63
	11	Administration Script Examples	143

The book contains 205 tables and 105 diagrams; 70 % of the book's spreads include either a table or a diagram. There are also 278 screen shots (of which 110 are sample scripts or their resulting output).

This page includes:

	Content Overview
	Chapters' Overview
	Table of Contents
	List of Tables

You can also view two entire chapters online, if you have Acrobat Reader:

	Chapter 3 in PDF format (509KB)
	Chapter 8 in PDF format (382KB)

Content Overview

We have divided the book into three parts.

	Part I: Background Skills (Chapters 1 and 2) gives the big picture of Active Directory so you can successfully plan and implement an Active Directory network. This part also discusses the installation of Windows 2000 and Active Directory.
	Part II: Core Skills (Chapters 3 through 7) describes the concepts, planning, and administration of both the physical and the logical structure of Active Directory. The topics presented in this part include user and group management, access control, and Group Policy. Even though Part III covers advanced skills, most chapters in this part discuss related advanced topics.
	Part III: Advanced Skills (Chapters 8 through 11) looks at advanced techniques, including the schema and scripting. Along with these topics we also uncover many aspects of Active Directory architecture. You can probably live without the information in these chapters, but by reading them you can greatly deepen your knowledge and understanding of Active Directory and make use of it when implementing and administering Active Directory networks.

Chapters' Overview

Mika wrote Chapter 2 and Chapter 7, and Sakari wrote the remaining chapters.

Chapter 1: Active Directory: The Big Picture

Before going into detail, we give you a general picture of Active Directory. After you learn the concepts introduced in this chapter, you can freely skip some later chapters that you might not be interested in. However, we encourage you to browse through the table of contents of any such chapter to make sure that you are not going to unintentionally miss anything important.

Chapter 2: Installation of Windows 2000 and Active Directory

In this chapter, we explain how to install both Windows 2000 and Active Directory. We also describe the post-installation tasks, as well as how to automate and troubleshoot installation.

Chapter 3: Managing OUs, Users, and Groups

Once you have an Active Directory domain up and running, one obvious task is to create a user account for each user and plan how to enhance user administration by using groups and organizational units (OUs). This chapter looks at managing OUs, users, contacts, groups, and computer objects, and covers some related topics.

Chapter 4: Securing Active Directory

Active Directory has an access control mechanism that enables you to define who can read or modify what information in Active Directory. In this chapter, we explain the concepts and architecture of access control, as well as how to manage permissions in various scenarios.

Chapter 5: Sites and Replication

For Active Directory to work efficiently when your network spans multiple geographic locations, you must plan and implement the physical structure and define it in Active Directory itself. In this chapter, we describe the concepts, management, and advanced topics of the physical structure. Some of the content is also relevant for a company with just one site.

Chapter 6: Domains and Forests

Active Directory has several levels of hierarchies that you can use to implement an effective logical structure for your company network. In this chapter, we discuss whether you should use one or many domains and one or many forests, and how you should plan and manage that logical structure. We also revisit the physical structure, because it somewhat overlaps with the logical structure. In addition, we explain the anatomy of LDAP searches.

Chapter 7: Group Policy

Active Directory has an extensive management architecture called "Group Policy." You can use Group Policy to manage user desktops and server settings, as we describe in this chapter. You learn the architecture, inheritance, and processing of Group Policy in this chapter.

Chapter 8: Active Directory Schema

This chapter examines the Active Directory data model and how it is enforced by the rules of the schema. After reading this chapter, you'll better understand how Active Directory works behind the scenes and you'll also gain knowledge that you can use if you are going to extend the schema.

Chapter 9: Extending the Schema

One of Active Directory's advantages over Windows NT is that you can extend Active Directory schema, either to accommodate directory-enabled applications or for some administrative purpose. In this chapter, we explain the considerations for extensions and describe the process itself.

Chapter 10: Administration Scripts: Concepts

By downloading scripts from the Internet or writing your own scripts and executing them you can greatly enhance and automate administration. In this chapter we explain how to get started with technologies such as Windows Script Host (WSH), VBScript, and Active Directory Service Interfaces (ADSI).

Chapter 11: Administration Scripts: Examples

In this chapter, we present over 50 sample scripts along with their explanations. Outputs of many of the scripts provide some architectural information about Active Directory and you can run those scripts without understanding what they do on each line. Therefore, you can use these scripts not only for various administrative tasks, but also to gain more knowledge about Active Directory. This chapter also introduces some additional scripting concepts, such as ActiveX Data Objects (ADO), between the sample scripts.

Preface

About the Authors

Acknowledgments

PART I: BACKGROUND SKILLS

Chapter 1
Active Directory: The Big Picture

Introduction to Active Directory

A Brief Description

The First Look at Active Directory

History

Previous Microsoft Network Operating Systems

The History of Directories

The History of Windows 2000

Active Directory Compared to Windows NT

Active Directory Compared to NDS

A Sample Company

Basic Building Blocks

Domain Controllers

Domains

Trust Relationships

Organizational Units and Other Objects

Groups

Sites

Replication

Global Catalog

Hierarchies

Single Domain with No OU Structure

OU Tree in a Single Domain

Domain Trees

Domain Names

Forest of Domain Trees

DNS Integration

Locating Computers and Services

Dynamic DNS Updates

Security and Policies

Access Control

Inheritance

Delegation of Administration

Group Policy

Architecture

Data Model

The Schema

Extending the Schema

Container and Leaf Objects

Partitions

Naming Objects

The X.500 Standards

LDAP

LDAPv3 Specifications

LDAPv3 Operations

Physical Architecture

ADSI

Kerberos Authentication

Public Key Infrastructure

Other Features

Virtual Containers

Publishing

Connecting to the Internet

Active Directory’s Current Limitations

No Forest Changes

Domain Nature

Other Limitations

Some Differences from NDS

The Next Version of Active Directory

Conclusion

Chapter 2
Windows 2000 Installation

Before You Install Windows 2000

Decisions That Cannot Be Reversed

Dual Booting

Requirements and Recommendations

Hardware Compatibility

Preparation

Installing Windows 2000

Starting Installation

The Setup Program

Installing Windows 2000 from the CD

Installing Windows 2000 from a Network

Using Alternative Drivers

Selecting an Installation Partition

The Setup Wizard

Components to Install

Date and Time Settings

Installing and Configuring a Network

Finalizing the Setup

Upgrading Your Operating System

After You’ve Installed Windows 2000 Server

Installing Windows 2000 Professional

Installing Active Directory

Requirements and Recommendations

Creating Domains, Trees, and Forests

Before Installation

The Installation Process

After Active Directory Installation

Verifying the Installation

Removing the DNS Root Domain and Configuring a Forwarding Address

Creating a Forward Lookup Zone and Enabling Dynamic Updates

Creating a Reverse Lookup Zone and Enabling Dynamic Updates

Other DNS-Related Tasks

List of Tables

Table 1.1: Windows NT versus Active Directory
Table 1.2: NDS Compared to Active Directory
Table 1.3: Syntaxes of Active Directory Names
Table 1.4: X.500 Standards
Table 1.5: LDAPv3 Specifications
Table 1.6: LDAPv3 Operations

Table 2.1: File Systems Supported by Windows 2000
Table 2.2: Hardware Requirements and Recommendations for Windows 2000 Server
Table 2.3: Important WINNT Switches
Table 2.4: Important WINNT32 Switches
Table 2.5: Windows 2000 Server Components
Table 2.6: Windows 2000 Server Upgrade Considerations
Table 2.7: Steps during Active Directory Installation
Table 2.8: Sample Configuration Used in This Book
Table 2.9: Windows 2000 Safe Mode Options
Table 2.10: Windows 2000 Recovery Console Commands

Table 3.1: The Predefined Containers in Active Directory
Table 3.2: The Predefined User Accounts in Active Directory
Table 3.3: The Predefined Built-in Local Security Groups
Table 3.4: The Predefined Groups in the Users Container
Table 3.5: End-User Memberships
Table 3.6: Properties of an OU Object
Table 3.7: The Nature of User and Contact Objects
Table 3.8: Name Properties of a User Object
Table 3.9: Significant Properties of a User Object: The Account Tab
Table 3.10: Significant Properties of a User Object: The Account Options
Table 3.11: Significant Properties of a User Object: The Profile Tab
Table 3.12: Informational Properties of User and Contact Objects
Table 3.13: Properties That Are Copied When Users Are Copied
Table 3.14: Comparing Domain Controllers and Other Computer Objects
Table 3.15: Name Properties of a Computer Object
Table 3.16: Properties of a Computer Object
Table 3.17: The Nature of Security and Distribution Groups
Table 3.18: Name Properties of a Group Object
Table 3.19: Symbol Letters for Group Names
Table 3.20: Properties of a Group Object
Table 3.21: The Extra Costs Related to Universal Groups

Table 4.1: Rights and Permissions Needed to Administer and Use Windows 2000
Table 4.2: Security Principal Types
Table 4.3: Well-Known Security Principals
Table 4.4: Overview of Permissions
Table 4.5: Parts of Dialog Box A (“Basic”)
Table 4.6: Elements of Dialog Box B (“Advanced”)
Table 4.7: Elements of Dialog Box C
Table 4.8: Permissions for a User Object by Categories
Table 4.9: Dialog Box A Permissions for a User Object by Category
Table 4.10: Dialog Box A Permission Mappings to Dialog Box C
Table 4.11: Special Object Permissions for Any Object Class
Table 4.12: Extended Rights for User Objects
Table 4.13: Extended Rights for Other Classes
Table 4.14: Base Schema Property Sets
Table 4.15: Property Sets: General Information
Table 4.16: Property Sets: Personal Information
Table 4.17: Property Sets: Public Information
Table 4.18: Property Sets: Remote Access Information
Table 4.19: Property Sets: Account Restrictions
Table 4.20: Property Sets: Logon Information
Table 4.21: Property Sets: Web Information
Table 4.22: Names of Object-Naming Properties
Table 4.23: Delegation of Control Wizard Common Tasks
Table 4.24: Inheritable Default Permissions for the Domain Object
Table 4.25: Noninheritable Default Permissions for the Domain Object
Table 4.26: Default Permissions for the Users and Computers Containers
Table 4.27: Default Permissions for the Domain Controllers OU
Table 4.28: Default Permissions for the First Domain Controller in the Domain Controllers OU
Table 4.29: Default Permissions for a New OU in a Domain
Table 4.30: Default Permissions for a New Contact or a New Shared Folder in a New OU
Table 4.31: Default Permissions for a New Group in a New OU
Table 4.32: Default Permissions for a New User in a New OU
Table 4.33: Permissions of Typical Security Principals
Table 4.34: Parts of a SID
Table 4.35: Identifier Authorities
Table 4.36: NT Authority SIDs
Table 4.37: Parts of a Security Descriptor
Table 4.38: Fields of an ACE
Table 4.39: ACE AccessMask Bits
Table 4.40: ACE AceFlags Bits
Table 4.41: ACE Flags Bits
Table 4.42: ACE AceType Bits
Table 4.43: How the ObjectType Field Identifies a Permission Target
Table 4.44: Logon Rights: Default Assignments for Domain Controllers
Table 4.45: Normal Privileges: Default Assignments for Domain Controllers
Table 4.46: Normal Privileges: Differing Default Assignments for Member Servers
Table 4.47: Advanced Privileges: Default Assignments for Domain Controllers
Table 4.48: Some Fixed Rights Assignments for Domain Controllers

Table 5.1: Active Directory Partition Types
Table 5.2: Replicas of an Active Directory Sample Forest
Table 5.3: Number of Domain Controllers in Each Domain and Site of a Forest
Table 5.4: Comparison of Intrasite and Intersite Replication
Table 5.5: Urgency Levels of Active Directory Replication
Table 5.6: Operations Masters
Table 5.7: Active Directory Objects for Sites and Replication
Table 5.8: Tasks for Setting Up a Single Site
Table 5.9: Tasks for the Default Site and Site Link
Table 5.10: Tasks for Additional Sites and Site Links
Table 5.11: Advanced Tasks for Setting Up Multiple Sites
Table 5.12: Tasks for Administering Sites
Table 5.13: Tools to Diagnose Replication
Table 5.14: Transport Protocols for Replication
Table 5.15: Options Property Bits of Site Links
Table 5.16: Options Property Bits of Connection Objects
Table 5.17: Options Property Bits of NTDS Site Settings
Table 5.18: Functions of the Active Directory Replication Process
Table 5.19: A Newly Created Object on DC1
Table 5.20: A Replicated Object on DC2
Table 5.21: A Change to a Property on DC2
Table 5.22: A Changed Property Replicated Back to DC1
Table 5.23: The High-Watermark Vector of DC1
Table 5.24: The Up-To-Date Vector of DC1
Table 5.25: USN of Each DC and Vectors of DC1: Initial State
Table 5.26: USN of Each DC and Vectors of DC1: Step 1
Table 5.27: USN of Each DC and Vectors of DC1: Step 2
Table 5.28: USN of Each DC and Vectors of DC1: Step 3
Table 5.29: USN of Each DC and Vectors of DC1: Step 4
Table 5.30: How Active Directory Handles Collisions
Table 5.31: Placement Rules for Operations Masters
Table 5.32: Placement Rules for Operations Masters in a Multidomain Forest
Table 5.33: How to See or Transfer the Role Owner
Table 5.34: Impact of Different Operations Master Failures

Table 6.1: Replication Traffic Amounts When Creating New Objects
Table 6.2: Per-Domain and Per-Forest Features
Table 6.3 Trust Types
Table 6.4: Properties of Cross-Reference Objects
Table 6.5: SystemFlags Property Bits of Cross-Reference Objects
Table 6.6: Permission Modifications for Delegating Child Domain Installation
Table 6.7: Permission Modifications for Delegating Domain Controller Installation
Table 6.8: The Main Parameters of an LDAP Search
Table 6.9: LDAP Search Filters
Table 6.10: The Escape Sequences in LDAP Search Filters
Table 6.11: Extended LDAP Controls of Active Directory
Table 6.12: LDIF Operations
Table 6.13: LDIF Modify Operations

Table 7.1: NT 4 System Policy Compared to Windows 2000 Group Policy
Table 7.2: Summary of Group Policy Contents
Table 7.3: Default Template Files in %SystemRoot%\Inf
Table 7.4: Important Properties of a Group Policy Container
Table 7.5: Processing Group Policies
Table 7.6: Slow Link Processing options
Table 7.7: Settings Used in Sample Scenario for Determining Effective Group Policy Settings
Table 7.8: Default Group Policy–Related MMC Consoles
Table 7.9: Groups with Permissions to Link GPOs
Table 7.10: Comparison of Published and Assigned Applications
Table 7.11: Registry Values for Starting Detailed Logging
Table 7.12: Registry-Based Settings for Group Policy Processing for Computer Objects
Table 7.13: Registry-Based Settings for Group Policy Processing for User Objects
Table 7.14: Client-Side Extension GUIDs and DLLs
Table 7.15: Group Policy History Registry Values
Table 7.16: Default Permissions for GPOs

Table 8.1: Uses of the Schema
Table 8.2: Inside Uses of the Schema
Table 8.3: Various Attribute Names
Table 8.4: Some Confusing Name Pairs
Table 8.5: Attributes of a classSchema Object
Table 8.6: Name and Identifier Attributes of a classSchema Object
Table 8.7: Microsoft Active Directory OIDs
Table 8.8: Structure and Containment Attributes of a classSchema Object
Table 8.9: Class Inheritance Attributes of a classSchema Object
Table 8.10: Class Categories
Table 8.11: Miscellaneous Attributes of a classSchema Object
Table 8.12: Default ACEs for a Group Object
Table 8.13: SDDL Permissions
Table 8.14: Attributes of an attributeSchema Object
Table 8.15: Some Name and Identifier Attributes of an attributeSchema Object
Table 8.16: Syntax and Content Attributes of an attributeSchema Object
Table 8.17: Syntaxes for Simple Data Types
Table 8.18: Syntaxes for String Data Types
Table 8.19: Syntaxes for Time Data Types
Table 8.20: Syntaxes for Reference Data Types
Table 8.21: oMObjectClass Values for “127” Syntaxes
Table 8.22: Search Attributes of an attributeSchema Object
Table 8.23: SearchFlags Bits
Table 8.24: Miscellaneous Attributes of an attributeSchema Object
Table 8.25: SystemFlags Bits

Table 9.1: Attributes of a New classSchema Object
Table 9.2: ClassSchema Object Attributes That Can Be Changed
Table 9.3: Attributes of a New attributeSchema Object
Table 9.4: AttributeSchema Object Attributes That Can Be Changed
Table 9.5: Means to Modify the Schema
Table 9.6: The Schema Manager Snap-in and the Attributes of an attributeSchema Object
Table 9.7: The Schema Manager Snap-in and the Attributes of a classSchema Object
Table 9.8: Display Specifier Attributes

Table 10.1: WScript and CScript Comparison
Table 10.2: Host Options for CScript and WScript
Table 10.3: WSH Script Settings
Table 10.4: Ways to Read and Write the Property Cache
Table 10.5: Get versus GetEx
Table 10.6: The Four Modes of PutEx
Table 10.7: Put versus PutEx
Table 10.8: Relevant ADSI Interfaces
Table 10.9: Properties of the IADs Interface
Table 10.10: Properties of the IADsContainer Interface
Table 10.11: Methods of the IADsContainer Interface
Table 10.12: Static Property Methods of the IADsUser Interface
Table 10.13: Methods of the IADsUser Interface
Table 10.14: Methods of the IADsGroup Interface
Table 10.15: Syntaxes and Data Types
Table 10.16: OLE Automation Data Types and Corresponding Active Directory Syntaxes

Table 11.1: The Two Ways to Access the Schema with ADSI
Table 11.2: Relevant Properties of the Abstract Schema Classes (IADsClass Interface)
Table 11.3: Properties of the Abstract Schema Properties (IADsProperty Interface)
Table 11.4: Name Formats to Use in the Trustee Property
Table 11.5: Generic Permission Mappings to Special Permissions
Table 11.6: ADSI and ADO Comparison
Table 11.7: The LDAP Search String Contents
Table 11.8: Search Options

Last modified 07/22/07

Inside Active DirectoryA book by Sakari Kouti and Mika Seitsonen

Content (1st Edition, AD2000)

Content Overview

Chapters' Overview

Table of Contents

List of Tables

Inside Active Directory
A book by Sakari Kouti and Mika Seitsonen